One Retention Period Does Not Fit Every Occupational Health Record
An employer reviewing years of safety files may find OSHA 300 Logs, audiograms, medical-surveillance results, exposure-monitoring reports, respirator evaluations, laboratory records, and ordinary HR documents stored together. The problem is that these records do not necessarily follow the same retention schedule.
OSHA medical records retention depends on what the record represents and which regulation applies. OSHA injury and illness records follow different rules from employee medical and exposure records, while hazard-specific standards may establish additional requirements. For employers managing occupational examinations and surveillance programs, Gulf Coast Occupational Medicine provides occupational-health services designed around industrial workforce needs.
Separate OSHA 300-Series Records From Medical and Exposure Records
A practical retention system starts by separating OSHA injury and illness records from records covered by OSHA’s employee medical and exposure record requirements.
OSHA 300 Logs, OSHA 300A Annual Summaries, and OSHA 301 Incident Reports generally must be retained for five years following the end of the calendar year they cover. During that period, employers must update the OSHA 300 Log when newly discovered recordable cases or changes to previously recorded cases occur.
Employee medical and exposure records can follow much longer schedules. Under 29 CFR 1910.1020, Access to Employee Exposure and Medical Records, qualifying employee medical records generally must be retained for the duration of employment plus 30 years, unless another OSHA standard establishes a different period.
Employers looking specifically at injury and illness reporting can also review GCOM’s OSHA recordkeeping guide.
What Falls Under the OSHA Medical and Exposure Record Rule?
An employee medical record can include occupational medical histories, questionnaires, examination findings, laboratory results, medical opinions, recommendations, and certain treatment records.
Employee exposure records are different. They may include workplace monitoring or measurements involving toxic substances or harmful physical agents, such as personal sampling, area sampling, wipe sampling, or other exposure data.
This distinction matters because the employer should classify the record before applying a retention period.
For employers coordinating exposure programs alongside occupational-health testing, GCOM’s workplace exposure monitoring guide provides additional context on how exposure data connects with workforce medical programs.
OSHA Record-Retention Matrix
The matrix is a planning tool. Employers should verify the exact regulation governing each record before setting a destruction date.
The Employment-Plus-30-Years Rule Has Important Exceptions
The familiar employment-plus-30-years rule should not be applied automatically to every document containing health information.
Under 1910.1020, some records are excluded from the general specified retention period. Examples include separately maintained health-insurance claim records and certain one-time first-aid records when the regulatory conditions are met.
Another exception applies to covered medical records for employees who worked less than one year. Those records do not have to be retained beyond employment under this provision if they are provided to the employee when employment ends.
The practical lesson is to classify the document first rather than label an entire folder “medical” and assign one retention date.
Build Your Record Schedule Around the Applicable Program
If your organization receives occupational examination, laboratory, audiometric, respiratory, or medical-surveillance records, identify the applicable program before deciding how the record should be managed.
Gulf Coast Occupational Medicine provides physical exams and health surveillance services for industrial employers. When occupational testing is tied to a particular exposure or regulatory program, clearly identifying the service and applicable standard can make internal record administration more consistent.
Audiograms Show Why One Universal Rule Can Fail
Hearing-conservation records are a useful example.
Under OSHA’s occupational noise standard, employers must retain employee audiometric test records for the duration of the affected employee’s employment.
Under the same standard, however, noise exposure measurement records are retained for two years.
That means two records created within the same hearing-conservation program can have different retention periods. Neither should automatically receive the five-year OSHA 300 period or a generic 30-year schedule.
Hazard-Specific Standards Can Add Different Requirements
The general 1910.1020 framework is not always the final answer.
For example, OSHA’s general-industry lead standard requires specified exposure-monitoring and medical-surveillance records to be maintained for 40 years or for the duration of employment plus 20 years, whichever is longer. Certain medical-removal records follow a different requirement.
Asbestos programs provide another example. Specific exposure-monitoring and medical-surveillance records can have separate retention requirements under the applicable asbestos standard.
Employers working with lead, asbestos, silica, noise, or another regulated hazard should therefore check both the general record-access rule and the specific hazard standard before assigning a retention period.
Employees May Have Access Rights to Covered Records
Retention is only one part of the employer’s responsibility.
Under 1910.1020, employees generally have access rights to relevant exposure records and their own covered medical records. A designated representative may also obtain certain records when the required authorization conditions are satisfied.
When access cannot be provided within 15 working days, the employer must inform the requester of the reason for the delay and the earliest date when the records can be made available.
Employers should build record-access responsibilities into the same system used for retention so they know where records are stored and who responds to requests.
Protect Clinical Information From Unnecessary Access
Employee access rights do not mean every supervisor, HR employee, or manager should have unrestricted access to clinical information.
Employers should distinguish between information legitimately needed for workplace administration and the employee’s underlying clinical record. Depending on the occupational-health program, an employer may need a work-status determination, restrictions, testing status, surveillance documentation, or follow-up requirement without needing every clinical detail generated during the examination.
A clear records process should therefore address retention, access, confidentiality, and authorized disclosure separately.
Six Records, Six Questions
A Louisiana manufacturer is reorganizing its occupational-health files.
The safety department finds OSHA 300 forms, annual audiograms, noise-monitoring reports, lead-surveillance results, respirator medical evaluations, and attendance records.
Instead of assigning one destruction date to the entire employee file, the company classifies each category. The OSHA 300-series records follow Part 1904. We check audiograms and noise measurements against the noise standard. The company reviews lead records under the lead standard. Other qualifying medical and exposure records are reviewed under 1910.1020.
Ordinary personnel records remain within the company’s separate HR retention program.
The result is a record map based on the document’s purpose rather than where the document happens to be stored.
What to Have Ready When Reviewing Your Record System
Before reviewing your occupational-health record process, organize the record categories your workforce generates, the hazards and surveillance programs involved, the applicable OSHA standards, where records are stored, who controls access, whether outside occupational-health providers maintain records, and the destruction schedules currently assigned to each category.
Having this information makes it easier to identify when a single retention rule has been incorrectly applied to different types of records.
Build the Record Map Before the Next Program Change
A reliable OSHA medical records retention process starts with record classification. Injury logs, employee medical records, exposure measurements, audiograms, medical-surveillance files, and substance-specific documentation should not automatically receive the same retention period.
Gulf Coast Occupational Medicine supports employers with occupational examinations, medical surveillance, laboratory testing, and related workforce-health services. If your organization is reviewing the occupational-health programs that generate these records, have your job categories, applicable standards, surveillance programs, and testing requirements ready.
Call Gulf Coast Occupational Medicine at (225) 753-7233 or use the GCOM contact page to discuss the occupational-health and medical-surveillance services supporting your workforce.
Frequently Asked Questions
How long must OSHA medical records be kept?
Employee medical records covered by 29 CFR 1910.1020 generally must be retained for the duration of employment plus 30 years. Exceptions apply, and specific OSHA standards can establish different requirements.
How long must OSHA 300 records be retained?
OSHA 300 Logs, OSHA 300A Annual Summaries, and OSHA 301 Incident Reports generally must be retained for five years following the end of the calendar year they cover.
How long should employers retain audiograms?
Under OSHA’s general-industry occupational noise standard, audiometric test records must be retained for the duration of the affected employee’s employment. Noise exposure measurement records follow a separate two-year period.
Can employees request access to their occupational medical records?
Yes. Employees covered by 1910.1020 generally have rights to access their own covered medical records and relevant exposure records. Designated representatives may also receive certain records when the rule’s authorization requirements are satisfied.
