Medical & exposure records (1910.1020)

The Health records page is the register of employee medical and exposure records OSHA 1910.1020 requires. It enforces the rule's two binding duties — retention (medical records for employment plus 30 years, exposure records for 30 years) and consent-gated access — and writes every access attempt, granted or denied, to the tamper-evident audit log.

Register a record

1. Go to Health records and use the Register a record form.
2. Pick the Site, pick the Worker from your roster, choose the Kind (medical or exposure), the Record type (e.g. audiogram, blood lead), and the Record date, then click Register.
3. Attach the actual PHI document through the API (/api/health-records) — the record keeps only a storage reference, and the register shows "attached". By design the document never renders on the shared page; it is released only through the same consent gate.
4. When the worker leaves, click Employment ended… on their medical records and set the date — that starts the 30-year retention clock for them.

Request access — the consent gate

Access follows 1910.1020(e):

1. Click Access… on a record.
2. Enter the requester, and: for a medical record, the reference to the employee's specific written consent; for an exposure record, the stated purpose of the written request.
3. Click Request access. The result shows granted or denied with the reason — and both outcomes are logged. An employee's own record is never gated.

Downloading the attached document goes through the same gate via the API: denied requests get a 403, and the attempt is still audited.

Retention and disposal

• Each record shows a Retain until date computed from the rule: exposure = record date + 30 years; medical = employment end + 30 years (shown as "employment + 30 yr" while the worker is still employed — the record is kept with no fixed end until then).
• A daily retention sweep finds records past their horizon. Disposal deletes both the PHI document and the record, and the disposal itself is audited. The sweep runs report-only (dry run) until real disposal is switched on in configuration.

What happens automatically

• Retain-until dates are computed from the rule — nothing to calculate or remember.
• Every access attempt — record or document, granted or denied — lands on the audit log, which is itself the access record 1910.1020 effectively requires. Never bypass the gate.

This register holds the documents; the programs that generate them live in vaccinations & TB screening and respiratory protection.

Related

• Vaccinations & TB screening — Vaccination records feed the medical file
• Industrial hygiene — Exposure sampling and medical surveillance records
• Hearing conservation — Audiograms are protected medical data
• Respiratory protection — Medical clearances stored as health records
• Bloodborne pathogens — Exposure-incident records under consent-gated access