Employee Access to Exposure and Medical Records: What OSHA 1910.1020 Requires

Most small business owners know they need an OSHA 300 log. Far fewer know that OSHA also gives employees a standing legal right to see their own exposure and medical records, and that the employer is on the hook for keeping those records intact for decades. The rule is 29 CFR 1910.1020, Access to Employee Exposure and Medical Records, and it quietly applies to more small businesses than most owners realize, especially any shop that does air monitoring, hearing tests, respirator medical evaluations, or blood lead testing.

Who This Standard Actually Covers

1910.1020 applies whenever an employer generates or receives exposure records or employee medical records related to occupational exposure to toxic substances or harmful physical agents. That's a broad net. If you monitor noise levels and put workers in a hearing conservation program under 1910.95, those audiograms are medical records. If you send employees for respirator fit testing and physician evaluations under 1910.134, those questionnaires and clearance letters are medical records. If you have air sampling done for solvents, welding fume, or silica, those results are exposure records regardless of which employee they're tied to.

A common misconception is that this rule only applies to large manufacturers with industrial hygiene departments. It doesn't. A 12-person auto body shop that does periodic isocyanate air monitoring, or a small foundry that runs annual audiograms, is squarely covered. The trigger is the existence of the records, not the size of the company.

What Employees and Their Representatives Can Request

Under the standard, an employee, a former employee, or someone with the employee's written authorization can request access to their own exposure records and medical records. Requests must be granted within 15 working days. You cannot charge for the first copy, and you cannot require employees to explain why they want the records or to justify their request in any way.

Exposure records are treated differently from medical records in one important respect: employees are also entitled to exposure records for other employees who did substantially similar work in the same job classification and work area, even without written authorization, because that data helps establish a pattern of hazard. Medical records, by contrast, require the individual employee's written consent before anyone other than that employee can see them, with narrow exceptions for OSHA representatives conducting inspections and for occupational health professionals investigating a hazard.

Small businesses trip up here in two common ways. First, owners sometimes assume a departing employee forfeits the right to request records, which is false; former employees retain full access rights. Second, supervisors sometimes hand over a coworker's audiogram or fit-test results informally, assuming it's just internal paperwork, which is a records-access violation if the employee didn't authorize disclosure.

Retention Periods That Outlast the Job

This is the part that catches small employers off guard. Medical records covered by 1910.1020 must be retained for the duration of employment plus 30 years. Exposure records carry the same 30-year-plus-employment retention requirement. Background data for exposure records, like laboratory reports underlying a sampling result, only needs to be kept for one year, but the exposure determination itself needs the full 30-year tail.

Thirty years is longer than most small businesses keep any other type of record, and it's long enough that the business may change hands, change software systems, or change owners entirely before the retention period runs out. If you're planning to sell the business, close a location, or transition to new ownership, exposure and medical records need to either transfer with the business or be offered to NIOSH before disposal. You are not allowed to simply shred them because the company is winding down. If you stop doing business and there's no successor employer to take custody of the records, the rule requires notifying NIOSH at least three months before disposal so it can arrange to take them.

Building a Simple Compliance System Now

For most small businesses, the fix here isn't complicated. Start by identifying which programs generate covered records: hearing conservation, respirator medical evaluations, blood lead or cadmium monitoring, bloodborne pathogen exposure follow-ups, and any industrial hygiene air sampling. Store those records separately from general personnel files, ideally in a locked cabinet or access-controlled digital folder, since medical information carries confidentiality obligations beyond just 1910.1020.

Write down, even briefly, who in your organization is authorized to release these records and what the process looks like when an employee asks. A one-page internal procedure that says "requests go to the office manager, who verifies identity and provides copies within 15 working days at no charge" is enough to keep you compliant and keep a routine request from turning into a scramble. Finally, put a calendar reminder or note in your records system for the actual retention deadline. If you're not sure whether an existing record falls under this standard, the safer default is to treat it as if it does. The retention burden is real, but it's far lighter than the liability of destroying a document OSHA or an employee later needs.

Employees don't need a lawyer or an OSHA complaint to exercise this right; they just need to ask. Having the system ready before that request arrives is what separates a five-minute response from a compliance headache.