Access to Employee Medical Records

MIOSHA

Michigan Occupational Safety and Health Administration (MIOSHA)

Department of Labor and Economic Opportunity (LEO)

AGENCY

INSTRUCTION

DOCUMENT IDENTIFIER:

MIOSHA-COM-08-2R4

DATE:

March 1, 2022

SUBJECT: Access to Employee Medical Records

I. Purpose. Michigan Occupational Safety and Health Administration (MIOSHA) staff may

occasionally be required to conduct limited review of specific employee’s medical

records when MIOSHA Standards require such information. There may also be a need to

gain access to such information for the purpose of determining compliance with other

requirements of MIOSHA Standards. This instruction establishes procedures and

guidance for ensuring uniform interpretation and application of MIOSHA rules for

examining or copying personally identifiable employee medical information (PIEMI).

II. Scope. This instruction applies to the General Industry Safety and Health Division

(GISHD), the Construction Safety and Health Division (CSHD), and the Consultation

Education and Training (CET) Division.

III. References.

A. General Industry and Construction Safety and Health Standard Part 470.

/R325.3451 et seq., Employee Medical Records and Trade Secrets.

B. General Industry Safety and Health Standard Part 554. /R325.70001 et seq.,

Bloodborne Infectious Diseases.

C. Michigan Occupational Safety and Health Act, R408.1001 et seq., P.A. 154 of

1974, as amended.

D. MIOSHA Administrative Rule Part 11. /R408.22101 et seq., Recording and

Reporting of Occupational Injuries and Illnesses.

E. MIOSHA Field Operations Manual (FOM), as amended.

F. United States Department of Health and Human Services, Health Insurance

Portability and Accountability Act of 1996 (HIPPA) Unofficial Version, as

amended through March 26, 2013 45 CFR Part 160 and Subparts A and E of Part

164.

G. United States Department of Labor (US DOL), Federal Occupational Safety and

Health Administration (OSHA), Compliance Directive 02-02-072, August 22,

2007, Rules of Agency Practice and Procedure Concerning OSHA Access to

Employee Medical Records.

H. US DOL, OSHA Standard 29 CFR 1910.1020 Access to Employee Exposure and

Medical Records, as amended June 8, 2011.

I. US DOL, OSHA Standard 29 CFR 1913.10, Rules of Agency Practice and

Procedure Concerning OSHA Access to Employee Medical Records.

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

IV. Distribution. MIOSHA Staff; Federal OSHA; S-drive Accessible; MIOSHA Messenger;

and Internet Accessible.

V. Cancellations. This agency instruction cancels all previous versions of this agency

instruction.

VI. Next Review Date. This instruction will be reviewed in three (3) years from date of

issuance.

VII. History. History of previous versions includes:

MIOSHA-COM-08-2R3, November 20, 2017

MIOSHA-COM-08-2R2, November 6, 2014

MIOSHA-COM-08-2R1, August 1, 2011

MIOSHA-COM-08-2, September 19, 2008

VIII. Contact. Adrian Rocskay, Director, GISHD; Lawrence Hidalgo, Director, CSHD; and

Nella Davis-Ray, Director, CET.

IX. Originator. Bart Pickelman, Director

X. Definitions.

A. Access: The right and opportunity to examine and copy.

B. Administrative Subpoena: A written order issued by MIOSHA to require an

employer, or any other person, to produce listed records, documents, testimony

and/or other supporting evidence relevant to an inspection or investigation under

the Michigan Occupational Safety and Health Act. If the person served with a

subpoena refuses to honor the order, a referral may be made to the Attorney

General for appropriate action.

MIOSHA’s policies and procedures for issuing administrative subpoenas are set

forth in Chapter III of the MIOSHA FOM, as amended. According to the FOM,

the division director or designee may contact the Department of Attorney General

and request the issuance of an administrative subpoena.

C. Director: The Director of the Department of Labor and Economic Opportunity.

D. Electronic Medical Information: Health data or information created, converted, or

maintained in an electronic form. This includes, but is not limited to, information

on desktop or portable computer files, CD-ROM, compact disk, computer tape

and diskette, electronic mail, automated data processing, and web-based Intranet

and Internet applications.

E. Employee Medical Record (as defined in Part 470, Employee Medical Records

and Trade Secrets, 1910.1020(c)(6)(i)(A)-(F): A record concerning any medical

tests, examinations or health status of an employee that is made or maintained by

a physician, nurse, technician, or other health care personnel, including the items

listed.

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

1. These items include the following:

a) Medical and employment questionnaires or histories (including job

description and occupational exposures),

b) The results of medical examinations (pre-employment, pre-

assignment, periodic, or episodic) and laboratory tests (including

chest and other X-ray examinations taken for the purposes of

establishing a base-line or detecting occupational illness, and all

biological monitoring not defined as an “employee exposure

record”),

c) Medical opinions, diagnoses, progress notes, and

recommendations,

d) First aid records,

e) Descriptions of treatments and prescriptions, and

f) Employee medical complaints.

2. As stated in Part 470, Employee Medical Records and Trade Secrets,

1910.1020(c)(6)(ii)(A)-(D) Employee medical records do NOT include the

following:

a) Physical specimens (e.g., blood or urine samples) which are

routinely discarded as a part of normal medical practice; or

b) Records concerning health insurance claims if maintained

separately from the employer’s medical program and its records,

and not accessible to the employer by employee name or other

direct personal identifier (e.g., social security number, payroll

number, etc.); or

c) Records created solely in preparation for litigation which are

privileged from discovery under the applicable rules of procedure

or evidence; or

d) Records concerning voluntary employee assistance programs

(alcohol, drug abuse, or personal counseling programs) if

maintained separately from the employer’s medical program and

its records.

F. Personally Identifiable Employee Medical Information (PIEMI): Employee

medical information accompanied by either direct identifiers (name, address,

social security number, payroll number, etc.) or by information which could

reasonably be used in the particular circumstances to indirectly identify specific

employees (e.g., exact age, height, weight, race, sex, date of initial employment,

job title, etc.). However, employee exposure records and medical records required

to be provided by MIOSHA standards are not included in PIEMI.

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

G. Principal MIOSHA Investigator (PMI): The MIOSHA employee in each instance

of access to PIEMI, who is primarily responsible for assuring that the examination

and use of this information is performed in the manner prescribed by a written

medical access order (MAO) or employee medical records access authorization

letter and the requirements of this instruction. Typically, this is the safety officer

or industrial hygienist (SO/IH) who is conducting the enforcement inspection.

H. Medical Access Order (MAO): An authorization by the Department Director,

upon the recommendation of the MIOSHA Director, for specified MIOSHA staff

to examine or copy PIEMI contained in a record held by an employer or other

record holder. According to Part 470, Employee Medical Records and Trade

Secrets, Rule 21(2), a MAO must be signed by the Department Director.

XI. Application.

A. This instruction describes procedures to be followed when it is necessary to

access/review employee medical records. Access to some types of medical

records (personally identifiable employee medical information) normally requires

an employee authorization, a written medical access order (MAO) or an

administrative subpoena. Access to other types of medical records does not

require any of these authorizations.

B. Medical records that do NOT require an employee authorization, a written MAO

and/or an administration subpoena, include the following information/documents.

1. Medical information that is not in a personally identifiable form.

2. Records required by MIOSHA Administrative Rule, Part 11. Recording

and Reporting of Occupational Injuries and Illnesses.

3. Employee exposure records, including biological monitoring records as

described in Part 470, 1910.1020(c)(5)(ii) or monitoring records required

by specific occupational health standards. See Appendix A for a list of

common biological monitoring tests.

4. Employee medical records that are accessed solely to verify employer

compliance with the medical surveillance recordkeeping requirements of

an occupational health standard or with the requirements of Part 11.

5. Death certificates.

C. Medical records that DO require an employee authorization, a written MAO

and/or an administrative subpoena in order to access them, are records that

contain PIEMI.

D. In all instances, the identity of an employee and his or her right to privacy shall be

respected and appropriately safeguarded in accordance with statutory

requirements and guidelines contained in this instruction.

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

XII. Background.

A. On June 29, 1983, the State of Michigan adopted General Industry and

Construction Safety and Health Standard Part 470, Employee Medical Records

and Trade Secrets. This standard was amended February 18, 1998. On

December 12, 2018, Part 470 was amended and R 325.3451(4)(a) adopted by

reference 29 CFR 1910.1020 Access to Employee Exposure and Medical

Records, as amended June 8, 2011. Part 470. R 325.3471 Rule 21(1) provides

authority for access to medical records by the department. Sub rule 21(2) makes

reference to a written medical access order that must be signed by the Director for

access to PIEMI. The Director is defined in Part 470 as the Director of the

Department. Federal OSHA adopted, 29 CFR 1913.10, Rules of Agency Practice

and Procedure Concerning OSHA Access to Employee Medical Records to

address OSHA access to employee medical records. MIOSHA Standard, Part 470,

does not include 1913.10 rules.

B. On August 22, 2007, federal OSHA published Compliance Directive 02-02-072,

Rules of Agency Practice and Procedure Concerning OSHA Access to Employee

Medical Records. MIOSHA published its initial agency instruction on

September 19, 2008. The MIOSHA instruction is based on policies stated in the

FOM as well as the authority granted MIOSHA under the Michigan Occupational

Safety and Health Act and Part 470, Employee Medical Records and Trade

Secrets.

C. Individuals have expressed a heightened concern over the privacy of their

personal information. Among different sets of personal information, medical

information is among the most sensitive. In recent years, rules requiring the

protection of health privacy have been enacted by both the federal government

and the states. Still, an individual’s right to privacy regarding their health

information is not absolute. It does not, for instance, prevent reporting of public

health information on communicable and occupational diseases or prevent

MIOSHA from gaining access to necessary medical information.

XIII. Significant Changes.

A. Deleted references to CET consultant accessing PIEMI in Section X. G.

Definitions, PMI and Section XI. B. Application.

B. Added language to Section XII. Background, “Part 470 was amended and

R 325.3451(4)(a) adopted by reference 29 CFR 1910.1020 Access to Employee

Exposure and Medical Records, as amended June 8, 2011”.

C. Updated Part 470 rule references with 1910.1020.

D. Deleted language, “such as, but not limited to, MIOSHA consultation visits and

MIOSHA Voluntary Protection Program (VPP) sites” in Section XV. Reasons for

MIOSHA Access to Medical Records.

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

E. Deleted Section XIX. Process of Access and Review of PIEMI, F., “If there is a

need to retain copies of PIEMI in the case file, copies will be placed in an

envelope, sealed, and marked confidential. The envelope will be retained in the

case file. At the end of the case file retention period, copies of PIEMI information

shall be shredded.”

F. Deleted Section XXII. Confidentiality and Security of Medical Records, B.,

“When it is necessary to maintain PIEMI in an inspection case file, copies will be

placed in an envelope, sealed, and marked confidential. The envelope will be

retained in the case file. At the end of the case file retention period, copies of

PIEMI information shall be shredded.”

XIV. Responsibilities.

A. Division Directors shall be responsible for the overall administration and

implementation of these procedures within their own divisions, including making

final determinations concerning access to PIEMI.

B. Division managers or supervisors are designated as the division medical records

officer (MRO). The MRO shall report through the chain of command to the

agency director or designee, on matters concerning these procedures and shall be

responsible for the following:

1. Assuring that a written MAO meets the requirements of Section XVII of

this instruction.

2. Forwarding a written MAO through the chain of command to the

Director’s office for the Director’s approval or denial.

3. Responding to employee, union, and employer objections concerning

written MAOs.

4. Regulating internal agency use and security of PIEMI.

5. Ensuring that the results of agency analysis of PIEMI are, where

appropriate, communicated to employees.

XV. Reasons for MIOSHA Access to Medical Records.

A. Access to employee medical records in certain circumstances is important to the

agency’s performance of its statutory functions. It should be stressed that in most

cases, medical records that are not in a personally identifiable form, are sufficient

for MIOSHA purposes and readily available to agency personnel through the

employer in accordance with Part 470, Employee Medical Records and Trade

Secrets, R 325.3471, Rule 21(1). Due to the substantial personal privacy interests

involved, MIOSHA authority to gain access to PIEMI will be used only after the

agency makes a careful determination of its need for this information and only

with appropriate safeguards to protect individual privacy. A memorandum

explaining MIOSHA’s authority to access medical records is attached as

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

Appendix B. A copy of this memorandum may be provided to employers to help

explain MIOSHA’s authority.

B. The provisions set forth in Chapter III of the MIOSHA FOM and this instruction

are internal procedures that govern the circumstances under which MIOSHA

seeks access to PIEMI, and how the information is protected once it is in the

agency’s possession.

C. Agency practices and procedures are intended to preclude potential misuse of

employee medical information, while at the same time enabling medical records

information to play a constructive role in agency efforts to prevent occupational

injury and illness.

D. Employee medical records often provide the critical information needed to

determine whether an employee’s safety and health has been adversely affected

by conditions in the workplace. For example, MIOSHA access to employee

medical records may be necessary during inspections to determine whether an

employer has taken steps to abate existing violations. Access to employee medical

information may also be helpful to the agency during certain non-enforcement

inspections/audits to evaluate the effectiveness of Safety and Health programs at

workplaces.

XVI. Typical Procedures for Obtaining PIEMI. In most situations, employee medical records

containing PIEMI can be examined without obtaining a written MAO. The following

steps should be followed when requesting medical records.

A. See Appendix C for a flow chart on the basic process of and a list of

responsibilities for obtaining PIEMI.

B. Requests to review employee medical records must be specific. For example, to

determine compliance with the medical provisions of the asbestos rules, the

industrial hygienist should request only the records needed to determine

compliance and not entire medical files.

C. When it has been determined that it is necessary to access PIEMI, the PMI should

first contact the affected employees. The PMI can request that the employees

themselves obtain the information and provide it to the PMI. Alternatively, the

employee can authorize access to their PIEMI by completing the authorization

form accompanying this instruction (see Appendix D). The preferred method for

accessing a PIEMI is for the employee to provide a copy of the record or sign an

authorization.

D. If the PMI asks an employee to sign an authorization form giving MIOSHA

access to PIEMI, the PMI must explain the following to the employee.

1. The reason why MIOSHA needs to access this information.

2. Agency procedures for ensuring that the records are kept confidential.

3. The employee’s right to refuse the request for written consent.

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

4. That no adverse action will be taken against the employee if he or she does

refuse to give written consent.

E. If the employee provides a copy of the PIEMI record or signs an authorization

form to access his/her PIEMI, then Sections XVII through XVIII of this

instruction are not applicable.

F. If access is denied by the employee, the appropriate division MRO will be

contacted to review the need to proceed with obtaining a written MAO or

administrative subpoena as described in Section XVII of this instruction. In

addition, the request for a written MAO must include a written description of the

specific objections of the employee.

XVII. Obtaining a Written MAO and/or Administrative Subpoena.

A. The contents of a written MAO must include all of the information listed in the

written MAO (see Appendix E), before it will be approved by a division director

or the MIOSHA Director. The written MAO must be signed by the department

director per Part 470, Employee Medical Records and Trade Secrets, R 325.3471,

Rule 21(2). A written MAO may be approved and signed when all of the

following requirements are satisfied.

1. The information to be examined or copied is relevant to a statutory

purpose and there is a need to gain access to the information.

2. The information to be examined or copied is limited to only that

information needed to accomplish the purpose for access.

3. The MIOSHA personnel authorized to review and analyze the information

are limited to those who have a need for access.

B. Procedures for obtaining a written MAO.

1. The PMI must review the need for the written MAO with his/her

immediate supervisor and advise the appropriate manager and division

director prior to filling out a request.

2. Included in the information to be discussed are the following:

a) Employer records relevant to the inspection or consultation visit

such as MIOSHA 300, 301, or equivalent (exposure records, first

aid logs, etc.).

b) An explanation why it is necessary to the inspection to review

PIEMI.

c) The PMI in consultation with the supervisor must prepare and

submit a completed written MAO Form to the MRO.

C. Administrative Subpoena.

1. When reasonably certain that access will not be permitted, an

administrative subpoena should be presented to the employer concurrently

with a written MAO. If the employer refuses access to the information

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

listed on the written MAO, MIOSHA staff must seek an administrative

subpoena.

2. See Chapter III of the MIOSHA FOM, as amended, for specific

instructions for obtaining and issuing an administrative subpoena.

3. According to the MIOSHA FOM, the division director or designee may

contact the Department of Attorney General and request the issuance of an

administrative subpoena.

XVIII. Presentation of Written Medical Access Order and Notice to Employees.

A. The PMI shall present at least two (2) copies of the written MAO (see

Appendix E) and accompanying cover letter (see Appendix F) to the employer,

prior to examining or obtaining medical information subject to a written MAO.

B. The employer must be directed to promptly post a copy of the written MAO

(which does not identify specific employees by direct personal identifiers), as well

as post the accompanying cover letter.

C. The PMI shall also present a copy of the written access order (which does not

identify specific employees by direct personal identifier) and its accompanying

cover letter to each collective bargaining agent who represents an employee

whose medical records are subject to the written MAO.

XIX. Process of Access and Review of PIEMI.

A. The PMI acquires records specified in the employee authorization form, the

written MAO and/or administrative subpoena.

B. Only individuals identified on the employee authorization form, the written MAO

or administrative subpoena may be included in the review of PIEMI records.

C. MIOSHA employees and contractors are only authorized to use PIEMI for the

express purpose for which it was obtained as described in writing on the

employee authorization form or on the written MAO/administrative subpoena.

The only way PIEMI can be used for a secondary purpose is if the employee has

given specific written consent to use the PIEMI for a secondary purpose or unless

an additional written MAO and/or an administrative subpoena has been issued for

the secondary purpose.

D. If abnormal findings are discovered in the employee medical records, they must

be carefully evaluated. Abnormal readings are determined by a comparison with

the health care laboratory’s normal range for a particular test result. A laboratory

will usually indicate the normal range for each test on their report and also

indicate if a result is abnormal because the result is above or below the normal

range. When test results are determined to be abnormal, the PMI should ensure

that the following actions have been taken.

1. The employee is informed of the abnormal results.

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

2. The employer has complied with all other related requirements of specific

standards, such as medical removal requirements.

E. Whenever practicable, the examination of PIEMI shall be performed on-site with

a minimum of medical information taken off-site in a personally identifiable form.

F. If there is a need to obtain and review additional employee medical records not

covered in the initial written MAO, the PMI must discuss this with his/her

supervisor and go through all of the above required procedures again to gain

access to the additional information.

XX. Access to Information for Which a Written MAO is Not Required.

It is not necessary to obtain a written MAO to view medical records or PIEMI under the

following circumstances. NOTE: Even if a written MAO is not required to review

PIEMI, all medically related information reported in personally identifiable form must be

handled in the same manner as PIEMI that is obtained with a written MAO or

administrative subpoena.

A. Review of PIEMI with Specific Employee Written Consent. Access to records

without a written MAO or administrative subpoena is permitted when the specific

written consent of an employee is obtained and the agency or an agency employee

is listed on the consent form as the designated representative to receive the

information. See Appendix D for the authorization form to be used to obtain

employee consent to access their PIEMI.

B. Review of Medical Opinions mandated by MIOSHA Standards (i.e., Part 554,

Bloodborne Infectious Diseases). A PMI may view a physician’s opinion without

a written MAO as long as that information is limited to the specific information

the employer is required to retain pursuant to the provisions set forth in a

MIOSHA Standard. However, a written MAO would be necessary for review of

medical opinions that include information beyond the scope of what is required by

a MIOSHA standard, such as a medical diagnosis. Medical opinions do not

generally contain, and are not the same as, medical diagnoses.

1. Access to medical opinion information, without a written MAO, as

described in this section, shall be restricted to situations where MIOSHA

personnel have determined that a review of such information is necessary

to verify compliance with MIOSHA standards.

2. Review of medical opinions is restricted to information needed to verify

compliance.

C. Review of Specific Medical Information Required by a Medical Surveillance

Program.

1. General Information. In order to verify employer compliance with

requirements for medical surveillance records, the PMI may have access

without a written MAO to employee medical information which is part of

a medical surveillance program mandated by a specific MIOSHA standard

(i.e., in order to determine that the medical information exists).

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

2. It may also be necessary to review medical surveillance records mandated

by a specific standard to evaluate whether an employer is in compliance

with the requirements of that standard (e.g., to determine whether an

employer has instituted control measures that prevent employee absorption

of toxic substances or harmful physical agents). Medical surveillance

records include: 1) biological monitoring results; 2) specific diagnostic

test results used to verify an exposure; and 3) physicians’ written opinions

required to be maintained by a standard.

3. Review of Biological Monitoring Results. MIOSHA personnel are

permitted access without a written MAO to biological monitoring results

which directly assess the absorption of a toxic substance or harmful

physical agent by body systems (e.g., blood lead levels;

carboxyhemoglobin blood levels to evaluate carbon monoxide exposure;

cadmium levels in urine; etc.). These results are defined in Part 470.

1910.1020(c)(5)(ii) as exposure records, and therefore, a written MAO is

not required for MIOSHA access. Examples of biological monitoring or

laboratory test results that may be accessed/reviewed are provided in

Appendix A.

4. When accessing the specific medical information required by a medical

surveillance program authorized by this section, the PMI should make the

following determinations:

a) The employee, for whom the records are requested, is exposed to a

toxic substance or harmful physical agent in the course of

employment through a route of entry (e.g., inhalation, ingestion,

skin contact, or absorption, etc.). This determination of the

employee’s exposure includes both past and potential exposure.

b) The laboratory test included as part of the medical surveillance

program, is a recognized indicator of this employee’s past and/or

potential exposure to a toxic substance or harmful physical agent,

or a recognized indicator of an adverse health effect of such an

exposure. This can be derived from a variety of sources, including

recognized textbooks in the field of industrial hygiene, medicine,

and toxicology; publications; and technical journals.

c) Because instruments may be calibrated differently among several

laboratories, the normal range for laboratory test results may vary.

When evaluating test results, the PMI should compare the test

results against the normal range listed by the laboratory conducting

the test.

5. This section does not authorize the PMI to examine medical records for

the purpose of identifying trends of illness which are not directly related to

the recognized adverse effects of specific substances or agents addressed

by the tests listed in Appendix A of this instruction.

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

XXI. Medical Records that May or May Not Require an Employee Authorization or written

MAO to Access.

A. Review of Specific Diagnostic Test Results.

1. There may be a need to review the content of, and if appropriate, to copy

employee medical records that pertain to diagnostic tests which measure

or reflect the adverse effects of exposure to toxic substances or harmful

physical agents, and which are considered medical records under Part 470,

1910.1020(c)(6).

2. Diagnostic test results differ from biological monitoring results in that

diagnostic test results provide information which identifies a specific

disease or a specific health effect of a substance or agent. As an example,

an employee medical file may contain biological monitoring results from

blood and urine analysis for cadmium exposure as well as diagnostic test

results which identify renal tubular dysfunction or cancer resulting from

the employee’s exposure to cadmium.

3. Access to this type of medical information (i.e., the diagnostic test results)

in personally identifiable form shall only be done by obtaining a signed

employee consent; by asking the employee to request a copy of the

medical information from the health care provider and giving a copy of

that information to MIOSHA; or by obtaining a written MAO and/or

administrative subpoena.

B. Review of Medical Information to Verify Compliance with Administrative Rule

Part 11, Recording and Reporting of Occupational Injuries and Illnesses.

1. General Information: Part 11, R 408.22140, Rule 1140(1) states that an

authorized MIOSHA representative and other listed government

representatives must be provided with copies of required injury and illness

records that the employer is required to maintain. Therefore, MIOSHA

personnel do not need a written MAO to access the following records

required under Part 11.

a) MIOSHA Form 300, Log of Work-Related Injuries and Illnesses.

b) MIOSHA Form 300-A, Summary of Work-Related Injuries and

Illnesses.

c) MIOSHA Form 301, Injury and Illness Incident Report, or

equivalent.

d) Certain related information such as first aid logs or first report of

injury, that is not more detailed than the type of information

contained in MIOSHA Form 301.

2. Part 11 and this instruction authorizes MIOSHA personnel to examine

without a written MAO, the contents of, and if appropriate, to copy the

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

following additional employee medical information when needed to verify

compliance with Part 11 recordkeeping requirements:

a) Daily reports of new injury or illness cases.

b) First aid records.

c) Nurse/Physician/clinic logs.

d) Company accident reports, insurers’ accident report, and workers’

compensation basic report of injury.

e) Sanitized medical records available to employer officials outside

the medical office.

f) Return to work slips.

g) Records related to medical removal.

3. When the medical information authorized to be reviewed by this

instruction and Part 11 indicates that injuries and/or illness are occurring

that are not being recorded, the PMI must investigate the employer’s

rationale for not recording the injury or illness.

4. In order to conduct a complete investigation of all relevant information

related to injury and illness recordkeeping requirements, it may be

necessary to examine additional employee medical records. Access to

PIEMI related to injury and illness recordkeeping, but outside the scope of

the Part 11 authorization, must be done with an employee authorization

form; a written MAO or administrative subpoena; and in accordance with

procedures in this instruction.

C. Access to Human Immunodeficiency Virus (HIV) Diagnostic Records or

Bloodborne Infectious Diseases Records.

1. MIOSHA will not normally request access to medical records which

indicate a specific diagnosis of HIV. If it is absolutely necessary to obtain

PIEMI related to potential HIV exposures, diagnoses or infections, written

employee authorization must first be obtained.

2. If an employee alleges a bloodborne infectious disease exposure incident,

it is not necessary to document an actual diagnosis of HIV in the source

individual to cite post exposure follow-up and evaluation violations of

General Industry Safety and Health Standards Part 554, Bloodborne

Infectious Diseases.

3. In the case of HIV test results from post-exposure evaluation, MIOSHA

may request access to identify work-related seroconversion and to assure

that tested employees are provided appropriate post-exposure evaluation,

care, and counseling. In order to obtain these results, a signed employee

authorization or a written MAO and/or administrative subpoena must be

obtained.

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

4. The division director must be consulted and authorize any request for an

employee to sign an authorization to release PIEMI related to HIV.

5. No diagnosis of HIV may be copied or retained in an inspection case file.

D. Access to Alcohol or Drug Test Results.

1. MIOSHA’s access to complete medical records includes access to alcohol

or drug test results that are maintained as part of the employer’s medical

program and its records. In very rare circumstances (e.g., accident

investigations), alcohol and/or drug test results that are maintained as part

of an employer’s medical program may be pertinent to MIOSHA’s

investigation.

2. Alcohol and drug test results from voluntary employee assistance

programs (e.g., alcohol, drug abuse, or personal counseling programs) that

are maintained separately from the employer’s medical program are

exempted from the definition of “employee medical records” and may not

be accessed.

XXII. Confidentiality and Security of Medical Records.

A. MIOSHA personnel and their contractors are required to maintain the

confidentiality of all PIEMI and medical information/records that are either

reviewed during an inspection or are maintained in inspection case files.

B. MIOSHA personnel and their contractors shall not discuss any of the information

found in the records, which is associated with specific individuals, with any

employer or employee representatives except the physician or health care

personnel in charge of, or who has access to, employee medical records. This

restriction applies even in situations where such medical information may be

known to those specific (or other) individuals.

C. However, the PMI may reveal the following information to an employee whose

medical record has been reviewed:

1. The laboratory or biological monitoring test examined.

2. The rationale for examining that test.

3. The normal ranges used for each test and the sources of these ranges.

4. The numerical test result if known by the PMI.

5. The PMI must not attempt any further discussion with the employee of the

meaning of the results, conclusions, interpretations, diagnoses, etc., as

such judgments can be made only in view of the total medical record and

only by an examining physician. If the employee wants clarification,

he/she shall be referred to a physician for any discussion of test results.

D. Interagency Transfer and Public Disclosure.

1. PIEMI shall not be transferred to another agency or office outside of

MIOSHA (other than to the Attorney General) or disclosed to the public

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

(other than the affected employee or the original record holder) except

when required by law or approved by the MRO or division director.

2. Any requests for such transfers must be approved by the appropriate MRO

on a case-by-case basis.

E. Medical Records Maintained in Electronic Form. In some instances, employers

and other record holders may maintain PIEMI in electronic form. If the PMI

needs to have a copy of an electronic record, he/she should request to have a hard

copy provided.

XXIII. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy

Regulation.

A. MIOSHA requirements for access to employee medical records are unaffected by

the HIPAA privacy regulation. Employers have no basis to object that the privacy

regulation prevents them from providing records to MIOSHA, or to those with a

right of access under MIOSHA regulations, on the ground that authorization of

individual employees is required.

B. The HIPPA privacy regulation (45 CFR 160 and 164) generally requires that

covered entities such as health care providers handling individually identifiable

health information assure the confidentiality of such records. The fundamental

requirement of the regulation is that a covered entity may not use or disclose

protected health information (PHI) without the written authorization of the

individual to whom the records relate.

C. However, the regulation specifically provides exemptions for disclosures by

covered entities of health information without individual authorization to “public

health authorities” and to “health oversight agencies.” See 45 CFR 164.512(b)

and (d). The preamble to the HIPAA privacy regulation specifically mentions

federal OSHA as an example of both, 65 FR 82492, 82526.

D. A separate set of exemptions generally allows covered entities to disclose PHI as

required by law and as necessary for law enforcement and judicial and

administrative purposes. See 45 CFR 164.512(a), I, and (f).

E. The privacy regulation does not govern the treatment of PHI once MIOSHA

(which does not meet the definition of a covered entity under the regulation)

received it. Therefore, internal agency policies regarding use and disclosure of

medical information remain intact.

XXIV. Citation Guidelines.

A. The PMI should verify employer compliance with medical recordkeeping

requirements by interviewing employer and employee representatives, employees,

and where appropriate, physicians. The PMI may be required to verify

compliance by reviewing a variety of medical records.

B. When medical records are used to verify compliance:

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

1. Documentation of noncompliance will include only the employee’s name

and violation, not the specific medical information unless absolutely

required to fully document a violation and approved by the MRO.

2. Documentation of compliance will consist of a statement attesting to a

check of some of the records and compliance with the specific

recordkeeping requirement.

3. If copying or review of the PIEMI or other medical records is necessary,

the PMI must follow the procedures described in this instruction.

C. Citations, classification of citations, and penalty calculations must be done

according to policies described in Chapter VI of the MIOSHA FOM and Agency

or Division Instructions that describe enforcement procedures for specific

MIOSHA Standards.

XXV. Training Requirements. The division director/division managers are responsible for

ensuring that all MIOSHA field personnel have been adequately trained on internal

MIOSHA policies required for conducting inspections.

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

APPENDIX A

Examples of Biological Monitoring Tests/Results that may Reveal Work Related Absorption and/or

Exposure to a Toxic Substance or Harmful Physical Agent:

1. Audiograms

2. Blood Urea Nitrogen (BUN)

3. Complete blood count with differential and description of peripheral smear

4. Creatinine phosphokinase (CPK)

5. Blood Erythrocyte and plasma cholinesterase assays

6. Blood Erythrocyte sedimentation rate

7. Lactic dehydrogenase (LDH)

8. Metabolites found in blood or urine when a specific exposure is identified or postulated; i.e.,

carboxyhemoglobin levels to indicate previous exposure to carbon monoxide

9. Blood Platelet count

10. Pulmonary function tests

11. Radiologists’ interpretations of employee X-rays

12. Serum bilirubin, serum calcium, serum cholesterol, serum creatinine, or serum electrolytes

13. Serum glutamic-oxaloacetic transaminase (SGOT) or Aspartate aminotransferase (AST)

14. Serum glutamine-pyruvic transaminase (SGPT) or Alanine aminotransferase (ALT)

15. Serum phosphorus or serum triglycerides

16. Urinalysis, including test for hematuria, glucosuria, proteinuria, ketonuria, and microscopic

examination of urine

17. Urine and sputum cytology reports

18. Zinc protoporphyrin test (ZPP)

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

APPENDIX B

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

APPENDIX C

Typical Process for Obtaining Employee Medical Information

Principal MIOSHA Investigator (PMI)

• Identify potential need to review employee medical records.

• Determine whether required information is classified as: an exposure record, medical surveillance

record, information related to injury and illness recordkeeping requirements, or is classified as

personally identifiable employee medical information (PIEMI) which requires employee authorization or

a written medical access order (MAO).

• If a written MAO is not required, request records from employer.

• If required information is PIEMI, consult with the supervisor to determine if a need exists.

• Request copies of PIEMI from employee and/or authorization from employee(s).

• If employee authorization to access the PIEMI is not obtained, pursue a written MAO or administrative

subpoena with medical records officer (MRO).

• Fill out written MAO, accompanying letter, and submit to supervisor.

• Once the written MAO is signed by the Department Director and the administrative subpoena is signed,

present the documents to the employer or healthcare provider and request to review the PIEMI listed on

the written MAO.

• If the employer or healthcare refuses to honor the written MAO or administrative subpoena, immediately

inform the MRO, the division director, and the MIOSHA Director.

↓

Supervisor

• Discuss need to access PIEMI with PMI.

• Assist the PMI in filling out the written MAO and accompanying letter.

• Review the written MAO and submit the request to the MRO.

↓

Medical Records Officer (MRO)

• Decide if there is an identifiable and supportable need to obtain access to PIEMI through a written

MAO.

• Finalize the written MAO and the accompanying letter.

• Ensure that an administrative subpoena is requested and filled out when necessary.

• Forward the written MAO, accompanying letter, and/or administrative subpoena to the MIOSHA

Director.

↓

MIOSHA Director

• Approve the written MAO and/or administrative subpoena or request additional information.

• Forward the written MAO, accompanying letter and/or administrative subpoena to the Department

Director for final approval.

• If the written MAO or administrative subpoena is presented and refused, treat as a refusal of entry.

↓

Department Director

• Approve and sign the written MAO.

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

APPENDIX D

Return Address: ____________________ Inspection No.: _______________

____________________ IH/SO: _______________

____________________

AUTHORIZED LETTER FOR THE RELEASE OF MEDICAL

RECORD INFORMATION TO A DESIGNATED REPRESENTATIVE

I, ____________________________, hereby authorize_________________________________________

(Full name of worker/patient) (Individual/organization holding medical records)

_______________________ to release to the Department of Labor and Economic Opportunity,

General Industry Safety and Health Division OR Construction Safety and Health Division OR

Consultation, Education and Training Division, the following medical information from my personal

medical records:

_____________________________________________________________________________________________

(Describe specifically the information desired to be released and the specific date(s) of treatment.)

______________________________________________________________________________

I give my permission for this medical information to be used for the following purpose: ______________

____________________________________________________________________________________,

but I do not give permission for any other use or re-disclosure of this information.

(Note: Several extra lines are provided below so that you can place additional restrictions on this

authorization letter if you want to. You may, however, leave these lines blank. On the other hand, you

may want to [1] specify a particular expiration date for this letter [if less than one year]; [2] describe

medical information to be created in the future that you intend to be covered by this authorization letter;

or [3] describe portions of the medical information in your records which you do not intend to be released

as a result of this letter.)

_____________________________________________________________________________________

Any information received will be marked "Confidential" (i.e., to the extent allowed by law) and will

remain so as part of Inspection File No. ________________ for __________________________.

____________________________________________________________________________________

Full name of Employee or Legal Representative (Please Print)

_____________________________________________________________________________________

Signature of Employee or Legal Representative

Date of Signature:______________Birth Date:_______________Social Security No.:________________

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

APPENDIX E

Inspection Number: __________________________

Department of Labor and Economic Opportunity

Michigan Occupational Safety and Health Administration

(MIOSHA)

Employee Medical Records

Written Medical Access Order (MAO)

Record holder/Employer: ________________________________________________________________________

Address: ________________________________________________________________________

City, State, Zip: ________________________________________________________________________

Purpose(s) for seeking access order:

Why is it necessary to examine personally identifiable information?

Type of Employee Medical Information

Examined On-Site

Copied

Removed Off-Site

(1)

(2)

(3)

(4)

The following Principal MIOSHA Investigator will review and analyze the above-mentioned medical information:

Name(s)___________________________________________ Work Phone: (____)__________________

This written access order has been reviewed by: ______________________________ On ________________

Medical Records Officer (MRO) Date

______________________________ On ________________

MIOSHA Director Date

______________________________ On ________________

Department Director Date

Failure to comply with this order is a violation of Michigan P.A. 154 OF 1974, as amended, and may result in the

issuance of a citation and a penalty.

MIOSHA-COM-08-2R4

March 1, 2022

Access to Employee Medical Records

APPENDIX F

Date

Record Holder/Employer

Name

Address

City, State, Zip

Dear:

It has been determined by MIOSHA that in conjunction with an investigation or consultation site

visit, it is necessary to examine or copy personally identifiable employee medical information

(PIEMI).

As required by agency policy MIOSHA-COM-08-2, Access to Employee Medical Records, a

written medical access order (MAO) describing what information is needed and why has been

submitted and approved by the Director of the Department of Labor and Economic Opportunity.

Pursuant to this policy, the attached written MAO must be presented to the record holder, each

collective bargaining unit representing employees whose records are subject to the written MAO,

and when deemed appropriate, to each affected employee.

A copy of the written MAO and this accompanying cover letter must be posted in a central

location that is accessible to affected employees.

Questions concerning the written MAO may be directed to the principal MIOSHA investigator

or to the medical records officer listed on the written access order.

Sincerely,

Name

Division Director

cc: Principal MIOSHA Investigator

Medical Records Officer

MIOSHA Director