How long you have to keep employee health records

Retention is the question employee health teams get wrong most often, in both directions: destroying records that had decades left to run, and keeping everything forever because nobody could find a defensible answer.

The short answer

Three clocks, from two different rules. Under 29 CFR 1910.1020, employee exposure records are kept 30 years from the date the record was made, and employee medical records for the duration of employment plus 30 years. The OSHA 300 Log, 300A and 301 are a separate obligation: five years after the calendar year they cover. Health insurance claims kept separately, qualifying first-aid records, and the records of employees who worked less than one year and were given their records on termination are exempt from the 30-year rule.

There are three different clocks, they come from different rules, and they do not agree with each other.

The 30-year rule: 1910.1020

OSHA's Access to Employee Exposure and Medical Records standard sets the long retention periods, and it distinguishes two categories.

Employee exposure records: 30 years

Records of exposure to toxic substances or harmful physical agents. This includes monitoring results, biological monitoring, and the material safety data relevant to the exposure. Thirty years from the date the record was made.

Employee medical records: duration of employment plus 30 years

Records concerning the health status of an employee, made by or for a physician or other licensed health care professional: medical histories, examination results, medical opinions, diagnoses, laboratory results, and employee medical complaints.

For a nurse who works twenty-five years and retires, that is fifty-five years from the date of hire.

What is exempt from the 30-year rule

Three categories do not carry the long retention, and this is where organizations most often over-retain:

• Health insurance claims records maintained separately from the employer's medical program.
• First aid records of one-time treatment for minor injuries, made on site by a non-physician, if kept separately.
• The records of employees who worked less than one year, provided the records are given to the employee on termination.

That last one has a condition attached. If you do not give the records to the departing employee, you keep them for the full period.

The five-year rule: OSHA recordkeeping

The OSHA 300 Log, the 300A Summary and the 301 Incident Reports are retained for five years following the end of the calendar year they cover.

This is a separate obligation from 1910.1020 and the shorter period does not release you from the longer one. A needlestick generates a line on the log (five years), an incident report (five years) and a medical record of the post-exposure evaluation (duration of employment plus thirty).

Destroying the medical record at five years because the log period expired is the most common serious error in this area.

Does HIPAA change the retention period?

Generally not in the way people assume. Most employee health records held by an employer for employment purposes are employment records, which fall outside HIPAA's definition of protected health information. They are governed by OSHA, the ADA and state law instead.

HIPAA does impose a six-year retention on certain documentation, but that applies to a covered entity's compliance documentation, not to the employee health file as such. If your organization is a covered entity, both regimes can apply to different records at once, which is an argument for a written retention schedule rather than a rule of thumb.

What about state law?

States may require longer, never shorter. Where a state plan or state health regulation sets a longer period, that governs. Check yours before writing a destruction schedule.

What to do with it

Three practical consequences:

• Do not destroy on a single schedule. A file that mixes first aid notes, exposure monitoring and a post-exposure evaluation has three clocks in it.
• Transferring the business does not end the obligation. Records go to the successor employer, who inherits the retention period.
• If you cannot find a record, you have not met the requirement. Retention includes retrievability, a box in a basement that nobody can index is not a retained record in any way that helps you.

Verify before you destroy

Retention rules are amended, and state requirements vary. Confirm the current text of 1910.1020 and your own state's requirements before acting on any schedule, including this one. The cost of checking is an afternoon; the cost of being wrong runs for decades.