Topic
Records, privacy and security
Who may see an employee health record, and what you must be able to prove.
6 guides
How long you have to keep employee health records
OSHA 1910.1020 requires exposure records for 30 years and medical records for the duration of employment plus 30. What each category covers, what is exempt, and where the five-year OSHA log rule fits.
Jul 21, 2026 · 3 min read
Business associate agreements for occupational health vendors: A practical guide
A CFR-cited guide to the business associate agreement occupational health programs need: the two-part test, required clauses, and the employment-records carve-out.
Jan 3, 2026 · 7 min read
HIPAA vs. OSHA for employee health records: Which rules apply and when
HIPAA vs OSHA employee health records: most employee files fall under OSHA's 1910.1020 and the ADA, not HIPAA. See which rule applies and who can access them.
Oct 24, 2025 · 9 min read
Encrypting PHI at rest: What employee health programs need to know
Does HIPAA require encrypting PHI at rest? A plain-English guide for employee health teams on what to encrypt, key management, and the 2025 rule change.
Jul 16, 2025 · 8 min read
Audit logging for HIPAA: Building access logs for employee health data
What HIPAA actually requires for audit logs: the exact rules, what an access log must capture, how long to keep it, and how logs prove compliance to OCR.
Jun 22, 2025 · 7 min read
Data security checklist for employee health records: Protecting PHI end to end
An employee health data security checklist for occupational-health teams: HIPAA administrative, physical, and technical safeguards, plus how to self-audit.
May 15, 2025 · 8 min read