Who Can See an Employee's Medical Records in Safety Software?

The respirator clearance for a new finisher comes back from the clinic as a PDF. Someone scans it into the safety app, where the superintendent, the office manager and three foremen have admin accounts. Nobody meant to share a medical record with five people. The software made it the default. That's the problem to solve before the first PDF goes in, and OSHA's own rules show where the line sits.

Under OSHA's rules, the employer usually receives a limited medical opinion, not the medical record: 29 CFR 1910.134(e)(6) for respirator clearance, 1926.1153(h)(6) for silica exams. Access to the full record belongs to the employee, to a designated representative with the employee's specific written consent, and to OSHA, under 29 CFR 1910.1020(e).

At a glance: Respirator: questionnaire and exam confidential (1910.134(e)(4)(i)); employer gets a limited recommendation (e)(6)(i). Silica: employer gets date, statement, respirator limits (1926.1153(h)(6)(i)); exposure limits or specialist referral only with written authorization (h)(6)(ii). Access (1910.1020(e)): the employee, a designated representative with specific written consent, OSHA; within 15 working days. Keep medical records for employment plus 30 years (d)(1)(i). ADA: separate medical files, confidential (29 CFR 1630.14(c)(1)).

What the employer is supposed to receive

OSHA's medical surveillance rules are built so the employer learns what it needs to manage the work, and not much more.

Respirator medical evaluation. Under 29 CFR 1910.134(e)(4)(i), the medical questionnaire and examinations are administered confidentially, during normal working hours or at a convenient time and place. The employer then gets a written recommendation from the physician or other licensed health care professional (PLHCP). Under 1910.134(e)(6)(i), that recommendation provides "only" three things: any limitations on respirator use, the need for follow-up evaluations, and a statement that the PLHCP gave the employee a copy. The questionnaire answers, with the employee's heart condition or medications, are not the employer's to read.

Silica medical surveillance. Under 29 CFR 1926.1153(h)(6)(i), the employer obtains a written medical opinion within 30 days of the exam, containing "only" the date of the exam, a statement that it met the requirements of the standard, and any recommended limitations on respirator use. Two more items, recommended limits on silica exposure and a referral to a specialist, appear only if the employee gives written authorization, under (h)(6)(ii). The full results go to the employee in a separate written report.

So the line is drawn in the rules themselves. A safety platform that puts the full clinic report next to the toolbox talk sign-in sheets has erased it.

Who has a right of access under 1910.1020

29 CFR 1910.1020 governs access to employee exposure and medical records. A medical record is defined broadly in 1910.1020(c)(6)(i): a record about the employee's health status made or kept by a physician, nurse or other health care personnel, including questionnaires, exam results, opinions and diagnoses. Paragraph (c)(6)(ii) excludes a few things, such as health insurance claims kept separately and voluntary employee assistance program records kept separately.

Three parties have a right of access to an employee's medical record:

Access is provided in a reasonable time, place and manner. If it can't be provided within 15 working days, the employer tells the requester why and when, under 1910.1020(e)(1)(i).

Exposure records are different. A designated representative's access to exposure records doesn't need the employee's medical consent, and a recognized collective bargaining agent counts as a designated representative for exposure records automatically, under the definition in 1910.1020(c)(3).

What "specific written consent" means

It's not a checkbox and not a clause in the hiring packet. 29 CFR 1910.1020(c)(12)(i) lists what it contains:

• the name and signature of the employee authorizing the release;
• the date of the authorization;
• who is authorized to release the information;
• the designated representative authorized to receive it;
• a general description of the medical information to be released;
• a general description of the purpose;
• a date or condition when it expires, if less than one year.

Appendix A to 1910.1020 gives a sample form. Keep the signed consent with the record it opens.

Your admins aren't a category in the rule

Nothing in 1910.134, 1926.1153 or 1910.1020 gives a supervisor, a safety manager or an office administrator access to medical information because of their job title. The Americans with Disabilities Act regulations point the same way: under 29 CFR 1630.14(c)(1), information from employee medical exams and inquiries is collected and kept on separate forms and in separate medical files and treated as a confidential medical record. Supervisors may be told about necessary work restrictions and accommodations, and first aid and safety personnel may be told when emergency treatment might be needed. That's the restriction, not the diagnosis.

In practice that means three rules for any software that holds medical documents:

1. Separate the opinion from the record. The respirator recommendation and the silica opinion are what supervisors work from. The questionnaire and the clinic report are not.
2. Name the people who may read medical records. One or two named people, not a role that every admin has.
3. Tie a representative's access to the employee's signed consent, and keep the document.

Retention follows the medical record wherever it lives: at least the duration of employment plus 30 years, under 29 CFR 1910.1020(d)(1)(i). How long to keep OSHA records has the full chart.

How HazComFast walls off medical opinions

Medical opinions are walled off. An administrator sees an employee's exposure records, not the medical opinion from a respirator evaluation or a silica exam, unless you name them medical custodian. A designated representative gets in only with the employee's written consent.

In HazComFast, medical custodian is an authorization given to a named person, on top of their usual role, and it can be revoked. Being an administrator or a manager isn't enough. An administrator can't name themselves custodian when another administrator could do it, and each authorization records who gave it and when.

A designated representative's access is tied to one employee and one representative, by name, and it needs the written consent itself: the signed document is uploaded, and without it there is no consent. The employee can withdraw it and consent again later. The employee always has access to their own record. And the answers to the respirator medical questionnaire are closed to administrators and managers entirely.

1910.1020 doesn't require software to keep a log of who opened a medical record, and HazComFast doesn't present these controls as a federal requirement. They're there because a medical record read by the wrong person can't be unread.

Related: Silica medical surveillance and the 30-day respirator rule · Who can see the OSHA 300 Log? · How long to keep OSHA records

---

Sources & verification (read on the eCFR, edition of 2026-10-01): 29 CFR 1910.1020(c)(3), (c)(6), (c)(12), (d)(1), (e)(1) to (e)(3); 1910.134(e)(4)(i) and (e)(6)(i); 1926.1153(h)(6); 29 CFR 1630.14(c)(1). General guidance, not legal advice.*