OSHA Recordkeeping Handbook - Msabc.net

LETTERS OF INTERPRETATION: Section 1904.35Section 1904.35 Employee involvementOSHA requirements are set by statute, standards and regulations. Letters of interpretation explainthese requirements and how they apply to particular circumstances, but they cannot create additionalemployer obligations. These letters constitute OSHA’s interpretation of the requirements discussed.Note that OSHA enforcement guidance may be affected by changes to OSHA rules. Also, from time totime we update our guidance in response to new information. To keep apprised of such developments,you can consult OSHA’s website at http://www.osha.gov.Letters of Interpretation constitute OSHA’s interpretation only of the requirements discussed and maynot be applicable to any situation not delineated within the original correspondence.Letter of interpretation related to section 1904.35(b)(2)(iv)OSHA 300 Log requirements versus HIPAA privacy requirements.August 2, 2004Mr. Bill KojolaIndustrial HygienistDepartment of Safety and HealthAFL-CIO815 Sixteenth St., NWWashington, DC 20006Dear Mr. Kojola:Thank you for your February 27, 2004 letter to the Occupational Safety and Health Administration(OSHA) regarding the Injury and Illness Recording and Reporting Requirements contained in 29CFR Part 1904. Your letter was forwarded to my office by Richard Fairfax, Director, Directorate ofEnforcement Programs. The Division of Recordkeeping Requirements, within my Directorate, isresponsible for the administration of the OSHA injury and illness recordkeeping system nationwide.Please excuse the delay in responding to your request.You state that employers are claiming they must remove all the names from the OSHA 300 Logbefore providing access in order to comply with the privacy requirements contained in the HealthInsurance Portability and Accountability Act (HIPAA). Specifically, you ask OSHA to clarify therecordkeeping requirements contained in 29 CFR Part 1904 vs. the HIPAA requirements.We do not believe that HIPAA provides a basis for employers to remove employees' names from theLog before providing access. Even if HIPAA is implicated by the employer's disclosure of the OSHALog, the statue and implementing regulation expressly permit the disclosure of protected healthinformation to the extent required by law. See 45 CFR 164.512(a). This exception for disclosuresrequired by law applies here because the Recordkeeping rule requires that employees, formeremployees, and employee representatives have access to the complete Log, including employeenames, except for privacy concern cases. See 29 CFR 1904.35(b)(2)(iv).§1904.35OSHA RECORDKEEPINGHANDBOOK153