OSHA Recordkeeping Handbook - denix

Incident Report (Forms 300 and 301, respectively)may contain information of a sufficiently intimateand personal nature that a reasonable personwould wish it to remain confidential. In its 1978records access regulation (29 CFR 1910.1020),OSHA addressed the privacy implications of itsdecision to grant employee access to the Log. Theagency noted that while Log entries are intended tobe brief, they may contain medical information,including diagnoses of specific illnesses, and thatdisclosure to other employees, former employeesor their representatives raised a sensitive privacyissue. 43 FR 31327 (1978). However, OSHA concludedthat disclosure of the Log to current and formeremployees and their representatives benefits theseemployees generally by increasing their awarenessand understanding of the health and safety hazardsto which they are, or have been, exposed.OSHA found that this knowledge “will help employeesto protect themselves from future occurrences,”and that “[i]n such cases, the right of privacymust be tempered by the obvious exigenciesof informing employees about the effects of workplacehazards.”...OSHA continues to believe that granting employeesa broad right of access to injury and illnessrecords serves important public interests. There ispersuasive evidence that access by employees andtheir representatives to the Log and the IncidentReport serves as a useful check on the accuracyof the employer’s recordkeeping and promotesgreater employee involvement in prevention programsthat contribute to safer, more healthful workplaces....There exist at present no mechanisms to protectagainst unwarranted disclosure of private informationcontained in OSHA records. While Agency policyis that employees and their representatives withaccess to records should treat the information containedtherein as confidential except as necessaryto further the purposes of the Act, the Secretarylacks statutory authority to enforce such a policyagainst employees and representatives (e.g., 29U.S.C. Sections 658, 659) (Act’s enforcement mechanismsdirected solely at employers)....OSHA has concluded that the disclosure ofoccupational injury and illness records to employeesand their representatives serves importantpublic policy interests. These interests support arequirement for access by employees and theirrepresentatives to personally identifiable informationfor all but a limited number of cases recordedon the Log, and to all information on the righthandside of the Form 301. However, OSHA alsoconcludes that prior Agency access policies maynot have given adequate consideration to the harmwhich could result from disclosure of intimatemedical information. In the absence of effectivesafeguards against unwarranted use or disclosureof private information in the injury and illnessrecords, confidentiality must be preserved for particularlysensitive cases. These “privacy concerncases” listed in paragraph 1904.29 (b)(7) of thefinal rule involve diseases, such as AIDS and hepatitis,other illnesses if the employee voluntarilyrequests confidentiality, as well as certain types ofinjuries, the disclosure of which could be particularlydamaging or embarrassing to the affectedemployee.......[T]he final rule requires that the employerwithhold the employee’s name from the OSHA 300Log for each “privacy concern case,” and maintaina separate confidential list of employee names andcase numbers. In all other respects, the final ruleensures full access to the OSHA Log by employees,former employees, personal representatives andauthorized employee representatives.Protections Against Broad Public Access...OSHA agrees that confidentiality of injury and illnessrecords should be maintained except for thosepersons with a legitimate need to know the information.This is a logical extension of the agency’sposition that a balancing test is appropriate indetermining the scope of access to be grantedemployees and their representatives. Under thistest, “the fact that protected information must bedisclosed to a party who has need for it* * * doesnot strip the information of its protection againstdisclosure to those who have no similar need.”Fraternal Order of Police, 812 F2d at 118.OSHA has determined that employees, formeremployees and authorized employee representativeshave a need for the information that justifiestheir access to records, including employee names,for all except privacy concern cases. While the possibilityexists that employees and their representativeswith access to the records could disclose theinformation to the general public, OSHA does notbelieve that this risk is sufficient to justify restrictionson the use of the records by persons grantedaccess under sections 1904.40 and 1904.35. As discussedin the following section, strong policy andlegal considerations militate against placing restric-§1904.35OSHA RECORDKEEPINGHANDBOOK149