OSHA medical records rule a 'mixed bag' for employers, source says

Dive Brief:

The U.S. Department of Labor's Occupational Safety and Health Administration (OSHA) published a final rule July 30 in which it revised the rules that determine how agency personnel obtain and use personally-identifiable employee medical information.
The changes include the elimination of the requirement that "direct personal identifiers" be removed for OSHA's review of medical information away from a worksite and the creation of "new procedures for the access and safeguarding of personally identifiable employee medical information in electronic form," according to the rule. OSHA also clarified that a written medical access order "does not constitute an administrative subpoena."
OSHA's medical records officer will now approve written medical access orders, transferring that power from the agency's assistant secretary of occupational safety and health, a position that has remained vacant throughout the Trump administration.

Dive Insight:

OSHA's changes come to employers as "a mixed bag," Eric Conn, Conn Maciel Carey founding partner and OSHA practice group chair, said. While it lifts some burden off of employers, the rule appears to have been designed to prioritize the agency itself.

"If we think about our context right now, it makes a lot of sense," Conn said. "We're amid a major public health crisis where OSHA in the course of its inspections needs access to a lot more employee health information." The agency had been encountering challenges in its medical access order processes, specifically in getting the orders issued fast enough as it began inspections and investigations of virus-related issues in workplaces. "That struck me as what seemed to be the principal purpose of the rule, to make it easier for OSHA," Conn said.

Even so, the rule reduces the burden on employers in a couple of ways. It did away with the requirement that employers heavily redact medical records before producing them, for example. Still, this measure may have been implemented to speed up production for OSHA rather than ease employer workloads, Conn said.

The regulation also created a kind of tool for employers to use as they negotiate information requests with OSHA during inspections. It includes "some self-limiting language about the scope of medical access orders" that is narrow and limited both in terms of information and in the people who get access to it.