Under OSHA’s 30-year retention rule for medical and exposure records (29 CFR 1910.1020), your employer must keep your medical records for the entire time you work there plus 30 years after you leave, and your exposure records for at least 30 years. The long window exists because many occupational illnesses do not appear until decades after the exposure that caused them. You can ask to see and copy these records at any point during or after your employment.
Which Records the Rule Covers
The regulation splits covered documents into two buckets, and the retention clock runs a little differently for each.
A medical record is anything about your health created or kept by a physician, nurse, or other health professional in connection with your job. That includes physical exam results, blood work, X-rays, diagnoses and medical opinions, treatment notes, prescriptions, and first aid records. One narrow exception: a one-time on-site treatment of a minor cut, burn, or splinter by a non-physician does not count, provided the note is kept separate from the employer’s medical files.
An exposure record documents what you were exposed to at work and how much. It covers workplace air monitoring for toxic substances and harmful physical agents, the sampling and analytical methods behind those measurements, Safety Data Sheets for hazardous chemicals, and biological monitoring results, such as blood, urine, or breath testing, that measure what has been absorbed into your body.
How Long Each Type Must Be Kept
Medical records: length of employment plus 30 years after separation.
Exposure records: 30 years, flat, regardless of how long you worked there.
Background lab worksheets behind exposure monitoring only have to be preserved for one year, so long as the actual sampling results, collection methods, and a summary of related data are retained for the full 30 years. Safety Data Sheets get a different treatment too. Your employer does not have to keep the whole SDS for 30 years, but must keep, at minimum, a record of the chemical name, where it was used, and when it was used for the full period.
If You Worked There Less Than a Year
Employers of short-term workers get a break on storage. If your employment lasted less than one year, the company does not have to hold your medical records for the full retention period, but it must hand you a copy of those records when you leave. Ask for them on your way out; you may not get another chance.
How to Request Your Records
Submit your request through human resources or the safety department. Once your employer has a valid request, it has 15 working days to produce the records. If it cannot meet that window, it must tell you why and give you a specific date when the records will be ready.
The first copy is free. That includes any search, retrieval, and copying costs. If you ask for a second copy of the same record later, your employer can charge reasonable, non-discriminatory fees for that.
Original chest X-ray films are handled specially. Because the originals need to be preserved, your employer can require you to review them on-site or arrange a temporary loan rather than surrender the film permanently.
Getting Records Through Someone Else
An attorney, personal physician, or other designated representative can request your records on your behalf if you give them specific written authorization. The authorization has to spell out which records the representative is allowed to see and carry an expiration date. This is how it usually works when a doctor needs your occupational history to reach a diagnosis, or when a lawyer is evaluating a workplace-illness claim.
What Your Employer Can Hold Back
Exposure records can contain proprietary information, and the rule lets an employer redact certain trade secrets. Specifically, an employer may delete information revealing manufacturing processes or the percentage of a chemical in a mixture, as long as it tells you information was removed. If those deletions would obscure where or when an exposure occurred, the employer has to fill the gap with enough alternative detail for the record to remain useful.
An employer can also withhold the specific chemical identity of a toxic substance, provided it discloses everything else known about the substance’s properties and health effects. That protection collapses in a medical emergency: if a treating physician or nurse decides the chemical identity is needed for treatment, the employer must disclose it immediately, no paperwork first.
In non-emergencies, a health professional or worker seeking a withheld chemical identity submits a written request explaining the occupational health need, why the specific identity is essential, and how confidentiality will be maintained. Both sides sign a confidentiality agreement limiting use to the stated health purpose. If the employer denies the request, it must do so in writing within 30 days, explain the denial, and back up the trade secret claim with evidence. You can refer a denial to OSHA, which can issue a citation if it finds the trade secret claim unsupported or the health need legitimate.
Privacy: What HIPAA Does and Doesn’t Do Here
A common misconception is that HIPAA protects the medical file your employer keeps. It generally does not. The HIPAA Privacy Rule applies to health care providers and health plans, not to employers acting as employers. If your company holds your workplace physical results in an employment file, HIPAA does not control how the company handles that file. What governs it is 29 CFR 1910.1020 and any state privacy law that applies. The health care provider who performed the exam still cannot share your information with your employer without your authorization unless another law requires it.
The regulation also has narrow carve-outs on your direct access. If a physician representing the employer believes that direct access to a diagnosis of a terminal illness or psychiatric condition could harm you, the employer can route the records to a designated representative of your choice instead. Personnel maintaining your file may also remove the identity of a family member, friend, or coworker who provided confidential information about your health.
When someone requests an analysis built from employee medical records, the employer has to strip direct identifiers, such as names and Social Security numbers, before releasing it. Health insurance claims kept separately and not filed by employee name, along with records from voluntary employee assistance programs, sit outside this OSHA standard entirely.
The Annual Notice You Probably Never Got
Your employer is required to tell you about these records and your right to see them when you are hired and at least once a year after that. The notice must cover the existence, location, and availability of the records, name the person responsible for them, and explain your access rights. A copy of the standard and its appendices, along with any informational materials from OSHA’s Assistant Secretary of Labor, has to be available too.
Many employers skip this. If yours has never mentioned it, that is itself a compliance failure, and it is worth flagging when you make your records request.
If Your Employer Refuses
You can file a complaint with OSHA, which may lead to an on-site inspection. Failure to maintain or provide access to these records can produce citations. As of January 2025, the maximum penalty for a serious violation is $16,550, and the maximum for a willful or repeated violation is $165,514, both per violation. Failure-to-abate penalties can reach $16,550 per day past the abatement deadline. OSHA adjusts these amounts annually for inflation.
What Happens If the Company Closes
When a business shuts down, it has to transfer covered records to a successor employer, who then takes over the retention and access obligations for the rest of the period. OSHA treats an employer as a successor when it acquires the business’s assets and continues using them in substantial continuity with the predecessor, so even an asset-only buyer can inherit the record-keeping duty.
If no successor exists, the closing employer must notify current employees of their access rights at least three months before ceasing business, and must contact the Director of the National Institute for Occupational Safety and Health (NIOSH) before disposing of the records so the federal government has a chance to preserve them. If your former employer is winding down, that three-month window is your cue to request everything in your file before it disappears.