29 CFR 1910.1020: Access to employee exposure and medical records
The official text is on the eCFR. This page maps how the section is organized, quotes the paragraphs our ASP, CHST, CSP practice questions are built on, and gives free questions you can try. Text below is quoted from the eCFR, current as of 2026-10-14; the section was last amended 2018-05-07.
How 29 CFR 1910.1020 is organized
- (a) Purpose1 paragraph
- (b) Scope and application3 paragraphs
- (c)41 paragraphs
- (d) Preservation of records12 paragraphs
- (e) Access to records—(1) General30 paragraphs
- (f) Trade secrets45 paragraphs
- (g) Employee information5 paragraphs
- (h) Transfer of records2 paragraphs
- (i) Appendices1 paragraph
- [Appendix A to § 1910.1020]10 paragraphs
- [Appendix B to § 1910.1020]10 paragraphs
Paragraphs our practice questions cite most
Counted across the 38 live PassCited questions built on this section. This reflects our question bank, not the real exam.
“(B) Whenever access is requested to an analysis which reports the contents of employee medical records by either direct identifier (name, address, social security number, payroll number, etc.) or by information which could reasonably be used under the circumstances indirectly to identify specific employees (exact age, height, weight, race, sex, date of initial employment, job title, etc.), the employer shall assure that personal identifiers are removed before access is provided. If the employer can demonstrate that removal of personal identifiers from an analysis is not feasible, access to the…”
“(3) Designated representative means any individual or organization to whom an employee gives written authorization to exercise a right of access. For the purposes of access to employee exposure records and analyses using exposure or medical records, a recognized or certified collective bargaining agent shall be treated automatically as a designated representative without regard to written employee authorization.”
“(4) Employee means a current employee, a former employee, or an employee being assigned or transferred to work where there will be exposure to toxic substances or harmful physical agents. In the case of a deceased or legally incapacitated employee, the employee's legal representative may directly exercise all the employee's rights under this section.”
“(D) Records concerning voluntary employee assistance programs (alcohol, drug abuse, or personal counseling programs) if maintained separately from the employer's medical program and its records.”
“(ii) The employer may require of the requester only such information as should be readily known to the requester and which may be necessary to locate or identify the records being requested (e.g. dates and locations where the employee worked during the time period in question).”
Free practice questions on 29 CFR 1910.1020
Question 1
An employee's designated representative requests a company's statistical analysis of workplace exposure and medical data. The report lists each affected worker's payroll number, exact age, and job title alongside their audiometric results. Before giving the representative access, what must the employer do?
Show answer and source
Answer: D. Remove the personal identifiers, both direct and those that could indirectly identify specific employees, before providing access
The standard requires the employer to remove personal identifiers before access is provided, and it counts both direct identifiers (payroll number) and indirect ones (exact age, job title). Removing only names and payroll numbers is wrong because indirect identifiers are expressly covered.
Answer D rests on
29 CFR 1910.1020(e)(2)(iii)(B)(opens ecfr.gov in a new tab)“Whenever access is requested to an analysis which reports the contents of employee medical records by either direct identifier (name, address, social security number, payroll number, etc.) or by information which could reasonably be used under the circumstances indirectly to identify specific employees (exact age, height, weight, race, sex, date of initial employment, job title, etc.), the employer shall assure that personal identifiers are removed before access is provided.”
Question 2
An employee asks to see her own medical records. The employer's physician believes that direct access to information about a specific diagnosis of a terminal illness in the file could be detrimental to her health. What may the employer lawfully do?
Show answer and source
Answer: D. Deny direct access to that information only and offer access through a designated representative with specific written consent
The standard lets the employer deny direct access to the terminal illness or psychiatric diagnosis information only, and inform the employee that access will be provided only to a designated representative with specific written consent. It does not permit withholding the whole record.
Answer D rests on
29 CFR 1910.1020(e)(2)(ii)(D)(opens ecfr.gov in a new tab)“the employer may inform the employee that access will only be provided to a designated representative of the employee having specific written consent, and deny the employee's request for direct access to this information only.”
Question 3
A plant's industrial hygienist has personal air-sampling results and the related calculations for a solvent used in the paint line. The recognized union that bargains for the paint-line workers asks in writing for copies of these results. None of the sampled workers has signed an authorization naming the union. How should the employer treat the request under the access standard?
Show answer and source
Answer: B. Treat the union as a designated representative and provide access without any written employee authorization.
The standard says a recognized or certified collective bargaining agent is treated automatically as a designated representative for access to exposure records and analyses, so no written authorization is needed. Requiring individual authorizations applies to other designated representatives, not to the bargaining agent.
Answer B rests on
29 CFR 1910.1020(c)(3)(opens ecfr.gov in a new tab)“For the purposes of access to employee exposure records and analyses using exposure or medical records, a recognized or certified collective bargaining agent shall be treated automatically as a designated representative without regard to written employee authorization.”
Question 4
A worker signed a dated written authorization allowing his occupational clinic to release his existing medical records to an outside consultant. The authorization had no special conditions. The clinic sent the records to the consultant in the first month. Three months after signing, the worker gives the clinic a signed written statement revoking the authorization. The next day the consultant asks the clinic for another copy of the same records. What should the clinic do?
Show answer and source
Answer: B. Decline the request, because the written revocation ends the clinic's authority to make further releases from that point on.
The worker revoked the authorization in writing, and a revocation takes effect prospectively at any time, so later releases are no longer authorized. The time left before the one-year limit does not matter once the worker has revoked. The earlier release was proper when made, but that does not permit new releases after the revocation.
Answer B rests on
29 CFR 1910.1020(c)(12)(iii)(opens ecfr.gov in a new tab)“A written authorization may be revoked in writing prospectively at any time.”
Question 5
In March, an employee signed a written authorization allowing the clinic to release his exposure-related medical records to a named representative. The form has all required elements, is within its one-year limit, and has not been revoked. It does not mention future records. In June, the employee has a new medical evaluation, and the representative asks the clinic for those results under the March authorization. What is the correct response?
Show answer and source
Answer: A. Do not release the results under this form, because they did not exist on the date of authorization and the form does not expressly authorize release of future information
The June evaluation did not exist when the authorization was signed, and the form does not expressly allow release of future information. The standard therefore says the authorization does not cover it. The one-year limit is only a maximum duration, so being inside that period does not extend the authorization to new records.
Answer A rests on
29 CFR 1910.1020(c)(12)(ii)(opens ecfr.gov in a new tab)“(ii) A written authorization does not operate to authorize the release of medical information not in existence on the date of written authorization, unless the release of future information is expressly authorized, and does not operate for more than one year from the date of written authorization.”
Where it shows up in exam prep
Find out which regulations you'd miss
Other Part 1910 sections
This is a study aid, not legal advice or an official interpretation. Always check the current eCFR text. Original practice questions, not real exam items. PassCited is not affiliated with or endorsed by BCSP.