Should medical records be under lock and key?
Question: What are the requirements for how medical records must be secured? I understand that they should be kept separate from any other records in the occupational health department, but are there specific requirements about how to lock them away?
If I’m working at the employer’s work site, should I be the only one with access to the records, or should the employer have a key also?
Answer: There are no specific requirements as to exactly how the records must be secured, but medical records should be locked up separately from any other occupational health or personnel records, says Deborah DiBenedetto, MBA, RN, COHN-S, ABDA, president of the American Association of Occupational Health Nurses in Atlanta.
Could be a problem at employer’s work site
This usually is not a problem for the hospital-based or freestanding occupational health center, where staff are used to handling confidential medical records and have a system in place for securing them. But when an occupational health provider works at an employer’s work site, the issue can be more difficult, DiBenedetto says. In that setting, it often falls entirely on the occupational health provider’s shoulders to set up a system for securing medical records and explaining to the employer why there is no free access.
Employees’ medical records should be locked away in some fashion. They can be kept in a locked file cabinet, for instance, or they can be filed in a room that is locked securely. In either case, the medical records should be kept separate from other types of personnel records because the employer cannot have free access to the medical records.
"Even in the medical records, you should separate workers’ comp and surveillance information from any other medical and personal information about the employee," DiBenedetto says. "The employer may need access to the workers’ comp information at some point, but they never have rights to the other, unrelated medical information without the employee’s permission. You have to keep the actual records separate to protect that."
For records stored at the work site, the occupational health professional still is responsible for keeping them secure — even from the employer. Even if the clinic, the file cabinet, and everything else on the premises belong to the employer, the employer cannot have access to the medical records.
DiBenedetto notes that the employer often is frustrated when the occupational health professional denies access to some medical records, especially when the records are filed within the employer’s own health clinic at the work site. It is not uncommon for the employer to demand that human resources or another representative of the employer have access to all records on site, but she says the occupational health professional must stand firm in protecting the confidentiality of medical records.
For more information on guidelines, see:
• Standard 29 CFR 1910.20, covering medical records from the federal Occupational Safety and Health Administration in Washington, DC.
• American Association of Occupational Health Nurses, 2920 Brandywine Road, Suite 100, Atlanta, GA 30341. Telephone: (770) 455-7757. Web: www.aaohn.org.
You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content