Requirements. Except as provided in §D of this regulation, a request by a MOSH representative to examine or copy personally identifiable employee medical information contained in a record held by an employer or other record holder shall be made in accordance with a written access order approved by the Commissioner or the Commissioner's authorized representative upon the recommendation of the medical records officer. At the Commissioner's discretion, a written access order may constitute, or be accompanied by, an administrative subpoena. Approval Criteria. Before issuing a written access order, the Commissioner or the Commissioner's authorized representative and the medical records officer shall determine that: The medical information to be examined or copied is relevant to a statutory purpose; There is a need to gain access to the personally identifiable information; The personally identifiable medical information to be examined or copied is limited to only the information needed to accomplish the purpose for access; and The personnel authorized to review and analyze the personally identifiable medical information are limited to those who have need for access and who have appropriate professional qualifications. Content. A written access order shall state with reasonable particularity: The statutory purposes for which access is sought; A general description of the kind of employee medical information that will be examined; An explanation of the need to examine personally identifiable employee medical information; Whether medical information will be examined onsite; What type of information will be copied and removed offsite; The name, address, and telephone number of the principal investigator and medical records officer; The name of any other authorized individual who is expected to review and analyze the medical information; and The anticipated period of time during which the employee medical information in a personally identifiable form is expected to be retained. Special Situations Not Requiring a Written Access Order. MOSH personnel are permitted to examine or copy personally identifiable employee medical information without a written access order if: The specific written consent of an employee is obtained under 29 CFR §1910.1020(e)(2)(ii), and MOSH or a MOSH employee is listed on the authorization as the designated representative to receive the medical information; When the information is taken offsite, the Commissioner or the Commissioner's authorized representative promptly: Names a principal investigator to ensure protection of the information, and Notifies the medical records officer of the principal investigator's identity; and MOSH handles the personally identifiable medical information in accordance with the use and security requirements of Regulations .06 and .07 of this chapter. MOSH Physician. A MOSH staff or contract physician shall be accorded access to personally identifiable employee medical information without a written access order, if the MOSH staff or contract physician: Is consulting with an employer's physician concerning an occupational safety or health issue; Conducts an on-site evaluation of employee medical records in consultation with the employer's physician; and Makes only necessary personal notes of the MOSH staff or contract physician's findings. Employee medical records may not be taken offsite in the absence of a written access order or the specific written consent of an employee. Notes of personally identifiable employee medical information made by the MOSH physician may not leave the physician's control without the permission of the medical records officer. Procedure for Presentation of Written Access Order. Presentation to Employer. Before examining or obtaining medical information subject to a written access order, the principal investigator, or a MOSH employee under the investigator's supervision, shall present to the employer: At least two copies of the written access order; and An accompanying cover letter to the employer. At least one copy of the written access order may not identify specific employees by direct personal identifier. The accompanying cover letter shall: Summarize the requirements of this section; and Indicate that questions or objections concerning the written access order may be directed to the principal investigator or to the medical records officer. The employer shall post promptly: A copy of the written access order which does not identify specific employees by direct personal identifier; and The accompanying cover letter. Presentation to Collective Bargaining Agent. The principal investigator shall present promptly to each collective bargaining agent representing employees whose medical records are subject to the written access order: A copy of the written access order which does not identify specific employees by direct personal identifier; and The accompanying cover letter. Notice to Employees. After presentation of a written access order to an employer and a collective bargaining agent, if any, the principal investigator shall: Discuss with the collective bargaining agent, if any, and the employer whether to provide individual notice to employees affected by the written access order; and If it is agreed that individual notice is appropriate, provide the employer an adequate number of copies of the written access order which does not identify specific employees by direct personal identifier, and the accompanying cover letter. An employer shall notify each affected employee by delivering the written access order or by placing a copy in each employee's medical file. Objections Concerning a Written Access Order. An employee, collective bargaining agent, and employer may file a written objection to access to records under a written access order. A written objection shall be transmitted to the medical records officer. Unless the Commissioner or the Commissioner's authorized representative decides otherwise, access to the records shall proceed without delay, notwithstanding the filing of an objection. The medical records officer shall respond in writing to a written objection to access by MOSH. If appropriate, the medical records officer may: Revoke a written access order; and Direct that the medical information obtained under the revoked written access order be returned to the original record holder, or destroyed. The principal investigator shall ensure that the instructions by the medical records officer are promptly implemented. Removal of Direct Personal Identifiers. If employee medical information obtained under a written access order is taken offsite with direct personal identifiers included, and the investigator is not otherwise authorized by the medical records officer, the principal investigator shall: Separate promptly all direct personal identifiers from the medical information; and Code the medical information and the list of direct identifiers with a unique identifier for each employee. The medical information with the code shall be used and kept secured as though still in a directly identifiable form. The principal investigator shall hand deliver or mail the list of direct personal identifiers with corresponding codes to the medical records officer. The medical records officer shall limit the use and distribution of the list of coded identifiers to individuals with a need to know its contents.