MOSH Files. MOSH files containing personally identifiable employee medical information shall be segregated from other MOSH files. When not in active use, files containing personally identifiable employee medical information shall be kept secured in a locked cabinet or vault. Except for necessary use by staff under their direct personal supervision, both the medical records officer and the principal investigator shall maintain a log of: Uses and transfers of personally identifiable employee medical information; and Lists of coded direct personal identifiers. Photocopying or other duplication of personally identifiable employee medical information shall be kept to the minimum necessary to accomplish the purposes for which the information was obtained. The protective measures established by this regulation apply to all: Worksheets; Duplicate copies; or Other documents containing personally identifiable employee medical information. Intra-Agency Transfers. Intra-agency transfers of personally identifiable employee medical information shall be by: Hand delivery; United States mail; or An equally protective means. Inter-office mailing channels may not be used.