Chapter 22. Personally Identifiable Employee Medical Information
Regulation .01 Purpose.LinkCopy Citation
The purpose of this chapter is to protect the substantial privacy interests involved in employee medical records by ensuring that:
A.
The Commissioner or the Commissioner's authorized representative will exercise authority to gain access to personally identifiable employee medical information only:
(1)
After a careful determination of the need for this information, and
(2)
With appropriate safeguards to protect individual privacy;
B.
Once the medical information is obtained, the examination and use of personally identifiable employee medical information obtained under this chapter is limited to only that information needed to accomplish the purpose for access;
C.
Personally identifiable employee medical information is:
(1)
Retained only for the time needed to accomplish the purpose for access,
(2)
Kept secure while being used, and
(3)
Not disclosed to other agencies or members of the public, except in narrowly defined circumstances and as permitted or required by law; and
D.
Medically related information reported in a personally identifiable form, even if not specifically covered by the terms of this chapter, is handled with appropriate discretion and care befitting information concerning specific employees.
Regulation .02 Scope and Application.LinkCopy Citation
A.
Except as provided in §B of this regulation, this chapter applies to a request by MOSH inspection personnel to access records for the purpose of examining or copying personally identifiable employee medical information, whether or not the request is made under the access provisions of 29 CFR §1910.1020(e)(3).
B.
This regulation does not apply when:
(1)
MOSH inspection personnel:
(a)
Conduct an examination of employee medical records solely to verify employer compliance with the medical surveillance record-keeping requirements of an occupational safety and health standard or with 29 CFR §1910.1020;
(b)
Conduct the examination:
(i)
On-site, and
(ii)
If requested, under the observation of the record holder; and
(c)
Do not record and take offsite any information from medical records other than documentation of the fact of compliance or noncompliance; or
(2)
A written directive by the Commissioner authorizes appropriately qualified personnel to conduct limited reviews of:
(a)
Specific medical information mandated by an occupational safety and health standard; or
(b)
Specific biological monitoring test results.
Regulation .03 Definition.LinkCopy Citation
A.
The definitions set forth in COMAR 09.12.20 apply to this chapter.
B.
For the purpose of this chapter, “personally identifiable employee medical information”:
(1)
Means employee medical information accompanied by either:
(a)
Direct identifiers, including:
(i)
Name,
(ii)
Address,
(iii)
Social Security number,
(iv)
Payroll number; or
(b)
Information which could reasonably be used indirectly to identify specific employees, including:
(i)
Exact age,
(ii)
Height,
(iii)
Weight,
(iv)
Race,
(v)
Sex,
(vi)
Date of initial employment, or
(vii)
Job title;
(2)
Does not include:
(a)
Aggregate employee medical information or medical records on individual employees not in a personally identifiable form;
(b)
Personally identifiable employee medical information obtained in the course of litigation;
(c)
Records required by COMAR 09.12.21;
(d)
Death certificates; or
(e)
Employee exposure records, including biological monitoring records which constitute exposure records under either 29 CFR §1910.1020(c)(5) or specific occupational safety and health standards.
Regulation .04 Responsible Individuals.LinkCopy Citation
A.
The Commissioner or the Commissioner's authorized representative is responsible for the overall administration and implementation of the procedures contained in this chapter, including making a final determination concerning:
(1)
Access to personally identifiable employee medical information; and
(2)
Interagency transfer or public disclosure of personally identifiable employee medical information.
B.
Medical Records Officer.
(1)
The Commissioner or the Commissioner's authorized representative shall designate a medical records officer with experience or training in the evaluation, use, and privacy protection of medical records.
(2)
The medical records officer shall:
(a)
Report directly to the Commissioner or the Commissioner's authorized representative on matters concerning this chapter; and
(b)
Be responsible for:
(i)
Making a recommendation to the Commissioner or the Commissioner's authorized representative regarding the approval or denial of a written access order,
(ii)
Assuring that a written access order meets the requirements of Regulation .05B and C of this chapter,
(iii)
Responding to an objection from an employee, collective bargaining agent, or employer concerning a written access order,
(iv)
Regulating the use of direct personal identifiers,
(v)
Regulating internal agency use and security of personally identifiable employee medical information,
(vi)
Assuring that the results of an analysis of personally identifiable medical information are, when appropriate, communicated to employees,
(vii)
Preparing an annual report of experience under Regulation .10 of this chapter, and
(viii)
Assuring that advance notice is given of intended interagency transfer or public disclosure of personally identifiable employee medical information.
C.
Principal Investigator.
(1)
The principal investigator is the MOSH representative who, in each instance of access to personally identifiable employee medical information, is made primarily responsible for assuring that the examination and use of the information is performed in the manner prescribed by:
(a)
A written access order; and
(b)
The requirements of this chapter.
(2)
When access is under a written access order, the principal investigator shall be professionally trained in medicine, public health, or allied fields such as epidemiology, toxicology, industrial hygiene, biostatistics, or environmental health.
Regulation .05 Written Access Orders.LinkCopy Citation
A.
Requirements.
(1)
Except as provided in §D of this regulation, a request by a MOSH representative to examine or copy personally identifiable employee medical information contained in a record held by an employer or other record holder shall be made in accordance with a written access order approved by the Commissioner or the Commissioner's authorized representative upon the recommendation of the medical records officer.
(2)
At the Commissioner's discretion, a written access order may constitute, or be accompanied by, an administrative subpoena.
B.
Approval Criteria. Before issuing a written access order, the Commissioner or the Commissioner's authorized representative and the medical records officer shall determine that:
(1)
The medical information to be examined or copied is relevant to a statutory purpose;
(2)
There is a need to gain access to the personally identifiable information;
(3)
The personally identifiable medical information to be examined or copied is limited to only the information needed to accomplish the purpose for access; and
(4)
The personnel authorized to review and analyze the personally identifiable medical information are limited to those who have need for access and who have appropriate professional qualifications.
C.
Content. A written access order shall state with reasonable particularity:
(1)
The statutory purposes for which access is sought;
(2)
A general description of the kind of employee medical information that will be examined;
(3)
An explanation of the need to examine personally identifiable employee medical information;
(4)
Whether medical information will be examined onsite;
(5)
What type of information will be copied and removed offsite;
(6)
The name, address, and telephone number of the principal investigator and medical records officer;
(7)
The name of any other authorized individual who is expected to review and analyze the medical information; and
(8)
The anticipated period of time during which the employee medical information in a personally identifiable form is expected to be retained.
D.
Special Situations Not Requiring a Written Access Order.
(1)
MOSH personnel are permitted to examine or copy personally identifiable employee medical information without a written access order if:
(a)
The specific written consent of an employee is obtained under 29 CFR §1910.1020(e)(2)(ii), and MOSH or a MOSH employee is listed on the authorization as the designated representative to receive the medical information;
(b)
When the information is taken offsite, the Commissioner or the Commissioner's authorized representative promptly:
(i)
Names a principal investigator to ensure protection of the information, and
(ii)
Notifies the medical records officer of the principal investigator's identity; and
(c)
MOSH handles the personally identifiable medical information in accordance with the use and security requirements of Regulations .06 and .07 of this chapter.
(2)
MOSH Physician.
(a)
A MOSH staff or contract physician shall be accorded access to personally identifiable employee medical information without a written access order, if the MOSH staff or contract physician:
(i)
Is consulting with an employer's physician concerning an occupational safety or health issue;
(ii)
Conducts an on-site evaluation of employee medical records in consultation with the employer's physician; and
(iii)
Makes only necessary personal notes of the MOSH staff or contract physician's findings.
(b)
Employee medical records may not be taken offsite in the absence of a written access order or the specific written consent of an employee.
(c)
Notes of personally identifiable employee medical information made by the MOSH physician may not leave the physician's control without the permission of the medical records officer.
E.
Procedure for Presentation of Written Access Order.
(1)
Presentation to Employer.
(a)
Before examining or obtaining medical information subject to a written access order, the principal investigator, or a MOSH employee under the investigator's supervision, shall present to the employer:
(i)
At least two copies of the written access order; and
(ii)
An accompanying cover letter to the employer.
(b)
At least one copy of the written access order may not identify specific employees by direct personal identifier.
(c)
The accompanying cover letter shall:
(i)
Summarize the requirements of this section; and
(ii)
Indicate that questions or objections concerning the written access order may be directed to the principal investigator or to the medical records officer.
(d)
The employer shall post promptly:
(i)
A copy of the written access order which does not identify specific employees by direct personal identifier; and
(ii)
The accompanying cover letter.
(2)
Presentation to Collective Bargaining Agent. The principal investigator shall present promptly to each collective bargaining agent representing employees whose medical records are subject to the written access order:
(a)
A copy of the written access order which does not identify specific employees by direct personal identifier; and
(b)
The accompanying cover letter.
(3)
Notice to Employees.
(a)
After presentation of a written access order to an employer and a collective bargaining agent, if any, the principal investigator shall:
(i)
Discuss with the collective bargaining agent, if any, and the employer whether to provide individual notice to employees affected by the written access order; and
(ii)
If it is agreed that individual notice is appropriate, provide the employer an adequate number of copies of the written access order which does not identify specific employees by direct personal identifier, and the accompanying cover letter.
(b)
An employer shall notify each affected employee by delivering the written access order or by placing a copy in each employee's medical file.
F.
Objections Concerning a Written Access Order.
(1)
An employee, collective bargaining agent, and employer may file a written objection to access to records under a written access order.
(2)
A written objection shall be transmitted to the medical records officer.
(3)
Unless the Commissioner or the Commissioner's authorized representative decides otherwise, access to the records shall proceed without delay, notwithstanding the filing of an objection.
(4)
The medical records officer shall respond in writing to a written objection to access by MOSH.
(5)
If appropriate, the medical records officer may:
(a)
Revoke a written access order; and
(b)
Direct that the medical information obtained under the revoked written access order be returned to the original record holder, or destroyed.
(6)
The principal investigator shall ensure that the instructions by the medical records officer are promptly implemented.
G.
Removal of Direct Personal Identifiers.
(1)
If employee medical information obtained under a written access order is taken offsite with direct personal identifiers included, and the investigator is not otherwise authorized by the medical records officer, the principal investigator shall:
(a)
Separate promptly all direct personal identifiers from the medical information; and
(b)
Code the medical information and the list of direct identifiers with a unique identifier for each employee.
(2)
The medical information with the code shall be used and kept secured as though still in a directly identifiable form.
(3)
The principal investigator shall hand deliver or mail the list of direct personal identifiers with corresponding codes to the medical records officer.
(4)
The medical records officer shall limit the use and distribution of the list of coded identifiers to individuals with a need to know its contents.
Regulation .06 MOSH Use of Personally Identifiable Employee Medical Information.LinkCopy Citation
A.
Whenever practicable, the examination of personally identifiable employee medical information shall be performed onsite with a minimum of medical information taken offsite in a personally identifiable form.
B.
The principal investigator, in each instance of access, is primarily responsible for ensuring that personally identifiable employee medical information is used and kept secured in accordance with this chapter.
C.
The principal investigator, the medical records officer, the Commissioner or the Commissioner's authorized representative, and any other authorized individual listed on a written access order may permit the examination or use of personally identifiable employee medical information by MOSH personnel and contractors who have:
(1)
A need for access; and
(2)
Appropriate qualifications for the purpose for which they are using the information.
D.
MOSH personnel or contractors are not authorized to examine or otherwise use personally identifiable employee medical information unless so permitted.
E.
If a need exists, access to personally identifiable employee medical information may be provided to:
(1)
An assistant attorney general assigned to MOSH; and
(2)
A MOSH contractor who:
(a)
Is a physician, or
(b)
Has contractually agreed to abide by the requirements of this chapter and to implement directives and instructions regarding them.
F.
MOSH personnel and contractors are authorized to use personally identifiable employee medical information only for the purposes for which it was obtained unless the:
(1)
Specific written consent of the affected employee is obtained to permit information to be used for another purpose; or
(2)
Procedures in Regulation .05 of this chapter are repeated with respect to using the information for another purpose.
Regulation .07 Security Procedures.LinkCopy Citation
A.
MOSH Files.
(1)
MOSH files containing personally identifiable employee medical information shall be segregated from other MOSH files.
(2)
When not in active use, files containing personally identifiable employee medical information shall be kept secured in a locked cabinet or vault.
B.
Except for necessary use by staff under their direct personal supervision, both the medical records officer and the principal investigator shall maintain a log of:
(1)
Uses and transfers of personally identifiable employee medical information; and
(2)
Lists of coded direct personal identifiers.
C.
Photocopying or other duplication of personally identifiable employee medical information shall be kept to the minimum necessary to accomplish the purposes for which the information was obtained.
D.
The protective measures established by this regulation apply to all:
(1)
Worksheets;
(2)
Duplicate copies; or
(3)
Other documents containing personally identifiable employee medical information.
E.
Intra-Agency Transfers.
(1)
Intra-agency transfers of personally identifiable employee medical information shall be by:
(a)
Hand delivery;
(b)
United States mail; or
(c)
An equally protective means.
(2)
Inter-office mailing channels may not be used.
Regulation .08 Retention and Destruction of Records.LinkCopy Citation
A.
Consistent with Maryland records retention programs, personally identifiable employee medical information and lists of coded direct personal identifiers shall be destroyed or returned to the original record holder when they are no longer needed for the purposes for which they were obtained.
B.
The medical records officer shall:
(1)
Maintain custody of personally identifiable employee medical information which is currently not being used actively but may be needed for future use; and
(2)
Conduct an annual review of all centrally held information to determine which information is no longer needed for the purposes for which it was obtained.
Regulation .09 Results of Analysis Using Personally Identifiable Employee Medical Information.LinkCopy Citation
If appropriate, the medical records officer shall communicate the results of a MOSH analysis using personally identifiable employee medical information to employees whose personal medical information was used as part of the analysis.
Regulation .10 Annual Report.LinkCopy Citation
A.
On an annual basis, the medical records officer shall review MOSH experience under this chapter during the previous year, and prepare a report to the Commissioner, which shall be made available to the public.
B.
The report shall discuss:
(1)
The number of written access orders approved and a summary of the purposes for access;
(2)
The nature and disposition of employee, collective bargaining agent, and employer written objections concerning access to personally identifiable employee medical information; and
(3)
The nature and disposition of requests for inter-agency transfer or public disclosure of personally identifiable employee medical information.
Regulation .11 Inter-Agency Transfer and Public Disclosure.LinkCopy Citation
A.
Except when required by law or when approved by the Commissioner, personally identifiable employee medical information may not be:
(1)
Transferred to an agency or office other than MOSH, except to an assistant attorney general assigned to MOSH; or
(2)
Disclosed to the public, other than to the affected employee or the original record holder.
B.
Except as provided in §C of this regulation, without the consent of the affected employee, the Commissioner or the Commissioner's authorized representative may not approve a request for an inter-agency transfer of personally identifiable employee medical information, unless the request is from a public health agency which:
(1)
Needs the requested information in a personally identifiable form for a substantial public health purpose;
(2)
Will not use the requested information to make individual determinations concerning an affected employee which could be to the employee's detriment;
(3)
Has regulations or established written procedures providing protection for personally identifiable medical information substantially equivalent to that of this chapter; and
(4)
Satisfies an exemption to the Maryland Public Information Act, State Government Article, Title 10, Subtitle 6, Annotated Code of Maryland, to the extent that the Maryland Public Information Act applies to the requested information.
C.
To the extent permitted by State Government Article, Title 10, Subtitle 6, Annotated Code of Maryland, and upon the approval of the Commissioner or the Commissioner's authorized representative, personally identifiable employee medical information may be transferred to the:
(1)
National Institute for Occupational Safety and Health (NIOSH); and
(2)
When necessary with respect to a specific action under the Act, Office of the Maryland Attorney General, or the State's Attorney for Baltimore City or a Maryland county.
D.
The Commissioner may not approve a request for public disclosure of employee medical information containing:
(1)
Direct personal identifiers unless there are compelling circumstances affecting the health or safety of an individual; or
(2)
Information which could reasonably be used indirectly to identify a specific employee when the disclosure would constitute a clearly unwarranted invasion of personal privacy.
E.
Advance Notice.
(1)
Except for an interagency transfer under §C of this regulation, when MOSH intends to release personally identifiable employee medical information to another agency or a member of the public other than an affected employee, the medical records officer shall ensure advance notice is provided to:
(a)
A collective bargaining agent representing affected employees; and
(b)
The employer.
(2)
When the employee medical information to be transferred or disclosed contains direct personal identifiers, the medical records officer shall take reasonable steps to ensure that advance notice is provided to affected employees, when feasible.
(3)
A release made under this section shall comply with State Government Article, Title 10, Subtitle 6, Annotated Code of Maryland.
Chapter annotations
Authority: Labor and Employment Article, §§2-106(b)(4) and 5-312, Annotated Code of Maryland; 29 CFR §1913.10(d) and 29 U.S.C. §668
History: Effective date: July 5, 1993 (20:13 Md. R. 1047)