12-55 Rules of HIOSH Practice and Procedure Concerning HIOSH Access to Employee Medical Records

§12-55
1
HAWAII ADMINISTRATIVE RULES
TITLE 12
DEPARTMENT OF LABOR AND INDUSTRIAL RELATIONS
SUBTITLE 8
HAWAII OCCUPATIONAL SAFETY AND HEALTH DIVISION
PART 1
GENERAL, LEGAL, AND ADMINISTRATIVE PROVISIONS
FOR OCCUPATIONAL SAFETY AND HEALTH
CHAPTER 55
RULES OF HIOSH PRACTICE AND PROCEDURE CONCERNING
HIOSH ACCESS TO EMPLOYEE MEDICAL RECORDS
§12-55-1 General policy
§12-55-2 Scope and application
§12-55-3 Director
§12-55-4 HIOSH medical records officer
§12-55-5 Principal HIOSH investigator
§12-55-6 Requirement for written access order
§12-55-7 Approval criteria for written access order
§12-55-8 Content of written access order
§12-55-9 Special situations concerning written access order
§12-55-10 Presentation of written access order and notice to employees
§12-55-11 Objections concerning a written access order
§12-55-12 Removal of direct personal identifiers
§12-55-13 Internal agency use of personal identifiable employee medical
information
§12-55-14 Security procedures
§12-55-15 Retention and destruction of records
§12-55-16 Agency analysis using personal identifiable employee medical
information
§12-55-17 Annual report
§12-55-18 Inter-agency transfer and public disclosure
§12-55-1 General policy. HIOSH access to employee medical records will
in certain circumstances be important to the division's performance of its
statutory functions. Medical records, however, contain personal details
concerning the lives of employees. Due to the substantial personal privacy
interests involved, HIOSH authority to gain access to personally identifiable
employee medical information shall be exercised only after HIOSH has made a
careful determination of its need for this information, and only with
appropriate safeguards to protect individual privacy. Once this information
is obtained, HIOSH examination and use of it will be limited to only that
information needed to accomplish the purpose of access. Personally
identifiable employee medical information will be retained by HIOSH only for
so long as needed to accomplish the purpose of access, shall be kept secure
while being used, and shall not be disclosed to other agencies or members of
the public except in narrowly defined circumstances. [Eff. 7/12/82;

§12-55
2
am 2/13/12] (Auth: HRS §396-4) (Imp: HRS §396-4)
§12-55-2 Scope and application. (a) This chapter establishes procedures
to implement the general policy.
(b) This chapter applies to all requests by HIOSH personnel to obtain
access to records in order to examine or copy personally identifiable
employee medical information, whether or not pursuant to the access provision
of section 1910.1020.
(c) This chapter does not apply to HIOSH access to, or the use of,
aggregate employee medical information or medical records on individual
employees which are not in a personally identifiable form nor to records
required by chapter 12-52.1, to death certificates, nor to employee exposure
records, including biological monitoring records treated by section
1910.1020, or by specific occupational safety and health standards such as
exposure records.
(d) This chapter does not apply where HIOSH compliance personnel conduct
an examination of employee medical records solely to verify employer
compliance with the medical surveillance recordkeeping requirements of an
occupational safety and health standard, or with section 1910.1020. An
examination of this nature shall be conducted on-site and, if requested,
shall be conducted under the observation of the recordholder. The HIOSH
compliance personnel shall not record and take off-site any information from
medical records other than documentation of the fact of compliance or non-
compliance.
(e) This chapter does not apply to HIOSH access to, or the use of,
personally identifiable employee medical information obtained in the course
of litigation.
(f) This chapter does not apply where a written directive by the director
authorizes appropriately qualified personnel to conduct limited reviews of
specific medical information mandated by an occupational safety and health
standard, or of specific biological monitoring test results.
(g) Even if not covered by the terms of this chapter, all medically
related information reported in a personally identifiable form shall be
handled with appropriate discretion and care befitting all information
concerning specific employees. There may be, for example, personal privacy
interests involved which militate against disclosure of this kind of
information to the public. [Eff. 7/12/82; am 8/15/87; am 2/13/12] (Auth: HRS
§396-4) (Imp: HRS §396-4)
§12-55-3 Director. The director shall be responsible for the overall
administration and implementation of the procedures contained in this chapter
including making final HIOSH determinations concerning:
(1) Access to personally identifiable employee medical information, as
provided in section 12-55-6; and
(2) Inter-agency transfer or public disclosure of personally identifiable
employee medical information, as provided in section 12-55-18.
[Eff. 7/12/82; am 8/15/87; am 2/13/12] (Auth: HRS §396-4) (Imp: HRS
§396-4)
§12-55-4 HIOSH medical records officer. The director shall designate a
HIOSH official with experience or training in the evaluation, use, and
privacy protection of medical records to be the HIOSH medical records
officer. The HIOSH medical records officer shall report directly to the
director on matters concerning this section and shall be responsible for:

§12-55
3
(1) Making recommendations to the director as to the approval or denial
of written access orders, pursuant to section 12-55-6;
(2) Ensuring that written access orders meet the requirements of sections
12-55-7 and 12-55-8;
(3) Responding to employee, or their designated representative, and
employer objections concerning written access orders, as provided in
section 12-55-11;
(4) Regulating the use of direct personal identifiers, as provided in
section 12-55-12;
(5) Regulating internal HIOSH use and security of personally identifiable
employee medical information, pursuant to sections 12-55-13, 12-55-
14, and 12-55-15;
(6) Ensuring that the results of HIOSH analyses of personally
identifiable medical information are communicated to employees, as
provided in section 12-55-16;
(7) Preparing an annual report of HIOSH's experience pursuant to section
12-55-17; and
(8) Ensuring that advance notice is given of intended inter-agency
transfers or public disclosures, pursuant to section 12-55-18.
[Eff. 7/12/82; am 8/15/87; am 2/13/12] (Auth: HRS §396-4) (Imp: HRS
§396-4)
§12-55-5 Principal HIOSH investigator. The principal HIOSH investigator
shall be the HIOSH employee, in each instance of access to personally
identifiable employee medical information, who is made primarily responsible
for ensuring that the examination and use of this information is performed in
the manner prescribed by a written access order and the requirements of
sections 12-55-6 through 12-55-18. When access is pursuant to a written
access order, the principal HIOSH investigator shall be professionally
trained in medicine, public health, or allied fields such as epidemiology,
toxicology, industrial hygiene, biostatistics, and environmental health.
[Eff. 7/12/82; am 8/15/87; am 2/13/12] (Auth: HRS §396-4) (Imp: HRS §396-4)
§12-55-6 Requirement for written access order. Except as provided in
section 12-55-9, each request by a HIOSH representative to examine or copy
personally identifiable employee medical information contained in a record
held by an employer or other recordholder shall be made pursuant to a written
access order which has been approved by the director upon the recommendation
of the HIOSH medical records officer. If deemed appropriate, a written
access order may constitute or be accompanied by an administrative subpoena.
[Eff. 7/12/82; am 8/15/87; am 2/13/12] (Auth: HRS §396-4) (Imp: HRS §396-4)
§12-55-7 Approval criteria for written access order. Before approving a
written access order, the director and the HIOSH medical records officer
shall determine that:
(1) The medical information to be examined or copied is relevant to a
statutory purpose and there is a need to gain access to this
personally identifiable information;
(2) The personally identifiable medical information to be examined or
copied is limited to only that information needed to accomplish the
purpose for access; and
(3) The personnel authorized to review and analyze the personally
identifiable medical information are limited to those who have a need
for access and have appropriate professional qualifications.

§12-55
4
[Eff. 7/12/82; am 2/13/12] (Auth: HRS §396-4) (Imp: HRS §396-4)
§12-55-8 Content of written access order. Each written access order
shall state with reasonable particularity:
(1) The statutory purposes for which access is sought;
(2) A general description of the kind of employee medical information
that will be examined and why there is a need to examine personally
identifiable information;
(3) Whether medical information will be examined on-site, and what type
of information will be copied and taken off-site;
(4) The name, address, and phone number of the principal HIOSH
investigator and the names of any other authorized persons who are
expected to review and analyze the medical information;
(5) The name, address, and phone number of the HIOSH medical records
officer; and
(6) The anticipated period of time during which HIOSH expects to retain
the employee medical information in a personally identifiable form.
[Eff. 7/12/82; am 2/13/12] (Auth: HRS §396-4) (Imp: HRS §396-4)
§12-55-9 Special situations concerning written access order. Written
access orders need not be obtained to examine or copy personally identifiable
employee medical information under the following circumstances:
(1) If the specific written consent of an employee is obtained pursuant
to section 1910.1020, and HIOSH or a HIOSH employee is listed on the
authorization as the designated representative to receive the medical
information, then a written access order need not be obtained.
Whenever personally identifiable employee medical information is
obtained through specific written consent and taken off-site, a
principal HIOSH investigator shall be promptly named to ensure
protection of the information, and the HIOSH medical records officer
shall be notified of this person's identity. The personally
identifiable medical information obtained shall be subject to the use
and security requirements of sections 12-55-13 through 12-55-18.
(2) A written access order need not be obtained where a HIOSH staff or
contract physician consults with an employer's physician concerning
an occupational safety or health issue. In a situation of this
nature, the HIOSH physician may conduct on-site evaluation of
employee medical records in consultation with the employer's
physician, and may make personal notes of his or her findings. No
employee medical records shall be taken off-site in the absence of a
written access order or the specific written consent of an employee,
and no notes of personally identifiable employee medical information
made by the HIOSH physician shall leave his or her control without
the permission of the HIOSH medical records officer. [Eff. 7/12/82;
am 8/15/87; am 2/13/12] (Auth: HRS §396-4) (Imp: HRS §396-4)
§12-55-10 Presentation of written access order and notice to employees.
(a) The principal HIOSH investigator, or someone under the investigator's
supervision, shall present at least two copies each of the written access
order and an accompanying cover letter to the employer prior to examining or
obtaining medical information subject to a written access order. At least
one copy of the written access order shall not identify specific employees by
direct personal identifier. The accompanying cover letter shall summarize
the requirements of this section and indicate that questions or objections

§12-55
5
concerning the written access order may be directed to the HIOSH principal
investigator or to the HIOSH medical records officer.
(b) The principal HIOSH investigator shall promptly present a copy of the
written access order (which does not identify specific employees by direct
personal identifier) and its accompanying cover letter to each designated
representative of the employees whose medical records are subject to the
written access order.
(c) The principal HIOSH investigator shall indicate that the employer must
promptly post a copy of the written access order which does not identify
specific employees by direct personal identifier, as well as post its
accompanying cover letter. See section 1910.1020.
(d) The principal HIOSH investigator shall discuss with any collective
bargaining agent and with the employer the appropriateness of individual
notice to employees affected by the written access order. Where it is agreed
that individual notice is appropriate, the principal HIOSH investigator shall
promptly provide to the employer an adequate number of copies of the written
access order (which does not identify specific employees by direct personal
identifier) and its accompanying cover letter to enable the employer either
to individually notify each employee or to place a copy in each employee's
medical file. [Eff. 7/12/82; am 8/15/87; am 2/13/12] (Auth: HRS §396-4)
(Imp: HRS §396-4)
§12-55-11 Objections concerning a written access order. All employees,
or their designated representatives, and an employer's written objections
concerning access to records pursuant to a written access order shall be
transmitted to the HIOSH medical records officer. Unless HIOSH decides
otherwise, access to the records shall proceed without delay notwithstanding
the lodging of an objection. The HIOSH medical records officer shall respond
in writing to each employee's or their designated representative's written
objection to HIOSH access. Where appropriate, the HIOSH medical records
officer may revoke a written access order and direct that any medical
information obtained by it be returned to the original recordholder or
destroyed. The principal HIOSH investigator shall ensure that such
instructions by the HIOSH medical records officer are promptly implemented.
[Eff. 7/12/82; am 8/15/87; am 2/13/12] (Auth: HRS §396-4) (Imp: HRS §396-4)
§12-55-12 Removal of direct personal identifiers. Whenever employee
medical information obtained pursuant to a written access order is taken off-
site with direct personal identifiers included, the principal HIOSH
investigator shall, unless otherwise authorized by the HIOSH medical records
officer, promptly separate all direct personal identifiers from the medical
information, and code the medical information and the list of direct
identifiers with a unique identifying number for each employee. The medical
information with its numerical code shall thereafter be used and kept secured
as though still in a directly identifiable form. The principal HIOSH
investigator shall also hand deliver or mail the list of direct personal
identifiers with their corresponding numerical codes to the HIOSH medical
records officer. The HIOSH medical records officer shall thereafter limit
the use and distribution of the list of coded identifiers to those with a
need to know its contents. [Eff. 7/12/82; am 2/13/12] (Auth: HRS §396-4)
(Imp: HRS §396-4)
§12-55-13 Internal agency use of personal identifiable employee medical
information. (a) The principal HIOSH investigator shall in each instance of

§12-55
6
access be primarily responsible for ensuring that personally identifiable
employee medical information is used and kept secured in accordance with this
section.
(b) The principal HIOSH investigator, the HIOSH medical records officer,
the director, and any other authorized person listed on a written access
order may permit the examination or use of personal identifiable employee
medical information by HIOSH employees and contractors who have a need for
access, and appropriate qualifications, for the purpose for which they are
using the information. No HIOSH employee or contractor is authorized to
examine or otherwise use personally identifiable employee medical information
unless so permitted.
(c) Where a need exists, access to personally identifiable employee
medical information may be provided to the attorney general and to HIOSH
contractors who are physicians or who have contractually agreed to abide by
the requirements of this section, implementing HIOSH directives, and HIOSH
instructions.
(d) HIOSH employees and contractors are only authorized to use personal
identifiable employee medical information for the purposes for which it was
obtained, unless the specific written consent of an employee is obtained as
to a secondary purpose, or the procedures of sections 12-55-6 through 12-55-
12 are repeated with respect to the secondary purpose.
(e) Whenever practicable, the examination of personally identifiable
employee medical information shall be performed on-site with a minimum of
medical information taken off-site in a personal identifiable form.
[Eff. 7/12/82; am 8/15/87; am 2/13/12] (Auth: HRS §396-4) (Imp: HRS §396-4)
§12-55-14 Security procedures. (a) HIOSH files containing personally
identifiable employee medical information shall be segregated from other
agency files. When not in active use, files containing this information
shall be kept secured in a locked cabinet or vault.
(b) The HIOSH medical records officer and the principal HIOSH investigator
shall each maintain a log of uses and transfers of personal identifiable
employee medical information and lists of coded direct personal identifiers,
except for necessary uses by staff under their direct personal supervision.
(c) The photocopying or other duplication of personally identifiable
employee medical information shall be kept to the minimum necessary to
accomplish the purposes for which the information was obtained.
(d) The protective measures established by this section apply to all
worksheets, duplicate copies, or other agency documents containing personally
identifiable employee medical information.
(e) Intra-agency transfers of personally identifiable employee medical
information shall be by hand delivery, United States mail, or equally
protective means. Inter-office mailing channels shall not be used.
[Eff. 7/12/82; am 2/13/12] (Auth: HRS §396-4) (Imp: HRS §396-4)
§12-55-15 Retention and destruction of records. (a) Consistent with
HIOSH records disposition programs, personally identifiable employee medical
information and lists of coded direct personal identifiers shall be destroyed
or returned to the original recordholder when no longer needed for the
purposes for which they were obtained.
(b) Personally identifiable employee medical information which is not in
current use but may be needed for future use shall be transferred to the
HIOSH medical records officer. The HIOSH medical records officer shall
conduct an annual review of all centrally-held information to determine which
information is no longer needed for the purposes for which it was obtained.

§12-55
7
[Eff. 7/12/82; am 2/13/12] (Auth: HRS §396-4) (Imp: HRS §396-4)
§12-55-16 Agency analysis using personal identifiable employee medical
information. The HIOSH medical records officer shall, as appropriate, assure
that the results of a HIOSH analysis using personally identifiable employee
medical information are communicated to the employees whose personal medical
information was used as a part of the analysis. [Eff. 7/12/82; am 2/13/12]
(Auth: HRS §396-4) (Imp: HRS §396-4)
§12-55-17 Annual report. The HIOSH medical records officer shall on an
annual basis review HIOSH's experience under this section during the previous
year, and prepare a report to the director which shall be made available to
the public. This report shall discuss:
(1) The number of written access orders approved and a summary of the
purposes for access;
(2) The nature and disposition of employee, or their designated
representative, and employer written objections concerning HIOSH
access to personally identifiable employee medical information; and
(3) The nature and disposition of requests for inter-agency transfer or
public disclosure of personally identifiable employee medical
information. [Eff. 7/12/82; am 8/15/87; am 2/13/12] (Auth: HRS
§396-4)
(Imp: HRS §396-4)
§12-55-18 Inter-agency transfer and public disclosure. (a) Personal
identifiable employee medical information shall not be transferred to another
agency or office outside of HIOSH (other than to the attorney general) or
disclosed to the public (other than to the affected employee or the original
recordholder) except when required by law or when approved by the director.
(b) Except as provided in subsection (c) below, the director shall not
approve a request for an inter-agency transfer of personal identifiable
employee medical information, for which the employees have not given their
consent, unless the request is by a public health agency which:
(1) Needs the requested information in a personally identifiable form for
a substantial public health purpose;
(2) Will not use the requested information to make individual
determinations concerning affected employees which could be to their
detriment;
(3) Has regulations or established written procedures providing
protection for personally identifiable medical information
substantially equivalent to that of this chapter; and
(4) Satisfies an exemption to the Privacy Act to the extent that the
Privacy Act applies to the requested information. See 5 U.S.C.
552a(b); 29 CFR 70a.3.
(c) Upon the approval of the director, personally identifiable employee
medical information may be transferred to:
(1) The National Institute for Occupational Safety and Health (NIOSH);
and
(2) The State attorney general, when necessary, with respect to a
specification under chapter 396, HRS.
(d) The director shall not approve a request for public disclosure of
employee medical information containing direct personal identifiers unless
there are compelling circumstances affecting the health or safety of an
individual.

§12-55
8
(e) The director shall not approve a request for public disclosure of
employee medical information which contains information which could
reasonably be used indirectly to identify specific employees when the
disclosure would constitute a clearly unwarranted invasion of personal
privacy. See, 5 U.S.C. 552(b)(6); 29 CFR 70.26.
(f) Except as to inter-agency transfers to NIOSH or the Department of
Justice, the HIOSH medical records officer shall ensure that advance notice
is provided to any designated representative of the affected employees and to
the employer on each occasion that HIOSH intends to either transfer
personally identifiable employee medical information to another agency or
disclose it to a member of the public other than to an affected employee.
When feasible, the HIOSH medical records officer shall take reasonable steps
to ensure that advance notice is provided to affected employees when the
employee medical information to be transferred or disclosed contains direct
personal identifiers. [Eff. 7/12/82; am 8/15/87; am 2/13/12] (Auth: HRS
§396-4) (Imp: HRS §396-4)