HIPAA and OSHA Audiometric Records: What General Industry Employers Need to Know

Audiometric test records contain sensitive personal health information — individual hearing thresholds, STS findings, medical referral decisions, and PLHCP notes. Employers maintaining these records under OSHA 1910.95 frequently ask whether HIPAA applies, who can access the records, how long they must be kept, and what happens to records when an employee leaves. The answers are more nuanced than a simple yes or no, and getting them wrong can create both OSHA citation exposure and employee relations problems.

Soundtrace maintains audiometric records in a secure cloud portal with role-based access controls, retention tracking through the employment-plus-30-year OSHA requirement, and employee access mechanisms built into the platform.

HIPAA and Employer Audiometric Records: Does It Apply?

HIPAA’s Privacy Rule applies to “covered entities” — health plans, health care clearinghouses, and health care providers that transmit health information electronically. Most manufacturing, warehousing, food processing, and other general industry employers that maintain audiometric records under OSHA 1910.95 are not HIPAA covered entities. They are employers, not health care providers.

This means that the audiometric records an employer maintains as part of its OSHA hearing conservation program are generally not subject to HIPAA Privacy Rule requirements. The employer is not required to provide HIPAA notices of privacy practices, designate a privacy officer, or follow HIPAA breach notification procedures with respect to audiometric records — because HIPAA does not apply to these records in the hands of the employer.

However, several scenarios bring HIPAA into the picture:

• Third-party vendor is a covered entity or business associate: If an audiometric testing vendor qualifies as a HIPAA business associate — because they perform functions on behalf of a covered entity — their handling of audiometric data may be subject to HIPAA. This depends on the vendor’s other activities and client relationships.
• Self-insured employer health plans: Employers that sponsor self-insured health plans are covered entities with respect to their health plan functions (not their employment functions). Audiometric records maintained under OSHA 1910.95 for employment purposes remain outside the health plan and generally remain outside HIPAA.
• State law analogues: Some states have health information privacy laws that may apply more broadly than HIPAA and could cover employer-held audiometric records.

OSHA 1910.1020: The Governing Standard for Most Employers

For general industry employers, OSHA 29 CFR 1910.1020 — Access to Employee Exposure and Medical Records — is the primary legal framework governing audiometric records. This standard applies to employers who make, maintain, contract for, or have access to employee medical records in connection with employment in a workplace subject to OSHA jurisdiction.

Under 1910.1020, audiometric records are “employee medical records” because they contain information concerning the health status of an individual employee. The standard establishes:

• Employee rights of access to their own records
• Employer obligations to provide access within 15 working days
• Retention requirements (employment duration plus 30 years)
• Transfer obligations when employer ceases operations
• Restrictions on employer disclosure of individual records

What Must Be in the OSHA Audiometric Record

OSHA 1910.95(m)(2) specifies what must be included in each employee’s audiometric record. A complete record must contain:

• Employee’s name and job classification
• Date of the audiogram
• Examiner’s name
• Date of the last acoustic or exhaustive calibration of the audiometer used
• The employee’s most recent noise exposure assessment (dosimetry result or exposure estimate)
• Measurements of background sound pressure levels in the audiometric test room (to document compliance with Appendix D limits)
• The audiometric test results: pure-tone thresholds at each required frequency for each ear

Professional supervisor review notes, STS determination documentation, work-relatedness opinions, and PLHCP referral records should also be retained in the audiometric record, though not all of these are explicitly listed in 1910.95(m)(2). These additional documents are part of the overall employee medical record under 1910.1020 and should be retained accordingly.

Retention Requirements

OSHA establishes different retention periods for different types of HCP records:

The employment-plus-30-year retention requirement for audiometric records is one of the most significant and frequently overlooked compliance obligations in the hearing conservation program. An employee hired at age 25 and retiring at 65 generates an audiometric record that must be retained until the employer has held it for 40 years post-employment. Most employers are not set up for this level of long-term records management without a dedicated system.

Employee Access Rights Under OSHA 1910.1020

OSHA 1910.1020(e) grants employees, their designated representatives, and OSHA specific rights to access audiometric records. The key provisions:

• Employee access: Employees have the right to examine and copy their own audiometric records. The employer must provide access within 15 working days of a written or oral request.
• Designated representative: An employee may designate a representative (union official, attorney, physician, or other person) to access their records on their behalf.
• OSHA access: OSHA has the right to access any employer medical or exposure record in connection with a workplace inspection, investigation, or other proceeding, without employee consent.
• Transfer to physician: An employee may request that their audiometric records be transferred to a physician or health professional of their designation. The employer must comply at the employee’s request.

Can Supervisors See Individual Audiometric Results?

No. OSHA 1910.1020’s access provisions do not include supervisors or managers in the category of people who have automatic access to individual employee audiometric results. Supervisors can be told that an employee has been enrolled in the hearing conservation program and that HPD use is required — but they are not entitled to see the employee’s individual audiometric results, STS status, or medical referral history.

Disclosure of individual audiometric results to supervisors without the employee’s consent would not be consistent with the confidentiality principles underlying 1910.1020, and could expose the employer to liability under state health information privacy laws or ADA disability discrimination provisions if the audiometric data reveals a hearing disability.

Records After Employment Ends

When an employee separates — whether by resignation, layoff, retirement, or termination — the audiometric record retention obligation does not end. The former employee’s audiometric records must be retained for 30 years after the end of employment. During this period, the former employee retains access rights and may request copies of their records.

Employers frequently transfer custody of audiometric records to the former employee at the time of separation as a practical solution. Under 1910.1020(h)(1)(iii), if the employer transfers records to the employee or to NIOSH, its own retention obligation is satisfied. Providing the employee with a complete copy of their audiometric record at separation — with written documentation that the transfer occurred — is the simplest approach for most employers.

Third-Party Vendors and Record Custody

Many employers use third-party audiometric testing vendors — mobile testing services, audiometric platforms, or occupational health clinics — who maintain the audiometric records on the employer’s behalf. The vendor relationship does not change the employer’s legal obligations: the employer remains responsible for ensuring that the records are maintained, accessible to employees on request, and retained for the required period.

Employer contracts with audiometric testing vendors should address: who owns the records, what happens to records if the vendor relationship ends, what access mechanisms exist for employees and OSHA, and what data security standards the vendor applies. An employer whose records are held by a vendor that goes out of business and deletes the data has a significant compliance problem that is the employer’s liability, not the vendor’s.

▶ Bottom line: Vendor custody does not transfer your OSHA obligations. Ensure your contract specifies record ownership, access rights, data security standards, and what happens to records if the vendor relationship terminates.

Frequently asked questions