Exposure Records Outlive the Sites That Created Them. Under 1910.1020, Thirty Years Is a Portfolio Problem.

A former employee writes to the company asking for the air sampling results from the plant where she worked in the early 2000s. That plant closed years ago. The building was sold, the local safety coordinator retired, and the industrial hygiene consultant who ran the sampling was replaced twice. Somebody at head office now has fifteen working days to either produce the records or explain in writing why they cannot yet, and the first job is working out whether the company still has them at all.

This post is about that scenario: how the retention and access rules in 29 CFR 1910.1020 behave across a portfolio of sites that open, close, change hands and change vendors over decades. It does not re-explain what counts as an exposure or medical record in detail. The question here is narrower. When records must outlive the sites that created them, who in a multi-site organization actually owns them, and can the organization find them when asked?

Thirty years is longer than most sites, systems and vendors last

The retention periods in 1910.1020(d) are unusually long, which is exactly what makes them a portfolio problem. Unless a specific standard sets a different period, each employee exposure record must be preserved for at least thirty years. Employee medical records must be kept for at least the duration of employment plus thirty years, with narrow exceptions: separately maintained health insurance claims records, certain on-site first aid records for minor one-time treatment, and the medical records of employees who worked for less than a year, provided those records are given to the employee when employment ends.

The standard's definition of an exposure record is broad. It covers workplace monitoring of a toxic substance or harmful physical agent, including personal, area, grab and wipe sampling and the methods behind them, and biological monitoring results that directly measure absorption. Background laboratory data can be kept for as little as one year, but only if the sampling results, the sampling plan, a description of the analytical methods and a summary of relevant background data are kept for the full thirty years. Safety data sheets need not be retained for a set period, as long as some record of the substance's identity, where it was used and when it was used is kept for thirty years.

Put those periods against the ordinary life of a multi-site business. Sites are acquired and divested. Plants close. Document management systems get replaced. Industrial hygiene and occupational health work is contracted out, and the contractor changes. Each of those events is a point where a record can quietly stop being anyone's responsibility, and none of them changes the employer's obligation to preserve it.

The standard does not care who holds the file

A common assumption is that records held by an outside clinic or consultant are the vendor's problem. 1910.1020(b)(3) says otherwise. The section applies to records made or maintained in any manner, including on an in-house or contractual, fee-for-service basis, and each employer must assure that the preservation and access requirements are met regardless of how the records are made or maintained.

For a single-site business that usually means one occupational health clinic and one consultant. For an organization with dozens of locations it often means a different clinic in every metro area, a different industrial hygiene firm in each region, and in some cases sampling that a site manager arranged locally and paid for out of a maintenance budget. The corporate records policy may say exposure data is retained for thirty years, but if the only copy of a 2014 noise dosimetry survey sits in a regional consultant's archive under a contract that ended in 2018, the policy and the obligation have come apart.

A useful test is whether head office could produce, for any site in the portfolio, a list of every exposure monitoring event, who performed it, and where the results are stored today. Most organizations can do this for recent years at their largest sites. Far fewer can do it for smaller locations, older years, or sites they no longer operate.

Closures, sales and acquisitions are where records are lost

1910.1020(h) addresses what happens when an employer ceases to do business. The employer must transfer all records covered by the section to the successor employer, and the successor must receive and maintain them. If there is no successor to receive them, the employer must notify affected current employees of their rights of access to the records at least three months before the business ceases.

The difficulty in a portfolio is that closing one site is not the employer ceasing to do business. The company continues, so the records stay with the company. That sounds simple, but a site closure is usually run by people focused on equipment, leases, severance and environmental exit obligations. Filing cabinets in the safety office get boxed, shipped to storage or scanned by whoever is available, and the index that tells someone what is in each box often does not survive. The obligation to preserve continues for decades after the last employee leaves.

Divestitures raise a different question. When a site is sold as a going concern, the transaction documents should settle which party holds the historical exposure and medical records for that location, and how the other party gets access if it needs them. Our piece on successor employers and site divestitures covers how the injury and illness log behaves in these transactions; exposure and medical records deserve the same attention in the deal checklist, because their retention horizon is far longer.

Acquisitions are the reverse. An acquired site arrives with its own history of sampling, its own clinic relationships and its own gaps. As we discussed in the acquired site problem, the acquiring organization inherits that site's safety record on day one. Part of integration is finding out where the site's exposure and medical records actually are, and whether the prior owner's vendor still holds anything the new owner is now responsible for.

Fifteen working days, from wherever the records are

The access rule in 1910.1020(e)(1)(i) is what turns a retention gap into a live problem. When an employee or designated representative requests access to a record, the employer must provide it in a reasonable time, place and manner. If access cannot reasonably be provided within fifteen working days, the employer must, within those fifteen working days, tell the requester the reason for the delay and the earliest date the record can be made available. The employer may ask the requester only for information needed to locate the records, such as the dates and locations where they worked. When a copy is requested, the first copy must be provided without cost, or copying facilities made available without cost, or the record loaned for a reasonable time so a copy can be made.

The same section also requires employers to tell people the records exist. Under 1910.1020(g)(1), on first entering employment and at least annually after that, current covered employees must be informed of the existence, location and availability of the records, the person responsible for maintaining and providing access to them, and their rights of access.

In a multi-site organization, both requirements quietly depend on a routing question. When a request arrives at a site that no longer exists, at a site where the records were never kept, or at a corporate mailbox, does someone know where to send it, and can they meet the fifteen-working-day clock? And when the annual notice names "the person responsible," is that a real person at each site, or a job title that was vacated two reorganizations ago?

What a portfolio-level view looks like

None of this requires a new program. It requires someone accountable for safety at the enterprise level to be able to answer a handful of questions for every location, including those the organization no longer operates. For each site, where are exposure monitoring results and employee medical records physically or digitally held today? Which outside parties hold originals, and does each contract say what happens to those records when the relationship ends? When a site closes or is sold, whose checklist includes records disposition, and who signs off that it was done? When an access request arrives, who receives it, and how do they find the right records within fifteen working days?

Organizations that can answer those questions consistently tend to have one thing in common: they treat records location as a tracked attribute of each site, not as something the local team knows. That view is exactly the kind of cross-site visibility that is hard to assemble from spreadsheets held at each location, and it is worth asking how your current systems would answer a request about a plant you closed a decade ago.

This is general information, not legal advice, and specific substance standards may impose their own retention or transfer requirements alongside 1910.1020. Where a transaction or closure raises a genuine question about who holds which records, it is worth resolving with counsel before the boxes are moved. If you would like to see how WorkSafely Enterprise approaches recordkeeping visibility across a portfolio, request a demo or talk to sales.