The OSHA 15-Day Records Clock Is Two Different Rules: What Happens When an Employee Asks for Their Exposure File
← Back to Blog Compliance

The OSHA 15-Day Records Clock Is Two Different Rules: What Happens When an Employee Asks for Their Exposure File

Federal OSHA gives you fifteen working days to explain a delay, not to produce the record. California gives fifteen calendar days, hard. Here is the difference.

by iSi Environmental

A letter arrives at a Wichita plant. A former press operator, now three years gone, wants “all air monitoring and medical records related to my employment.” He copied a lawyer. The EHS manager searches his own procedure, finds the line every EHS procedure seems to contain, and reads it out loud: OSHA gives us fifteen days to respond.

That sentence is wrong in two directions at once. Under federal OSHA, an employee’s right to see exposure and medical records has no fifteen-day production deadline at all. Fifteen working days is the point at which a different obligation switches on. In California, fifteen days is a real wall, and it is calendar days, not working days. Same number, two rules, opposite consequences for the manager who guesses.

This post walks the actual text of 29 CFR 1910.1020, the California analogue at 8 CCR 3204, and the parts of the standard that decide whether the file you are about to hand over is even complete. The one that surprises people most: sampling your outside industrial hygiene consultant performed is your record, with your retention duty attached, whether or not anyone at your company ever filed a copy.

Does OSHA give employers 15 days to respond to a records request?

No. Federal 29 CFR 1910.1020(e)(1)(i) requires access “in a reasonable time, place, and manner.” If the employer cannot reasonably provide access within fifteen working days, the employer must, within those same fifteen working days, tell the requester the reason for the delay and the earliest date the record will be available. Fifteen working days triggers a duty to explain.

Read the operative sentence in the current eCFR text and the structure is clear. The primary obligation is reasonableness. The fifteen-working-day mark is a communication checkpoint layered on top of it. There is no outer limit stated anywhere in paragraph (e)(1)(i). An employer who needs six weeks to pull thirty years of dosimetry off microfiche has not violated the standard by taking six weeks, provided the delay is reasonable and the employer sent the explanation inside the fifteen-working-day window.

The practical consequence runs the other way from what most procedures assume. The failure mode is not missing a production deadline. It is going quiet. An employer who says nothing for a month and then produces a complete file has skipped the one hard-dated obligation in the paragraph. An employer who writes back on day nine, states why the 1998 through 2004 records are in offsite storage, and commits to a date, is in a defensible position even if production lands in November.

Document the delay notice. Date it, keep it, and file it with the request. That memo is what makes the reasonable-time position visible to a compliance officer later, and there is a specific reason it matters that we get to below.

What is the difference between “15 working days” under federal OSHA and “15 days” in California?

Federal 1910.1020(e)(1)(i) uses fifteen working days and imposes only a duty to explain a delay. California 8 CCR 3204(e)(1)(A) uses fifteen days and makes it absolute: access shall be provided “but in no event later than fifteen (15) days after the request for access is made.” The only relief is an advance extension request to the Chief of DOSH, granted on a good-cause finding.

Fifteen working days and fifteen calendar days are not the same interval. Across a two-week span with a holiday, the federal window can run past three calendar weeks. The California window does not move.

The extension mechanism in Title 8 Section 3204 is also the opposite of the federal explanation letter in a way that catches multi-state operators. The federal notice goes to the requester and is unilateral. The California extension goes to the Chief of the Division of Occupational Safety and Health, has to be requested in advance, and depends on a good-cause finding by the agency. A California plant manager who writes a polite delay letter to the requester on day twelve has done the federal thing and still blown the California deadline.

California adds one more duty federal 1910.1020 does not contain. Under 3204(h)(3) and (h)(4), an employer intending to dispose of records required to be kept for thirty years must transfer them to the Director of NIOSH where a specific standard requires it, or notify the Director of NIOSH in writing at least three months before disposal, with an annual-notice option for employers who dispose on a routine cycle. Federal paragraph (h) has two subparagraphs and no NIOSH notification duty at all. If your document retention schedule was written from the California standard and applied nationally, you are doing extra work. If it was written from the federal standard and applied in California, you have a gap.

Do Kansas, Missouri, Oklahoma, Nebraska and Texas have their own records-access rules?

No. None of those states operates an OSHA-approved State Plan covering private-sector employers, so federal 1910.1020 applies unchanged, with the fifteen-working-day explain-the-delay structure and no hard production deadline. OSHA’s roster lists 29 approved plans, and Kansas, Missouri, Oklahoma, Nebraska, Texas and Colorado appear on none of them (OSHA State Plans).

That covers every one of iSi’s Tier 1 metros. Wichita, Kansas City on both sides of the state line, Tulsa, Oklahoma City and Omaha are all federal jurisdiction for private employers. A manufacturer with plants across those five markets runs one records-access rule.

The trap sits one state east. Illinois has an OSHA-approved State Plan, and safety managers who check a State Plan map assume Illinois operations follow a state rule. The Illinois plan covers state and local government employees only. A private manufacturer in Illinois is under federal OSHA. The same public-sector-only structure applies in Maine, Massachusetts, New Jersey, New York, Connecticut and the Virgin Islands.

For plants in the other State Plan states, do not assume the federal timing travels. State Plans must be at least as effective as federal OSHA and are free to impose different or additional requirements. California proves the point. A state-by-state sweep of all 29 plan analogues was not run for this post, so treat California as the confirmed variation and verify any other plan state before you write a national procedure around the federal timing.

Does an outside industrial hygiene firm’s sampling report belong to the employer?

Yes. 1910.1020(b)(1) applies the standard to every general industry, maritime and construction employer who “makes, maintains, contracts for, or has access to” employee exposure or medical records. Sampling a consultant performed under contract is the employer’s exposure record. It carries the employer’s thirty-year retention duty under (d)(1)(ii) and must be produced on request.

“Contracts for” is three words that reassign ownership. Most EHS managers read the standard as a duty to hand over what is in their own filing cabinet. The scope paragraph is broader than the filing cabinet. If a firm sampled welding fume at your Tulsa plant in 2009 and emailed a PDF to a plant manager who retired in 2013, that report is your exposure record today. The retention clock started when the record was created, not when you found it.

The same clause reaches your occupational health clinic. Audiograms, respirator medical evaluations, spirometry and biological monitoring performed by an outside provider are employee medical records under (c)(6), and the employer contracted for them.

There is a third category that catches facilities that have never sampled anything. Under 1910.1020(c)(5), an exposure record includes safety data sheets indicating that a material may pose a hazard to human health, and, where no monitoring or biological data exists, a chemical inventory or other record revealing the identity of a toxic substance and where and when it was used. A plant with an SDS library and no air sampling history still holds exposure records subject to this standard.

Run the self-test. First, has anyone at this company ever collected an air sample, a wipe sample, a noise dosimetry reading, a blood lead, or a respirator fit-test medical clearance? Second, do we have SDSs? Third, did we tell every employee at hire and at least once in the last twelve months where those records live, who keeps them, and that a copy is free? If either of the first two is yes and the third is no, the annual notification obligation at 1910.1020(g)(1) is already unmet.

Paragraph (b)(2) closes the last escape route. The section applies to all such records whether or not they are mandated by a substance-specific standard. Voluntary sampling counts. A one-time comfort survey with no exceedances counts.

How long do exposure and medical records have to be kept?

Exposure records: at least thirty years under 1910.1020(d)(1)(ii). Medical records: the duration of employment plus thirty years under (d)(1)(i). Those are different clocks and they are commonly merged. Analyses using exposure or medical records also run thirty years. Background lab worksheets may be dropped after one year if the results, sampling plan, analytical methods and interpretive summary are kept the full thirty.

The medical record clock is the one that gets shortened by accident. For a maintenance tech hired at 24 and retiring at 62, the file has to survive until he is 92. A retention schedule that says “medical: 30 years” is short by the length of a career.

The one-year background-data allowance in (d)(1)(ii)(A) is the only real relief in the paragraph, and it is conditional. You may discard the lab bench sheets and raw chromatograms after a year only if you retained the sampling results, the sampling plan, the analytical method and the interpretation. Most consultants deliver all four inside the report. That is the reason the report itself is the artifact worth indexing.

We already covered the thirty-year problem from the SDS side in the multi-site SDS migration post, including what archive storage costs when a digital platform prices by active chemical count. Read that one for the storage economics rather than re-deriving them here.

Can an employer charge an employee for a copy of their exposure or medical record?

Not for the first copy. 1910.1020(e)(1)(iv) requires the employer to provide a copy without cost, or make copying facilities available without cost, or loan the record long enough for the employee to copy it. The choice among the three belongs to the employer. The zero-cost outcome does not.

Reasonable, non-discriminatory search-and-copy charges are permitted under (e)(1)(v), and only in a narrow lane. They apply to requests for additional copies of a record already provided. They may not be charged for a first request covering information newly added to a record. They may not be charged to a recognized or certified collective bargaining agent making a first request for an exposure record or an analysis.

A per-page fee schedule applied uniformly to all records requests will violate this paragraph the first time an employee makes an initial request. Build the exception into the procedure rather than into the judgment of whoever opens the mail.

Does posting the OSHA “It’s the Law” poster satisfy the annual notification requirement?

No. OSHA answered this directly in a July 16, 2018 letter of interpretation, stating that posting the “OSHA Job Safety and Health: It’s the Law” poster “does not meet the requirements of 1910.1020(g)(1).” The poster covers OSH Act rights generally. Paragraph (g)(1) requires something specific and local.

What (g)(1) actually requires, at hire and at least annually after that: the existence, location and availability of exposure and medical records; the person responsible for maintaining and providing access to those records; and each employee’s rights of access under the standard. A poster on the breakroom wall names none of those.

Paragraph (g)(2) adds a companion duty that is easy to satisfy and easy to forget. Keep a copy of 1910.1020 and its appendices, make copies readily available on request, and distribute any informational materials OSHA makes available.

The annual notification is a recurring obligation with no filing date attached, which is why it disappears from compliance calendars built around dated deadlines. It belongs on the same annual cycle as your other recurring training obligations, and it shows up as a commonly missed audit finding for exactly that reason. We listed it among the annual items worth adding to a training calendar in our annual safety training requirements post; the 2018 poster interpretation is the piece that post does not carry.

Can a union request exposure records without each employee signing an authorization?

For exposure records and analyses, yes. 1910.1020(c)(3) treats a recognized or certified collective bargaining agent as a designated representative “without regard to written employee authorization.” Medical records are different and require specific written consent. Unconsented designated-representative requests for exposure records must be in writing and must state the records sought and the occupational health need for them.

The two record types run on separate tracks and the distinction is the entire compliance question when a union letter lands. Exposure monitoring data, analyses built from that data, and the SDS-and-inventory records that stand in for monitoring are all reachable by the bargaining agent directly. Employee medical records are not.

Written consent for medical records has to contain the seven elements listed at 1910.1020(e)(2)(ii), and the authorization expires no later than one year from the date it was signed unless the employee sets a shorter period. A blanket authorization collected at hire and filed for a decade does not work.

What can an employer legally withhold from a records request?

Very little. 1910.1020(f) permits deletion of trade secret manufacturing processes and percentage-of-mixture data, with notice of the deletion to the requester. Personal identifiers must be stripped from analyses under (e)(2)(iii). Beyond those, the standard runs toward disclosure.

The trade secret provision is narrower than it sounds. Even where an employer withholds the specific chemical identity, the standard requires disclosure of information sufficient to allow the recipient to identify where and when exposure occurred, and requires release of the specific identity in a medical emergency.

One additional carve-out sits inside the medical records paragraph and it is conditional rather than absolute. A physician representing the employer may recommend that an employee not be given direct access to information about a specific diagnosis of a terminal illness or a psychiatric condition. Even then, the information must be released to a designated representative of the employee who has the employee’s written consent, and the physician does not get to withhold it on the ground that it will reach the employee through that route.

What are the penalties for failing to provide access to exposure records?

There is no penalty specific to 1910.1020. A records-access failure is cited on OSHA’s standard schedule: up to $16,550 per serious or other-than-serious violation and $165,514 per willful or repeat violation. Failure to abate runs $16,550 per day past the abatement date, generally capped at thirty days (OSHA memorandum, May 21, 2026).

Those 2026 figures are the 2025 amounts carried forward. The annual inflation adjustment for 2026 was cancelled. OMB Memorandum M-26-11, issued April 17, 2026, explains that BLS could not produce the October 2025 CPI-U because of the appropriations lapse, and the 2015 inflation adjustment statute provides no alternative calculation method. Penalty maximums did not move this year.

Small-employer relief widened in the same period. Effective July 14, 2025, OSHA’s Field Operations Manual Chapter 6 expanded the maximum general size reduction band from employers with 1 to 10 employees out to 1 to 25, moved firms with 11 to 25 employees from a 60 percent reduction to 70 percent, extended the 80 percent serious-willful reduction from employers with 10 or fewer employees to 20 or fewer, and raised the history reduction from 10 percent to 20 percent. Most single-plant manufacturers sit inside those bands.

Is OSHA actually citing 1910.1020?

Rarely, on the one enforcement measurement that could be pulled and verified. In OSHA’s Frequently Cited Standards table for NAICS 31, Manufacturing part 1 of 3, federal OSHA jurisdiction, FY2025, standard 1910.1020 does not appear once among 1,869 citations across 703 inspections (OSHA Frequently Cited Standards, NAICS 31).

Scope that finding carefully, because it is narrower than it looks. It covers NAICS 31 only, federal jurisdiction only, October 2024 through September 2025. It does not describe NAICS 32 or 33, State Plan states, or any national total. No national FY2025 citation figure for this standard was obtainable for this post, so none is offered.

What makes the zero meaningful inside its own scope is that the table is complete. It enumerates standards down to a single citation and $0 in penalties, so the absence is real rather than a truncation. The recordkeeping citations that do appear in that group are Part 1904 items: 1904.39 at 31 citations, 1904.41 at 34, 1904.29 at 17, 1904.32 at 9, 1904.4 at 4, 1904.33 at 1.

The honest read is that 1910.1020 rides along with a health inspection opened for another reason rather than driving one. A records-access failure also surfaces in whistleblower and discrimination matters, which never appear in a cited-standards table at all. Low citation frequency inside one NAICS group is a statement about how the standard gets enforced, not about whether the obligation exists.

There is also no pending rulemaking, no National Emphasis Program, and no dated compliance event on this topic. The only Federal Register activity in the docket is Paperwork Reduction Act housekeeping on a routine three-year renewal cycle, and that comment period closed April 13, 2026 (91 FR 5959). Nothing on the calendar forces this. The letter from the former press operator does.

What happens to the records when the company closes or is sold?

They transfer. 1910.1020(h)(1) requires an employer ceasing to do business to transfer all records covered by the standard to the successor employer, who must receive and maintain them. Where there is no successor, the employer must notify affected current employees of their access rights at least three months before the business ceases.

This paragraph surfaces during acquisition due diligence more often than during an inspection. A buyer taking an asset purchase of a fifty-year-old fabrication plant inherits thirty years of exposure records and the medical files of every current employee, plus employment-duration-plus-thirty-years exposure for those individuals going forward. If the seller cannot produce them, the obligation does not evaporate, and the buyer is the one holding an incomplete file when a request arrives in year two.

Ask for the records index during diligence. Not the records, the index: what monitoring exists, for which agents, at which locations, in which years, and where it physically sits. That single document tells you whether you are buying a compliant recordkeeping system or a thirty-year reconstruction project.

What To Do This Month

Five specific actions, in the order they pay off:

  1. Write the request procedure to the actual federal text. Reasonable time, place and manner as the standard, with a dated delay notice sent inside fifteen working days whenever production will run past it. Add a hard fifteen-calendar-day path for any California facility, with the DOSH extension request as the only relief.
  2. Build the records index. Every IH sampling event your company has ever contracted for, by year, agent, location and consultant. This is the deliverable that determines whether you can answer a request in days rather than months.
  3. Call your current and former consultants for copies of anything you cannot locate. Under (b)(1) those reports are yours regardless of who is storing them.
  4. Split the retention schedule. Exposure at thirty years, medical at duration of employment plus thirty. Two rows, not one.
  5. Put the (g)(1) notification on the annual cycle, in writing, with the location and the responsible person named. The poster does not cover it.

Steps two and three are where most of the work sits, and they are also the steps that put a number on your actual exposure history. iSi’s industrial hygiene team reconstructs sampling histories for multi-site manufacturers, including data collected by prior consultants, and builds the index that makes a records request a two-day task. For facilities without in-house EHS staff to own the annual notification and the retention schedule, that work sits inside the EHS COOP retainer. If the letter has already arrived and you are not sure what you hold, that is the call to make first.

Sources

Tags: