In addition to maintaining patient records, your organization is also required to maintain certain records related to your employees. Read on for an overview of each category of employee records, along with documentation and retention requirements for each.

Training Records

Different agencies require different lengths of retention for training records. OSHA requires that safety-related training records be maintained for a minimum of 3 years. HIPAA training records must be maintained for at least 6 years. The OIG requires fraud, waste and abuse training records and billing and coding training records to be kept on file for 10 years.

Training documentation should include:

• The dates of training
• The contents, or a summary of the training information provided
• The name of the person(s) conducting the training
• The name and job titles of all persons participating in the training
• Fraud, Waste and Abuse (FWA) training records should include the start date of each participant’s employment

Training documentation can be accomplished by simply retaining a Compliance Training Test (included with each of Eagle Associates’ training modules) for each participating staff member. These records may be maintained digitally or on paper. You are not required to file training documentation in each individual staff member’s personnel record, though some accrediting organizations may have specific training documentation requirements. If you utilize Eagle Associates’ e-Compliance Training program, your electronic reports can serve as official training documentation.

Employee Medical Records

OSHA requires that employers maintain a medical record for each employee for the duration of their employment plus thirty years. If an employee has been employed less than one year, OSHA permits an employer to provide the employee with their medical record upon termination without having to meet the thirty-year retention requirement. For compliance documentation purposes, is still advised to keep a copy of employee records, even if they were employed for less than a year.

Employee medical records should include:

• The employee’s name and secondary identifier such as an employee ID number or date of birth. It is no longer recommended to maintain employees’ full social security numbers.
• If the employee will experience occupational exposure to bloodborne pathogens, a copy of the employee’s hepatitis B vaccination status, including dates of all hepatitis B vaccinations, or a signed hepatitis B vaccine declination statement
• A copy of any incident, accident or illness records that are applicable to the employee
• A copy of all results of examinations, medical testing, and procedures required following an exposure incident (if applicable)
• Baseline tuberculosis test results, and, if your facility’s risk level requires it, results of subsequent skin tests. Documentation of any positive results should be followed by annual symptom screening questionnaires, and any records of examination or treatment for active TB infection.
• Influenza and COVID-19 vaccination records (if vaccines are offered to employees)
• Employee medical complaints and any other medical information relevant to their employment

Because they contain protected health information (PHI), employee medical records must be maintained confidentially. Only authorized staff members should be permitted to access employee medical records. Employees have the right to access their medical record, even after their employment ends.

Exposure Records

Employers also must maintain an exposurerecord for employees who may be exposed tohazardous chemicals, bloodborne pathogens,and other occupational hazards.

Exposure records may be combined with employee medical records, and would include:

• Workplace monitoring or measuring of a toxic substance or harmful physical agent (i.e., formaldehyde exposure monitoring, ionizing radiation monitoring), including any forms of sampling, as well as related analytical methodologies, calculations, and other data relevant to the interpretation of results obtained;
• Biological monitoring results which directly assess the absorption of a toxic substance or harmful agent by body systems, for example, results of testing for levels of an agent in an employee’s blood, urine, breath, etc.;
• Safety data sheets (SDSs), which indicate that a material may pose a hazard to human health; and/or a chemical inventory or other record that reveals where and when a product was used, and the identity of the harmful ingredient. SDSs and/or chemical inventories may be kept apart from employee medical/exposure records but must be maintained for thirty years beyond last use of the product, so that exposure information is available if needed.

If exposure records are maintained separately from medical records, they must also be maintained for the duration of employment plus thirty years. Exposure records will contain PHI and must be maintained in a confidential manner.

Employment Records

Employment records (also known as personnel records) will include any other documentation regarding an individual’s employment that does not pertain to their medical record or training records. These records may be included with other personnel, or human resource files, etc.

Documentation in an employment record may include:

• A signed medical records acknowledgement form. You are required to inform employees annually of the existence and availability of their employee medical record.
• Any records regarding workplace violence or harassment complaints (if applicable);
• A signed employee confidentiality statement pertaining to HIPAA Rules;
• A signed Employee Code of Conduct form (for fraud, waste and abuse prevention in Medicare/Medicaid programs, if applicable); and
• A signed Employee Notice of Privacy Practices form (if the organization meets the definition of a health plan under HIPAA). You may not combine medical and/or exposure records with employment/personnel records.

Access to confidential medical/exposure records should only be provided to staff members that have a legitimate need, such as to verify required testing has been completed.