Occupational health records migration: a 10-step checklist

An occupational health records migration moves each worker’s medical and exposure history out of spreadsheets, paper files and old software into one record, without breaking what the law asks of those records: that they are kept for decades, stay retrievable, stay accurate and stay confidential. The hard part is not copying the data. It is being able to show, years later, that nothing was lost, altered or seen by the wrong people on the way.

This guide sets out the rules that still apply during and after the move in the US, Great Britain and the EU, then a 10-step checklist. It is general information, not legal advice.

Why occupational health records are harder to move

An occupational health record is not ordinary business data. Three things set it apart.

The retention clocks run for decades. Under OSHA’s 29 CFR 1910.1020, which covers records of employees exposed to toxic substances or harmful physical agents, each employee medical record must be kept for at least the duration of employment plus 30 years, and each employee exposure record for at least 30 years, unless a specific standard sets another period. The exceptions are narrow, such as the medical records of workers employed for less than a year, if handed to them when they leave. In Great Britain, COSHH regulation 11 requires the health records of workers under health surveillance to be kept for at least 40 years from the date of the last entry. In the EU, Directive 2004/37/EC requires the list of workers exposed to carcinogens or mutagens, and the individual medical records from their health surveillance, to be kept for at least 40 years after exposure ends, in accordance with national law or practice. A record opened today may have to outlive several generations of software. The full picture is in how long to keep occupational health records.

The records sit in more than one place. OSHA’s rule covers records made or maintained in any manner, in-house or through a contractor such as a fee-for-service provider, and the employer stays responsible for preserving them either way. For a multi-site employer, that can mean site spreadsheets, clinic paper files, a provider’s system and exposure monitoring kept by industrial hygiene.

Every step creates copies. Each export, email attachment and USB stick is another copy of health data. The GDPR names the risks to weigh when setting security: accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data (Article 32(2)).

What the law expects during and after the move

United States: OSHA and the ADA

OSHA does not dictate the medium. Section 1910.1020(d)(2) says the standard does not mandate the form, manner or process of preservation, as long as the information is preserved and retrievable, with one exception: chest X-ray films must be preserved in their original state. Scanning paper is allowed; discarding chest X-ray films after scanning them is not.

Access rights do not pause for a cutover. When a worker or their designated representative asks for a record, the employer must provide access in a reasonable time, place and manner, and if that is not possible within 15 working days, tell the requester within those 15 days why, and the earliest date the record will be available ((e)(1)(i)). More detail in OSHA employee medical records.

Closures are migrations too. When an employer is ceasing to do business, it must transfer the records to the successor employer, which must receive and maintain them. With no successor, it must notify affected current employees of their access rights at least three months before the business closes ((h)).

The ADA builds the wall between medical and HR data. Under 29 CFR 1630.14(c)(1), information on an employee’s medical condition or history from exams and inquiries must be kept on separate forms, in separate medical files, and treated as a confidential medical record. The exceptions are narrow: supervisors and managers may learn about necessary work restrictions and accommodations, first aid and safety personnel may be informed, when appropriate, if the disability might require emergency treatment, and government officials investigating compliance get relevant information on request. A migration that loads a site spreadsheet, diagnosis column included, into an HR system puts that separation at risk. See employee health records vs personnel files and does HIPAA apply to employee health records.

Great Britain: COSHH health records

Under COSHH regulation 11, which applies in England, Wales and Scotland, the employer must keep each health record, or a copy, available in a suitable form for at least 40 years from the date of the last entry. It must also let a worker see their own health record on reasonable notice and, if it ceases to trade, notify HSE in writing at once and make all health records available to it.

HSE’s record-keeping guidance draws the line that matters most in a migration. A COSHH health record is the legal record of the outcome of health surveillance: the worker’s details, where they work, the hazards they have been exposed to and their fitness to continue that exposure. It should not contain confidential medical information unless the worker gives written consent. Clinical notes and test results belong in medical records, kept in medical confidence by the occupational health professional responsible for the scheme. When the occupational health provider changes, HSE says medical records in paper and electronic form should be transferred to the new provider.

European Union: GDPR accuracy, security and processors

Health data is special category data under the GDPR (Article 9(1)), and several of its rules bite hardest during a migration. The UK has its own UK GDPR, with the same security duties in Article 32; both regimes are covered in GDPR and workforce health data.

• Accuracy (Article 5(1)(d)). Every reasonable step must be taken to erase or rectify inaccurate data without delay. A transposed date or a merged identity is an accuracy problem, not only an IT bug.
• Integrity and confidentiality (Article 5(1)(f)). Processing must ensure appropriate security, including protection against accidental loss, destruction or damage.
• Security of processing (Article 32(1)). The listed measures include encryption, the ability to restore access after an incident, and regular testing of the measures.
• Processors (Article 28(3)). Processing by a vendor on the employer’s behalf must be governed by a contract that, among other things, binds its staff to confidentiality and requires it to delete or return all personal data at the end of the service, and delete existing copies, unless law requires storage. That matters for the new vendor and the outgoing one.
• Impact assessment (Article 35(3)(b)). A data protection impact assessment is required for large-scale processing of special category data. Where it applies, run or update it before the move, not after.
• Breaches (Articles 4(12) and 33(1)). A personal data breach includes accidental loss, such as a lost export file. The controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to people.

The migration checklist

Carry the original dates (step 3). The clocks run from different events: the end of employment for OSHA medical records, the last entry for COSHH health records, the end of exposure under the EU directive. If the import date overwrites the date of an exam or the date a worker left, any retention schedule built on the new system will compute the wrong end date. Keep the original date of every exam, result and entry, and the worker’s employment dates, as data, not as notes.

One worker, one record (step 4). The same person often appears in several site spreadsheets under slightly different names, and contractors are often tracked separately or not at all. OSHA’s definition of employee includes former employees, so leavers’ records are still in scope. Have a person review every uncertain match. For shared sites, see contractor health records.

Do not leave exposure records behind (step 2). Under OSHA, exposure records include workplace monitoring results, biological monitoring results that measure absorption of a substance, safety data sheets and, failing those, chemical inventories. They often live with industrial hygiene, not the clinic, yet they are what links a later diagnosis to a job and a site.

Decommission properly (step 10). Retired laptops, file servers and USB drives still hold copies. NIST SP 800-88 Rev. 2, published in September 2025, sets out how to plan media sanitization and disposal according to the sensitivity of the information.

Validation: how to know nothing was lost

Run five checks before each site switches over:

1. Reconcile counts per source, per site and per record type: workers, exams, results, exposure records.
2. Run field checks: plausible dates, consistent units, required fields present, no clinical data where HR can read it.
3. Have a health professional review a random sample of migrated records against the source. Clinical content stays with health professionals during the review, as it will after it.
4. Test retrieval as if a request had arrived. Pick a former worker from an old site and produce their full medical and exposure history in the new system, then check that it could be provided in a reasonable time, well within the 15 working days by which OSHA requires the employer either to provide access or to explain the delay and give a date.
5. Keep an exceptions log: every record not migrated, why, and where the original now sits.

Where MyC fits

MyC replaces pen, paper and Excel across sites with one employee health record per worker, employees and contractors alike. The migration is scoped so that older records can be imported into MyC before each site switches on, and MyC’s team works with the customer to configure the platform and launch it gradually across sites. Health professionals work in the full record; HSE, HR and managers see only what their responsibilities require, such as fitness decisions and work restrictions, without medical details. Every medical event is timestamped, every access is logged, medical details are encrypted at rest and in transit, and the history stays available for audits, even decades later. See the occupational health EHR or book a demo.

Questions

Can paper occupational health records be destroyed after scanning?

In the US, OSHA allows any form as long as the information is preserved and retrievable, but chest X-ray films must be kept in their original state. In Great Britain, COSHH requires the health record or a copy to be kept in a suitable form for at least 40 years from the last entry. Check other national rules, and evidence needs for future claims, before destroying originals.

Which dates should be kept when records are migrated?

The dates the retention clocks run from: the worker’s employment dates for OSHA medical records, the date of each entry for COSHH health records, and the end of exposure under the EU carcinogens directive. Keep the original date of every exam and result as well.

What happens to records when the occupational health provider changes?

In Great Britain, HSE says medical records in paper and electronic form should be transferred to the new provider. Under OSHA, the employer stays responsible for the records whether they are kept in-house or by a contractor.

Sources

1. 29 CFR 1910.1020: Access to employee exposure and medical records
2. 29 CFR 1630.14: Medical examinations and inquiries specifically permitted (ADA)
3. Control of Substances Hazardous to Health Regulations 2002, regulation 11: Health surveillance
4. HSE: Health surveillance, record keeping
5. Directive 2004/37/EC on carcinogens, mutagens and reprotoxic substances at work, Article 15 (consolidated April 8, 2024; Article 15 not changed by Directive (EU) 2026/2450)
6. Regulation (EU) 2016/679 (GDPR): Articles 4, 5, 9, 28, 32, 33 and 35
7. UK GDPR Article 32: Security of processing
8. NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization (September 2025)

Written by Lisa Bardet, VP Marketing at MyC. Every factual claim in this article is checked against primary sources, such as regulations, regulators and peer-reviewed studies, in three passes before publication, and the sources are listed above.

This article is general information for employers and occupational health teams. It is not legal or medical advice for a specific situation.