OSHA 29 CFR 1910.1020: What Employers Get Wrong

Q: What records does 29 CFR 1910.1020 require employers to retain?

1910.1020 covers employee exposure records, employee medical records, and analyses built from either category. All three are subject to independent retention obligations.

Q: How long must exposure records be kept vs medical records?

Exposure records: minimum 30 years from creation. Medical records: duration of employment plus 30 additional years after last employment date.

Q: Do employers need to retain air monitoring results that showed no exposure?

Yes. OSHA explicitly requires retention of all monitoring results regardless of detected levels. Discarding non-detect results is a violation.

Q: What happens to exposure records when an employee leaves?

Medical records must be kept for 30 years after last employment date. HR processes that destroy files at offboarding produce a systematic violation for every departing employee.

Q: What must an employer do before destroying records when closing a business?

Under 29 CFR 1910.1020(h), the employer must notify NIOSH at least 3 months before destroying records and give employees the opportunity to receive copies.

Q: How does OSHA calculate penalties for 1910.1020 violations?

Per-record, per-employee citations. A denied request covering three employees' files can produce six violations at up to $16,550 each, or $165,514 each for willful violations.

Q: Does 1910.1020 cover physical hazard records, or only chemical exposure?

It covers all toxic substance and harmful physical agent records, including radiation, noise, vibration, and ergonomic assessments, not only chemical monitoring.

INSIGHTS: EHS ESSENTIALS

The 30-Year Exposure Record Gap
Why Most Employers Are Already in Violation

OSHA’s 29 CFR 1910.1020 requires exposure records to be retained for 30 years, yet 70 to 80 percent of inspected employers have at least one violation. When an access request arrives, OSHA can cite every missing file as a separate violation at up to $165,514 each.

Years

Minimum retention for employee exposure records under 29 CFR 1910.1020(d). Medical records require the duration of employment plus 30 additional years.

OSHA, 29 CFR 1910.1020(d)

$165K

Per Violation

Maximum OSHA penalty per willful or repeated violation as of January 15, 2025. Applied per record in 1910.1020 access failures: one denial can produce dozens of citations.

OSHA Penalty Schedule, 2025

80%

Have Violations

Of inspected employers have at least one violation annually. OSHA’s in-compliance rate for inspected sites is only 20 to 30 percent.

Safety and Health Magazine, 2024

OSHA’s 29 CFR 1910.1020 is one of the most violated standards in American workplaces, not because employers ignore it, but because most do not know it exists. Employers who believe they are fully OSHA-compliant, maintaining injury logs, conducting hazard communication training, and posting required notices, are routinely unaware that 1910.1020 creates a separate, independent set of retention obligations that run alongside every other requirement. These obligations do not end when an employee leaves. They do not end when a company closes. And they do not apply only to records that show elevated exposures.

The scientific justification for the 30-year floor is unambiguous. Mesothelioma has a latency period of 20 to 50 years. Lung cancer from workplace asbestos or silica exposure develops 20 to 40 years after the causative contact. Silicosis can take 10 to 30 years to manifest under chronic conditions. When a worker files a compensation claim decades after exposure, the exposure and medical records retained under 1910.1020 are often the only documentation that connects their diagnosis to their former employer’s workplace. Absent those records, the claim dies.

This article compiles the key statistics on the retention requirement, compliance failures, OSHA enforcement mechanics, disease latency periods, and the practical challenges that make 30-year retention harder than it appears. Includes updated 2025 penalty figures and current enforcement data.

Key Statistics: 29 CFR 1910.1020

15 Days

Maximum time employers have to provide access to exposure and medical records on employee request. Failure to meet this deadline triggers citation potential separate from any underlying retention failure.

OSHA, 29 CFR 1910.1020(e)

700+

Improper recording cases found in a single OSHA audit of one company’s 3,500 medical files at Avondale Industries. Missing documents, denied access, and inadequate retention across a 20 percent non-compliance rate within one organisation.

OSHA Enforcement Record

$50K-$200K

Typical total fine range from a single OSHA audit with multiple respirator-related and 1910.1020 violations. Individual violations run $7,000 to $16,550 each; per-record enforcement turns a handful of missing files into a six-figure exposure.

RespiratorTest.com, 2026

15,000+

Medical evaluation documents a 500-employee company must retain over 30 years. For a 50-employee firm, the number is 1,500+. Volume at this scale makes paper-based systems unreliable and the 15-day OSHA access deadline impractical.

RespiratorTest.com, 2026

20-50 Years

Latency period for mesothelioma, the primary scientific justification for the 30-year retention floor. A worker first exposed in 1995 may not receive a diagnosis until 2025 to 2045, decades after the original employer’s records would otherwise have been destroyed.

Mesothelioma.net, 2025

1. What 29 CFR 1910.1020 Actually Requires

The regulation imposes two separate retention clocks that most employers conflate. Exposure records run for 30 years from creation date. Medical records run for the duration of employment plus 30 additional years, meaning a medical file created on an employee’s first day must be retained until 30 years after their last day. The two clocks are independent, and mixing them up is itself a compliance failure.

Record Type

Retention Requirement

Employee Exposure Records

Minimum 30 years from date of record creation. Includes air monitoring, biological monitoring, MSDSs/SDSs that identify substances, and all records used to assess toxic exposure.

Employee Medical Records

Duration of employment PLUS 30 additional years after last date of employment. Covers medical evaluations, physical examinations, biological monitoring results, and workplace injury or illness records.

Analyses of These Records

Any epidemiological study, occupational health analysis, or report built from exposure or medical data must also be retained for 30 years from the date of analysis.

Background Data (Limited Exemption)

Laboratory worksheets and raw background sampling data may be retained for 1 year ONLY IF the summary results, collection methodology, analytical methods, and data summary are kept for the full 30 years.

Access Rights

Employees, former employees, authorised representatives (doctors, unions, spouses), and OSHA itself must receive access within 15 working days of request. Employers must notify employees annually of this right.

Source: OSHA 29 CFR 1910.1020 | LegalClarity, 2026

Non-detect results are not exempt. The most pervasive myth in 1910.1020 compliance is that air monitoring samples returning below-threshold readings do not need to be retained. OSHA explicitly requires them regardless of result. Destroying a non-detect sample is a violation. (Seyfarth Shaw, January 2026)
Physical hazard records are covered. Radiation dosimetry, noise dosimetry, ergonomic assessments, and vibration monitoring records all fall under 1910.1020, not just chemical exposure data. Employers who conduct industrial hygiene assessments for physical hazards have full retention obligations under this standard. (Pappas Grubbs Price)
Annual notification is itself an obligation. Employers must notify employees at hire and annually thereafter of the existence of exposure and medical records and their right to access them. Failure to provide this notification is a separate, independently citeable violation with per-employee exposure. (29 CFR 1910.1020(g))

2. Disease Latency: Why the 30-Year Floor Exists

OSHA did not choose 30 years arbitrarily. The retention period maps directly to the latency periods of the occupational diseases most likely to produce compensation claims decades after the causative exposure. The landmark study of 17,800 asbestos insulation workers observed from 1967 to 1976 found that lung cancer peaked 30 to 35 years from onset of exposure, and mesothelioma incidence did not decline even at the study’s end. The 30-year floor is the minimum, not the safe point.

Occupational Disease Latency Periods

Mesothelioma (Asbestos) 20-50 years

Peak incidence 35 to 45 years post-exposure. A worker first exposed in 1990 may not receive a diagnosis until 2025 to 2040, after most paper record systems have been destroyed, reorganised, or lost.

Lung Cancer (Asbestos / Silica) 20-40 years

Peaked at 30 to 35 years in the insulation workers study. Hazard communication records and air monitoring data from 20 to 40 years ago are the primary evidentiary link to current diagnoses.

Silicosis (Chronic) 10-30 years

Accelerated silicosis can appear in 5 to 10 years; acute silicosis in months from very high-intensity exposure. Engineered stone cutting is a current accelerated silicosis risk in the construction industry.

Asbestosis 10-30+ years

Progressive scarring can continue even after exposure ends. Symptoms peaking at 40 to 45 years in the insulation workers study means medical records created 30 years ago may still be the primary evidence today.

Source: Mesothelioma.net, 2025 | Selikoff Insulation Workers Study (PubMed) | RespiratorTest.com, 2026

The 30-year floor is a minimum, not a ceiling. Asbestosis peaks at 40 to 45 years; mesothelioma continues rising beyond 50. For these diseases, a 30-year-old record is still actively relevant evidence. Employers who destroy records exactly at the 30-year mark risk destroying records that are about to become legally material. (MyPatientAdvice, March 2026)
Without records, mesothelioma claims hit a dead end. Lack of medical and exposure records is specifically cited in clinical literature as a factor complicating mesothelioma diagnosis and legal claims. Workers who cannot establish the causal link between their illness and a former employer’s workplace have no legal remedy: the employer’s failure to retain records is the cause. (Mesolawsuitafterdeath.com, 2025)

3. The Six Ways Employers Fail 1910.1020

Enforcement data and legal analysis identify six recurring failure patterns. The most dangerous is the first: employers who have never heard of the standard cannot comply with it, and OSHA’s Field Operations Manual provides for per-record citations the moment an access request surfaces the gap.

1. Unaware the Standard Exists

The single most common failure. Many employers believe OSHA recordkeeping means only the 300 log (29 CFR 1904) and have never implemented a separate 1910.1020 programme. This is specifically documented by legal counsel who handle OSHA enforcement actions.

2. Confused About Scope

Employers who know 1910.1020 exists frequently believe it covers only chemical exposures above permissible limits. In fact, it covers all toxic substance and harmful physical agent records, including non-detect monitoring results, radiation records, and ergonomic assessments.

3. Destroying Records at Termination

A former employee’s medical record must be retained for 30 years after their last date of employment, not discarded at offboarding. HR processes that destroy employee files at termination are a systematic 1910.1020 violation across every departing employee’s file.

4. Discarding Non-Detect Samples

Employers frequently discard air monitoring results that returned below detectable limits, believing that “no exposure found” means “no record needed.” OSHA requires retention regardless of result. The absence of detected exposure is a data point with legal and medical significance.

5. Paper Systems That Degrade

A 500-employee company accumulates 15,000+ medical evaluation documents over 30 years. Paper systems degrade, documents are misfiled, and staff turnover destroys institutional knowledge of where records are stored. The 15-day OSHA access deadline is effectively impossible to meet with an unorganised paper archive.

6. Company Closure Without NIOSH Notice

When a business closes with no successor employer, the obligation does not end. The closing employer must notify NIOSH at least 3 months before destroying records and give employees the opportunity to receive copies. This step is almost never planned for in business closure processes.

Fit tests are not medical evaluations. A particularly common error: medical evaluations require 30-year retention; fit test records do not. Many employers make the reverse mistake, discarding medical evaluations after 12 months because they confuse them with fit testing, which only needs to be kept until the next test. (RespiratorTest.com, 2026)
Successor employers inherit the full obligation. In mergers, acquisitions, and business sales, the successor employer assumes complete retention responsibility for records created by the predecessor organisation. OSHA explicitly holds successor employers accountable. Failing to include 1910.1020 records in due diligence is a material compliance risk. (LegalClarity, April 2026)

4. How OSHA Calculates the Penalty Exposure

The mechanism that makes 1910.1020 so financially dangerous is not the per-violation penalty ceiling: it is the per-record, per-employee citation structure documented in OSHA’s Field Operations Manual. A single access request that covers three employees’ exposure and medical files can produce six separate violations before OSHA has even looked at the underlying documents.

$16,550 Per Serious Violation

Maximum OSHA penalty per serious or other-than-serious violation as of January 15, 2025. Applied per record in 1910.1020 access failures: three employees, two record types each, equals six violations at up to $16,550 each before the inspector reviews a single document.

OSHA, January 2025

$165,514 Per Willful / Repeat

Maximum OSHA penalty per willful or repeated violation as of January 15, 2025, a 2.6 percent increase from 2024, with annual cost-of-living adjustments expected to push this figure higher in 2026. Willful citations require knowledge of the standard, which prior OSHA correspondence or prior citations establish.

OSHA, January 2025

Florenza Chicago: 11 Serious, 10 Willful

At Florenza, a Chicago stone product manufacturer, OSHA found workers exposed to silica at up to six times the permissible exposure limit. Multiple workers required lung transplants from silicosis. OSHA issued 11 serious and 10 willful violations, including failures to establish baseline medical monitoring and conduct medical surveillance.

Safety and Health Magazine, OSHA Top 10, 2024

Recordkeeping violations are consistent top-10 presence. Fall protection remained OSHA’s most cited standard for the fourteenth consecutive year in FY2024 with 6,307 violations. Hazard communication was second with 2,888. Recordkeeping violations appear in the top 10 annually, and inadequate exposure and medical record retention frequently accompanies both. (OSHA Top 10 FY2024)
The most common respirator violation is documentation-based. Failure to provide medical evaluations before employees use respirators under 29 CFR 1910.134(e)(1) accounts for approximately 35 percent of all respirator citations and carries average fines of $8,500 to $12,000 per violation, with each employee using a respirator without medical clearance counted as a separate violation. (RespiratorTest.com, 2026)

5. Why 30-Year Retention Requires Digital Infrastructure

The volume math alone explains why paper systems fail 1910.1020. A company with 500 employees accumulates over 15,000 medical evaluation documents over 30 years. Staff turnover destroys institutional knowledge of the filing system. Paper degrades. Misfiled documents disappear. And when an OSHA access request arrives, the 15-day response deadline becomes a practical impossibility without rapid digital retrieval.

Digital Systems with HIPAA-Compliant Storage

OSHA has encouraged the shift to electronic documentation and continues to move toward electronic record submission for injury logs. Digital record systems with audit-ready formatting and HIPAA-compliant secure storage are increasingly the standard expectation for 1910.1020 compliance at meaningful scale.

IntelliChief, March 2026

Mergers and Acquisitions: Records Must Transfer

Companies that merge, are acquired, or are sold must ensure exposure records are explicitly included in the asset transfer. The successor employer assumes full retention responsibility, and OSHA holds successors accountable for records created by predecessors. Failing to include 1910.1020 records in M&A due diligence creates an inherited liability.

LegalClarity, April 2026

The 300 Log Retention Period Is Not the Model

The OSHA 300 injury log requires only 5 years of retention. Employers accustomed to the 5-year cycle who apply that assumption to exposure monitoring data are systematically underretaining records with a 30-year obligation. The two standards run independently and cannot be conflated.

IntelliChief, 2026

Key Takeaways

1910.1020 Is Invisible Until It Is Not

Most employers do not know 29 CFR 1910.1020 exists separately from their injury log obligations. That invisibility is precisely why it generates large penalty exposure when an inspection or employee access request surfaces it. Conduct a records audit against the three categories: exposure records, medical records, and analyses, before an inspector does.

Non-Detect Records Must Be Retained

The most pervasive myth in 1910.1020 compliance is that exposure measurements below detectable limits do not need to be kept. They do. The absence of detected exposure is a data point with legal and medical significance, and destroying it is a violation regardless of what the result showed.

The Penalty Exposure Is Per Record: Not Per Inspection

Under OSHA’s Field Operations Manual, 1910.1020 access failures are cited per record per employee. A request for three employees covering both exposure and medical records can produce six violations at up to $16,550 each. An employer with an uncontrolled paper system failing a multi-employee audit faces more than $50,000 in penalties from a single access request, before OSHA has examined any underlying documents for additional violations.

Frequently Asked Questions

What records does 29 CFR 1910.1020 require employers to retain?

1910.1020 covers three categories: employee exposure records (air monitoring, biological monitoring, safety data sheets identifying substances, and any records used to assess toxic exposure); employee medical records (evaluations, physical examinations, biological monitoring results, and injury or illness records); and analyses built from either category. All three categories are subject to retention obligations independently.

How long must exposure records be kept vs medical records?

Exposure records must be retained for a minimum of 30 years from the date of record creation. Medical records must be retained for the duration of employment plus 30 additional years after the employee’s last date of employment. The two clocks are independent and cannot be conflated with each other or with the 5-year OSHA 300 log retention period.

Do employers need to retain air monitoring results that showed no exposure?

Yes. OSHA explicitly requires retention of all exposure monitoring results regardless of whether they returned detectable levels. The absence of exposure is a legally and medically significant data point. Employers who discard “non-detect” monitoring results believing they have no recordkeeping value are in violation of 29 CFR 1910.1020.

What happens to exposure records when an employee leaves the company?

The retention obligation does not end at termination. Medical records must be kept for the duration of employment plus 30 additional years after the last date of employment. HR processes that destroy employee files at offboarding are producing a systematic 1910.1020 violation for every departing employee whose records are discarded.

What must an employer do before destroying records when closing a business?

Under 29 CFR 1910.1020(h), if a company closes with no successor employer, it must notify NIOSH at least 3 months before destroying any exposure or medical records, and must give employees and their designated representatives the opportunity to receive their own records. Closing a business without this notification is a violation even if the business has ceased operations.

How does OSHA calculate penalties for 1910.1020 violations?

OSHA’s Field Operations Manual provides for per-record, per-employee citations for 1910.1020 access failures. A denied request covering three employees’ exposure and medical records can produce six separate violations at up to $16,550 each for serious violations, or up to $165,514 each for willful or repeated violations. Total fine exposure from a single audit routinely reaches $50,000 to $200,000.

Does 1910.1020 cover physical hazard records, or only chemical exposure?

The standard covers records related to any toxic substance or harmful physical agent, including radiation dosimetry, noise dosimetry, vibration monitoring, and ergonomic assessment records, not only chemical monitoring data. Employers who conduct industrial hygiene assessments for physical hazards have full 30-year retention obligations under 1910.1020 for those records.

Sources

Government and Regulatory Sources

OSHA. 29 CFR 1910.1020: Access to Employee Exposure and Medical Records: Full regulatory text covering retention schedules, record categories, access rights, employee notification obligations, and transfer requirements on business closure.
OSHA. Penalty Schedule (January 2025): Current maximum penalties for serious, willful, repeated, and failure-to-abate violations, adjusted under the Federal Civil Penalties Inflation Adjustment Act. Effective January 15, 2025.
EPA. Recordkeeping Requirements for Asbestos Operations and Maintenance: 30-year personal air sampling retention and medical surveillance requirements for asbestos operations, updated July 2025.
OSHA. Top 10 Most Frequently Cited Standards, FY2024: Enforcement frequency data including fall protection (6,307 violations), hazard communication (2,888), and the broader recordkeeping enforcement context.

Research and Industry Sources

Seyfarth Shaw (January 2026): Employee exposure and medical records: scope of 1910.1020, access obligations, and avoiding OSHA citations for non-detect records and physical hazard monitoring.
LegalClarity (April 2026): What employee records must be kept for 30 years: retention clocks, exceptions, NIOSH notification on closure, and successor employer obligations.
RespiratorTest.com (January 2026): OSHA 30-year retention rule: penalty ranges, document volume calculations for employers of various sizes, and paper system failure analysis.
Mesothelioma.net (November 2025): Mesothelioma latency period: 20 to 50 years, asbestosis 10 to 30 years, clinical and legal implications for records retention requirements.

Exposure Record Retention: The 30-Year OSHA Gap