HIPAA Compliance Guide for Commercial Diving Medical Examiners

When Does HIPAA Apply to a Commercial Diving Medical Examiner?

HIPAA does not automatically apply to every clinician who performs a commercial diving examination. A health care provider is generally a HIPAA covered entity if the provider transmits health information electronically in connection with a transaction for which HHS has adopted a standard—for example, certain electronic claims or eligibility transactions. Sending ordinary email, by itself, does not make a provider a covered entity. See the HHS Summary of the HIPAA Privacy Rule.

A separate question is whether an examiner or clinic acts as a business associate. That may be the case when a non-workforce contractor handles protected health information on behalf of a covered entity to perform a covered function or service. If the relationship qualifies, the covered entity generally needs a written HIPAA business associate agreement setting out permitted uses and required safeguards. The label in a contract is not decisive; assess what the parties actually do. See HHS Covered Entities and Business Associates.

When HIPAA applies, identifiable medical histories, test results, examination notes, and fitness conclusions held by the covered entity or its business associate can be protected health information, whether recorded on paper, electronically, or orally. Employers’ employment records are treated differently: HIPAA does not protect records an employer maintains in its capacity as an employer, although the examiner’s own records may still be protected. See the HHS Privacy Rule summary.

What Information Should a Diving Fitness Examination Assess?

There is no single federal OSHA checklist that requires every commercial diver to undergo the same medical examination. A careful assessment should be individualized to the diver, the work, the diving mode, and the consequences of a sudden health problem underwater. OSHA’s appendix lists examples of conditions that may restrict or limit exposure to hyperbaric conditions, with the effect depending on factors such as severity, treatment response, diving mode, and isolation—not as automatic disqualifiers. See OSHA Appendix A to Subpart T.

Depending on the clinical history and job demands, the examiner may assess:

• Prior diving-related illness or injury, including decompression illness and barotrauma, and any continuing symptoms or restrictions.
• Cardiovascular and pulmonary history, exercise tolerance, and relevant current symptoms.
• Neurological history, including seizure history, and any condition or medication that could impair consciousness, coordination, judgment, or emergency response.
• Ear, sinus, and vestibular history, including ability to equalize pressure and any balance or hearing concerns relevant to the work.
• Medications, substance use, and other conditions that could affect safe exposure to hyperbaric conditions or the ability to perform assigned duties.
• The specific work profile, such as diving mode, expected depth and duration, isolation, thermal conditions, physical workload, and available emergency support.

These are clinical considerations, not a claim that OSHA mandates each test or examination component. The examiner should document the basis for any restrictions, additional testing, or referral, and should distinguish a medical finding from the occupational decision about assignment.

What May the Medical Report Disclose to the Operator and Dive Supervisor?

A fitness-for-duty medical report should ordinarily answer the operational question without unnecessarily disclosing the diver’s full history or diagnostic details. It can state whether the diver is fit for the specified work, whether restrictions or follow-up apply, and when reassessment is appropriate. Keep the underlying clinical record separate from the report sent to the operator or dive supervisor.

If HIPAA applies, disclosure to an employer generally requires a valid authorization or a specific HIPAA permission. One limited permission covers certain workplace medical surveillance or evaluation of work-related illness or injury when the service is employer-requested or provided as part of the employer’s workforce, the employer needs the findings to meet OSHA or similar legal duties, and the disclosure is limited to those findings. HHS also says the individual must receive written notice of this disclosure. This is not a blanket permission to send an employer every pre-placement or fitness-examination result; see HHS guidance on employer-requested examinations.

Apply the minimum necessary standard when it governs the disclosure: share only what is reasonably needed for the stated purpose. The standard has exceptions, including disclosures made pursuant to a valid authorization and certain provider-to-provider disclosures for treatment. In practice, a supervisor may need a work status or specific limitation, not the full examination file. See the HHS Minimum Necessary Requirement guidance.

Use a clear authorization when that is the basis for release. Identify the information, recipient, purpose, and expiration as required, and follow applicable state privacy laws and employer procedures as well. HHS explains the authorization requirements in its guidance on HIPAA consent and authorization.

How Should Examiners Secure and Retain Diving Medical Records?

First determine whether HIPAA applies to the examiner’s practice or to the examiner as a business associate. Where it does, protect paper and electronic records with appropriate safeguards, limit access to authorized personnel, and use secure procedures for transmitting and disposing of records. For electronic protected health information, the HIPAA Security Rule requires administrative, physical, and technical safeguards; see the HHS Summary of the Security Rule.

HIPAA does not set a general retention period for all medical records. State law and other applicable requirements may set the period, so establish a retention schedule that accounts for the examiner’s jurisdiction, the record’s purpose, and any employer or contract requirements. HHS confirms that the Privacy Rule itself does not establish medical-record retention periods in its medical-record retention FAQ.

For OSHA employee medical records, a separate rule may apply where the employer makes, maintains, contracts for, or has access to records relating to employees exposed to toxic substances or harmful physical agents. When 29 CFR 1910.1020 applies, the general retention period for an employee medical record is employment duration plus 30 years, subject to listed exceptions and any specific standard that sets a different period. Review the scope and exceptions in OSHA’s employee medical records standard.

Keep the distinct OSHA diving-related injury hospitalization records requirement in view: an employer must record a diving-related injury or illness requiring hospitalization for 24 hours or more, and retain those records for five years under 29 CFR 1910.440. That requirement does not mean every examiner’s full clinical file has the same five-year retention period; assess whether additional OSHA employee medical record duties or state rules apply. See OSHA’s commercial diving recordkeeping standard.

How Do OSHA Record Access Requirements Interact With HIPAA?

OSHA record access and retention rules do not create unrestricted access for an operator or dive supervisor to a diver’s complete clinical record. Under 29 CFR 1910.1020, an employee may request access to their own covered medical records, and a designated representative may access an employee’s medical records with the employee’s specific written consent. OSHA’s commercial diving rule makes specified records available through the procedures in that standard. See 29 CFR 1910.1020 and 29 CFR 1910.440.

When HIPAA applies to the examiner, the examiner must still identify a valid basis for disclosure to the employer—such as a valid authorization or the limited workplace-surveillance permission—and keep the release within that basis. OSHA’s rule directs employers to provide covered records in accordance with its access provisions; it should not be read as a general authorization for employers to obtain every medical detail. Coordinate the record custodian, employee access process, representative consent, and any HIPAA authorization before releasing records.

Keep event records and clinical records distinct. OSHA-required diving-related injury hospitalization records document the circumstances and extent of a qualifying event; the examiner’s medical file may contain much more information. The applicable retention period and access rule depend on which record is involved and which regulations cover it.

What Qualifications and Jurisdictional Rules Apply to Diving Medical Examiners?

OSHA’s current commercial diving standards address dive-team qualifications and employer responsibilities, including not permitting a team member to dive during a known temporary physical impairment or condition likely to adversely affect safety or health. The current Subpart T contains no general medical-examination section equivalent to the former 29 CFR 1910.411, which OSHA removed. See 29 CFR 1910.410, OSHA Subpart T, and OSHA’s commercial diving enforcement directive.

Accordingly, do not assume there is one universal federal license or OSHA credential called “commercial diving medical examiner.” Verify the clinician’s authority to perform and sign the examination under the medical-practice and licensing rules of the relevant state or jurisdiction. Employers, contracts, industry standards, or project-specific rules may also set additional qualifications or examination criteria; treat those as separate from federal OSHA requirements.

For an examiner, the practical approach is to confirm the applicable jurisdiction and job standard, conduct a clinically appropriate assessment for the actual diving demands, issue a narrowly tailored fitness-for-duty medical report, and protect the underlying record under the laws and agreements that apply. HIPAA coverage, permissible disclosure, OSHA record access, and retention are related but separate questions, so assess each rather than assuming one rule answers them all.

FAQs.

Does HIPAA apply to every commercial diving medical examiner?

No. HIPAA generally applies to a health care provider that conducts certain standard electronic transactions, or to a qualifying business associate handling protected health information for a covered entity. A commercial diving medical examiner’s role alone does not determine HIPAA status. See the HHS Privacy Rule summary.

What medical information can an examiner share with a dive operator?

Usually, the report should communicate the diver’s fitness status and any relevant restrictions, not the entire medical file. If HIPAA applies, the examiner needs a valid authorization or another applicable HIPAA permission. The narrow employer disclosure permission for workplace surveillance or work-related illness or injury applies only when its conditions are met. See HHS guidance on employer-requested examinations.

How long must commercial diving medical records be retained?

There is no single answer for every examiner’s clinical file. HIPAA does not set a general medical-record retention period; state law and other applicable requirements govern. OSHA separately requires five-year retention of qualifying diving-related injury hospitalization records, while the general OSHA employee medical-record rule may require employment duration plus 30 years when it applies. See HHS retention guidance, 29 CFR 1910.440, and 29 CFR 1910.1020.

Can an employer access a diver’s medical examination records?

An employer does not have automatic access to every detail in a diver’s examination file. Depending on the circumstances, disclosure may require the diver’s authorization or fit a specific legal permission. OSHA provides employees access to covered employee medical records and allows access by designated representatives with specific written consent; that is not the same as blanket access for an employer or supervisor. See OSHA’s access standard and HHS guidance on employers and health information.