HIPAA Training for Respirator Fit Testing Service Staff

What health information do respirator fit-testing staff handle?

When you provide respirator fit-testing services, you may handle completed medical questionnaires, examination notes, medical evaluation recommendations, and fit-test results. Questionnaires and examination notes can contain sensitive health details; fit-test documentation usually records the employee’s identity, the respirator tested, the test method, date, and result.

Whether this information is protected health information (PHI) under HIPAA depends on who holds or handles it and in what capacity. HIPAA applies to covered entities and their business associates, not automatically to every employer or fit-testing service. HHS also explains that employment records a covered entity holds in its role as an employer are excluded from PHI. See the HHS Summary of the HIPAA Privacy Rule and its guidance on covered entities and business associates.

Regardless of HIPAA status, treat medical information as confidential and follow applicable OSHA requirements, contracts, state law, and your organization’s policies. The OSHA respiratory protection standard, 29 CFR 1910.134, sets requirements for respirator medical evaluations, fit testing, training, and related records.

How should medical questionnaires and examination notes be protected?

Under OSHA’s respiratory protection standard, the medical questionnaire or examination must be administered confidentially, during the employee’s normal working hours or at a time and place convenient to the employee. The employee must have an opportunity to discuss the questionnaire and examination results with the physician or other licensed health care professional (PLHCP). Follow the requirements in 29 CFR 1910.134(e).

Limit access to questionnaires, examination notes, and medical evaluation records to people whose assigned duties require it. Use practical safeguards such as locked storage for paper records, restricted access to electronic files, secure transmission, and careful disposal. If the information is electronic PHI held by a HIPAA-regulated entity or business associate, the HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards. See HHS guidance on the HIPAA Security Rule.

In general, provide the employer with the PLHCP’s written recommendation rather than the employee’s completed questionnaire or detailed examination notes. OSHA’s standard calls for the recommendation to address the employee’s ability to use a respirator, any limitations, and whether follow-up evaluations are needed. It also includes a statement that the PLHCP discussed the questionnaire or examination results with the employee.

How must medical records be kept separate from employee records?

Keep medical evaluation records in a restricted medical-record system rather than placing questionnaires, diagnoses, or examination notes in a general personnel file. Limit access to designated medical or safety personnel who need the information for their work. OSHA’s employee-records rule sets requirements for access to medical records, and respirator medical evaluations must be retained and made available in accordance with it. See 29 CFR 1910.1020.

For ordinary employment decisions, provide only the information needed to carry out the respirator program, such as the PLHCP’s written recommendation and any work-use limitations—not the underlying medical history. This is a prudent confidentiality practice; HIPAA does not create a universal file-separation rule for every employer. HHS distinguishes employment records maintained by an employer from PHI held by a covered entity in another capacity.

What information belongs in a fit-test record?

For each qualitative or quantitative fit test, OSHA requires the employer to establish a record containing:

• The employee’s name or identification.
• The type of fit test performed.
• The specific make, model, style, and size of the respirator tested.
• The date of the test.
• The pass/fail result for a qualitative fit test, or the fit factor and strip-chart recording or other recording of the results for a quantitative fit test.

These are the required elements of respirator fit-test documentation under 29 CFR 1910.134(m)(2). Keep medical histories and examination details out of the fit-test record unless a specific lawful and necessary purpose requires them.

How long should fit-test records be retained?

OSHA requires fit-test records to be retained for respirator users until the next fit test is administered. This retention rule is different from the rule for medical evaluation records. See 29 CFR 1910.134(m).

Medical evaluation records must be retained and made available in accordance with 29 CFR 1910.1020. That standard generally requires employee medical records to be kept for the duration of employment plus 30 years, subject to specified exceptions. Check applicable state requirements, contracts, and organizational retention policies before disposing of records.

When must medical evaluations and respirator training occur?

An employee must receive a medical evaluation before fit testing or required respirator use. A tight-fitting respirator user must be fit tested before initial use, when using a different facepiece make, model, style, or size, and at least annually. An additional fit test is required when a physical change could affect the respirator’s fit. These requirements are set out in 29 CFR 1910.134(e) and (f).

Employees who are required to use respirators must also receive training before use and at least annually afterward. Training must be understandable to employees and cover the respiratory hazards, proper use and limitations, maintenance, and other elements required by the standard. See 29 CFR 1910.134(k).

What privacy and recordkeeping limits should staff understand?

The minimum necessary standard generally requires HIPAA-regulated entities and business associates to take reasonable steps to limit PHI use, disclosure, and requests to what is needed for the purpose. It does not apply in every situation, including certain disclosures to or requests by health care providers for treatment. See HHS guidance on the minimum necessary standard.

Do not assume that every respirator-related record is PHI, or that every fit-testing service is a HIPAA business associate. Determine the organization’s role and the purpose for which it handles the information. When HIPAA applies, follow the relevant Privacy Rule, HIPAA Security Rule safeguards, and any applicable business associate agreement. OSHA’s recordkeeping, confidentiality, and access requirements still need to be followed as applicable.

In practice, protect medical questionnaires and evaluation notes, restrict access to authorized staff, and keep required fit-test documentation distinct from medical details. Apply OSHA’s separate retention rules to medical evaluation records and fit-test records, and follow the organization’s policies and any stricter applicable requirements.

FAQs

Are respirator fit-test records protected health information under HIPAA?

Not automatically. HIPAA applies when identifiable health information is held or transmitted by a covered entity or its business associate in that capacity. Fit-test records held by an employer in its employment role may be employment records rather than PHI under HIPAA. OSHA recordkeeping and confidentiality requirements may still apply.

Who is responsible for retaining respirator medical evaluation records?

The employer must ensure the required medical evaluation records are retained and made available in accordance with OSHA’s recordkeeping rules. A PLHCP or another designated record custodian may maintain the records, but the employer remains responsible for ensuring the applicable OSHA requirement is met. See 29 CFR 1910.134(m)(1).

What details must be included in a respirator fit-test record?

Include the employee’s name or identification, type of fit test, specific respirator make, model, style, and size, test date, and results. For a qualitative fit test, record pass or fail; for a quantitative fit test, record the fit factor and strip-chart recording or another record of the results. See 29 CFR 1910.134(m)(2).

Should medical questionnaires be stored with general employee records?

Keep questionnaires and examination notes in a restricted medical-record system, separate from general personnel files, as a sound confidentiality practice. Limit access to staff who need the information for their duties, and share the PLHCP’s written recommendation with the employer as needed to administer the respirator program rather than circulating detailed medical information.