The Phone Call That Exposed a $1.7 Million Blind Spot

A hospital safety officer called me three years ago, panicking. OSHA had requested employee exposure records following a bloodborne pathogen incident. The safety team handed over the files — which included diagnostic details, treatment notes, and HIV test results pulled straight from the employees' medical charts. They thought they were complying with one federal agency. Instead, they'd just violated another.

That's the OSHA HIPAA collision in a nutshell. Two federal mandates, both legitimate, both enforceable, and both capable of generating six-figure penalties when your staff doesn't understand where one ends and the other begins.

If you run a healthcare organization — or any covered entity where employees also happen to be patients — you need to understand how OSHA and HIPAA interact. Get it wrong, and you're not just facing one regulator. You're facing two.

OSHA and HIPAA: Two Different Agencies, One Shared Workforce

OSHA, the Occupational Safety and Health Administration, exists to keep workers safe. HIPAA, enforced by HHS through the Office for Civil Rights (OCR), exists to keep patient data private. In most industries, these mandates never cross paths.

Healthcare is different. Your workforce is exposed to biological hazards and handles protected health information (PHI) every single shift. When an employee gets a needlestick, both OSHA and HIPAA have something to say about what happens next — and they don't always agree.

OSHA requires employers to maintain records of occupational injuries, illnesses, and exposures. Under the Bloodborne Pathogens Standard (29 CFR 1910.1030), employers must offer post-exposure evaluation, maintain confidential medical records, and make certain records available to OSHA upon request.

HIPAA requires covered entities to protect individually identifiable health information and disclose it only under specific permitted conditions. Employee medical records maintained by a covered entity's healthcare component can absolutely contain PHI — and that's where things get complicated.

Where the OSHA HIPAA Overlap Actually Hurts Organizations

Employee Health Records in a Covered Entity

Here's the scenario I see most often. A hospital employs 3,000 people. Some of those employees receive care at the same hospital. Their medical records now serve dual roles — they're patient records and employee health records. HIPAA protects those records as PHI. OSHA may require access to portions of those records for compliance purposes.

The mistake? Treating OSHA's authority as a blanket exemption to HIPAA's Privacy Rule. It isn't. HIPAA does include provisions that permit disclosures required by law — 45 CFR § 164.512(b) allows disclosures for public health activities, and § 164.512(a) permits disclosures required by other laws. But those permissions are narrow, not unlimited.

OSHA Inspections and PHI Access

When OSHA conducts an inspection or investigates a complaint, inspectors may request medical records related to workplace exposures. Your compliance team needs to know exactly what OSHA is entitled to see — and what must be redacted or withheld under HIPAA.

OSHA can access employee medical records under 29 CFR 1910.1020. But HIPAA's minimum necessary standard still applies. You disclose only what's directly relevant to the occupational health issue. Handing over a full medical chart because OSHA asked about a chemical exposure is over-disclosure — and it's a HIPAA violation.

Sharps Injury Logs and Incident Reports

OSHA requires a sharps injury log under the Bloodborne Pathogens Standard. That log must include the type and brand of device involved, the department, and an explanation of how the incident occurred. It must not include the employee's name or any information that could identify them in a way that violates HIPAA.

I've reviewed sharps logs at clinics that listed the employee's full name, the patient's name, diagnosis, and room number. Every one of those fields beyond the OSHA requirements was unnecessary PHI exposure. This is fixable with five minutes of training — but most organizations never deliver that training.

What HIPAA Actually Permits When OSHA Comes Knocking

Let me answer the question I get asked most: Can you share employee health information with OSHA without violating HIPAA?

Yes — but only under specific conditions. HIPAA's Privacy Rule permits disclosures required by law (§ 164.512(a)), which includes valid OSHA requests. It also permits disclosures for workplace medical surveillance under § 164.512(b)(1)(v). The key constraints are:

  • Apply the minimum necessary standard — share only what OSHA needs, nothing more.
  • Verify the request is legitimate and within OSHA's statutory authority.
  • Document the disclosure in your HIPAA accounting of disclosures.
  • Never use an OSHA request as justification to access PHI you wouldn't otherwise be authorized to view.

When your Privacy Officer and Safety Officer coordinate on this before an OSHA inspection happens, you avoid the panic-driven over-disclosures that generate breach reports.

The $2.3 Million Lesson From Failing to Separate Roles

OCR's enforcement history is full of cases where organizations failed to properly segment employee health functions from treatment functions. In 2018, OCR settled with Allergy Associates of Hartford for $125,000 after a physician improperly disclosed a patient's PHI — the patient was also associated with the practice. That's a smaller case, but the principle scales.

The larger settlements — like the $4.3 million penalty against MD Anderson Cancer Center for ePHI breaches — reinforce that OCR does not accept confusion between operational roles as an excuse for privacy failures. When your safety team has unrestricted access to your EHR because "they need exposure records," you've built a compliance catastrophe waiting for a trigger.

Five Steps to Get OSHA HIPAA Compliance Right

1. Separate Employee Health Records From Patient Records

If your employees receive treatment at your facility, maintain their occupational health records in a separate system or clearly segmented section. OSHA's required records — exposure logs, post-exposure evaluations, vaccination records — should not be co-mingled with clinical treatment records accessible through your standard EHR workflows.

2. Train Both Teams Together

Your Safety Officer and Privacy Officer need to be in the same room at least once a year. I've seen organizations where these two roles have never met. That's how you get safety staff pulling full patient charts for OSHA logs. Our HIPAA Introduction Training 2026 covers cross-regulatory scenarios like this one.

3. Create an OSHA Disclosure Protocol

Write a one-page protocol that specifies exactly what your organization discloses when OSHA requests medical records. Include who authorizes the disclosure, what gets redacted, and how the disclosure is documented. Tape it to the wall in your compliance office.

4. Audit Your Sharps Logs and OSHA 300 Logs

Pull your sharps injury log and your OSHA 300 Log right now. Look for names, diagnoses, room numbers, or any other identifiers that exceed what OSHA requires. If you find them, you have a training gap. Our HIPAA Training for Nurses addresses exactly these clinical workflow issues.

5. Run a Tabletop Exercise

Simulate an OSHA inspection that requests employee medical records. Walk your team through the process. Who pulls the records? Who reviews them for minimum necessary compliance? Who signs off? If your team can't answer those questions smoothly, you're not ready for the real thing.

Why Your Workforce Training Probably Has a Gap Here

Most HIPAA training programs cover patient-facing scenarios — the snooping employee, the misdirected fax, the lost laptop. Almost none cover the OSHA-HIPAA intersection. Your safety team may have never received HIPAA training at all, even though they routinely handle ePHI in the form of exposure records and incident reports.

Under HIPAA, every member of your workforce who touches PHI must receive training. That includes safety officers, occupational health nurses, HR staff managing FMLA and workers' comp, and anyone who maintains OSHA-required medical records. If these roles aren't in your training matrix, you have a compliance gap that OCR will find before you do.

Our HIPAA Fundamentals course builds this cross-functional awareness from the ground up — covering not just clinical staff, but every role in the workforce that interacts with protected health information.

The Bottom Line: Two Laws, One Compliance Strategy

OSHA and HIPAA aren't adversaries. They're parallel obligations that require coordinated compliance. The organizations that struggle are the ones that treat them as separate silos — safety over here, privacy over there, and nobody talking in between.

Build the bridge now. Train your workforce across both frameworks. Write the protocols before an inspector shows up. Because when OSHA knocks on your door and HIPAA is watching from the other side, the only thing that protects you is preparation.