**BONNEVILLE POWER ADMINISTRATION**

**HUMAN CAPITAL MANAGEMENT**

**Portland, Oregon**

**PERSONNEL LETTER NO. 293-2 (Revised) DATE:** January 2, 2008

**SUBJECT:** Occupational Medical Records

**PURPOSE**[]{#__RefHeading___Toc187024637 .anchor}

> This Personnel Letter -

-   Establishes the Bonneville Power Administration's (BPA's) policy on
    the maintenance, retention, and transmittal of occupational medical
    records pertaining to employees, consistent with 5 CFR 293, Employee
    Medical File System Records and DOE-33.

-   Clarifies the definitions under Section I.

-   Supersedes Personnel Letter 293-2 dated June 27, 2003.

**POLICY SUMMARY**[]{#__RefHeading___Toc187024638 .anchor}

The Bonneville Power Administration (BPA) adheres to the appropriate
establishment, maintenance, processing, use, dissemination and
safeguarding of all employee medical records. To ensure the security and
confidentiality of records, access is limited to those whose official
duties require access to the records.

BPA has instituted controls to prevent careless and unintentional
disclosure or destruction of personnel data. When appropriate, BPA will
ensure that the Human Capital Management staff is responsible and
accountable for disposing of personnel records as required by the Office
of Personnel Management.

Table of Contents

[**PURPOSE 1**](#__RefHeading___Toc187024637)

[**POLICY SUMMARY 1**](#__RefHeading___Toc187024638)

[**I. DEFINITIONS 3**](#__RefHeading___Toc187024639)

[**II. COVERAGE 4**](#__RefHeading___Toc187024640)

[**III. RESPONSIBILITIES 5**](#__RefHeading___Toc187024641)

[**IV. LOCATION AND SECURITY OF EMF\'S
5**](#__RefHeading___Toc187024642)

[**V. EXCLUSIONS FROM THE EMFS 6**](#__RefHeading___Toc187024643)

[**VI. ESTABLISHMENT, TRANSMITTAL, AND RECEIPT OF EMFS
6**](#__RefHeading___Toc187024644)

[**VII. ACCESS TO AND DISCLOSURE OF MEDICAL RECORDS
7**](#__RefHeading___Toc187024645)

[**VIII. EFFECT OF HIPAA ON BPA\'S AUTHORITY, AS AN EMPLOYER, TO OBTAIN
AND MAINTAIN MEDICAL INFORMATION
8**](#effect-of-hipaa-on-bpas-authority-as-an-employer-to-obtain-and-maintain-medical-information)

[**IX. AMENDMENT OF MEDICAL RECORDS 9**](#__RefHeading___Toc187024647)

[**X. RETENTION OF MEDICAL RECORDS 9**](#__RefHeading___Toc187024648)

[**XI. OWNERSHIP OF MEDICAL RECORDS 10**](#__RefHeading___Toc187024649)

[**XII. REFERENCES 10**](#__RefHeading___Toc187024650)

I.  **DEFINITIONS**[]{#__RefHeading___Toc187024639 .anchor}

> **Drug-Testing Records**
>
> Are records created when an employee is tested for use of illegal
> drugs under an agency plan implementing Executive Order 12564 or for
> the use of alcohol under Department of Transportation regulations in
> 49 CFR, Part 40. The records include results of tests, indications
> that an employee has/has not reported for testing, copies of notices
> to the employee of proposed action when a confirmed positive test
> result is made, and related documents, and are a component of the
> Employee Medical File System. However, these records must be kept
> separate from the Employee Medical Folder. BPA Drug and Alcohol
> Testing Program records do not include employee assistance and
> counseling records that are set up when an employee formally enters
> and participates in the Employee Assistance Program for alcohol and/or
> drug abuse.
>
> **Employee**
>
> An individual employed by BPA, covered by the protections specified in
> the Personnel Letter (PL). This does not include student volunteers or
> contractor employees.
>
> **Employee Medical File System (EMFS) Manager**
>
> The individual in the Human Capital Management staff assigned
> responsibility for the management of the BPA-wide EMFS.
>
> **Employee Medical Folder (EMF)**
>
> A separate file folder (SF-66D) that contains all medical records
> designated for retention that is maintained by BPA for active
> employees, and is forwarded to other employing agencies or the
> National Personnel Records Center (NPRC) in accordance with regulatory
> requirements. Audiometric records are part of the EMFS, but are
> maintained by the Safety Office in support of BPA's hearing
> conservation program. These records are to be included in the EMF upon
> separation or transfer of an employee from BPA.
>
> **Electronic Employee Medical File (EEMF)**
>
> The electric system of records that replaces the EMF and contains all
> medical records designated for retention maintained by BPA for active
> employees.
>
> **Health Insurance Portability and Accountability Act (HIPAA) Privacy
> Rule**
>
> The Privacy Rule implements the privacy requirements of the
> Administrative Simplification subtitle of the HIPAA. This rule
> regulates the use and disclosure of individual's health information by
> health plans, health care clearinghouses and health care providers,
> referred to as covered entities. The Privacy Rule requires explicit
> consent from patients, except in a limited number of circumstances,
> before a covered entity can release protected health information. This
> rule applies directly to BPA's health care units because they are
> health care providers. However, it does not restrict BPA in its role
> as an employer from receiving or requesting medical information in
> order to make employment related determinations.
>
> **Medical Records Custodian (MRC)**
>
> An individual assigned responsibilities for maintaining medical
> records.
>
> **Occupational Illness/Injury Record**
>
> Any documentation that indicates an on-the-job occupational illness/
> /injury under the Federal Employees Compensation Act (FECA). When a
> claim is filed with the Office of Workers' Compensation Programs
> (OWCP), the official file is retained by the Department of Labor
> (DOL). Copies of documents retained by BPA are maintained in an agency
> working file and are not part of the EMF. A notice of injury not filed
> with OWCP is to be placed in the employee's EMF and retained in
> accordance with OPM regulations governing disposal of the EMF.
>
> **Occupational Medical and Related Records**
>
> A chronological, cumulative record of information about health status
> developed on an employee and related to employment, regardless of the
> form or process by which it is maintained. This includes personal and
> occupational health histories, exposure records, medical surveillance
> records, and records about occupational illnesses, injuries, and
> diseases. Related records include the opinions and written evaluations
> generated in the course of diagnosis and/or treatment by medical
> health care professionals and technicians or by industrial hygienists.
>
> **Routine Use**
>
> With respect to the disclosure of a record, the use of such record for
> a purpose which is
>
> compatible with the purpose for which the information was collected.
>
> **Safety/OHSA Long-Term Record**
>
> Medical records as defined in OSHA regulations (29 CFR 1910 and 1960).
> These records are designated for retention for the duration of
> employment plus 30 years and reports related to occupational illness,
> accident, injury, or exposure , required to be completed under OHSA
> regulations (see 20 CFR 10), whether or not a Federal Employee
> Compensation Act (FECA) file is created.

II. **COVERAGE**[]{#__RefHeading___Toc187024640 .anchor}

Occupational Medical Records are maintained and used by the BPA to:

1.  Provide data necessary for proper medical evaluations, diagnosis,
    treatment and care;

2.  Provide an accurate medical history, including job and/or hazard
    exposure documentation and health monitoring in relation to health
    status and claims of the individual;

3.  Provide a method for evaluating quality of health care rendered and
    job-health protection including engineering protection provided,
    protective equipment, workplace monitoring, and medical examinations
    monitoring required by the Occupational Safety and Health
    Administration (OSHA) or by good practice;

4.  Provide data for health hazard evaluations, epidemiologic studies
    and public health activities;

5.  Ensure that all relevant, necessary, accurate, and timely data is
    available to support any medically related employment decisions
    affecting the subject of the records, including decisions pertaining
    to the fitness-for-duty and disability retirement;

6.  Document possible re-employment rights under statutes governing that
    program;

7.  Document employee's reporting of on-the-job injuries or unhealthy or
    unsafe working conditions, including the reporting of such
    conditions to the OSHA and actions taken by the agency or by the
    employing agency; and;

8.  Ensure proper and accurate operation of the agency's employee drug
    testing program under Executive Order 12564.

9.  Ensure that BPA has all the relevant, necessary and accurate
    information to meet its statutory, administrative and legal
    obligations,

    II. **RESPONSIBILITIES**[]{#__RefHeading___Toc187024641 .anchor}

        A.  **Chief Human Capital Officer (CHCO)**: The CHCO is
            responsible, through his/her staff, for the maintenance,
            retention, and transmittal of occupational medical records
            pertaining to employees and for the proper implementation of
            this policy.

        B.  **Employee Medical File System (EMFS) Manager:** The Manager
            is responsible for the proper maintenance, retention, and
            transmittal of medical records maintained by BPA. The
            Medical Program Manager will serve as the EMFS Manager.

        C.  **Medical Records Custodians (MRC):** The EMFS Manager, by
            the provision of this Personnel Letter, can delegate to
            certain MRC's the responsibility for medical records, which
            they use in carrying out their duties. The delegates are:

            1.  **Manager, Safety and Health** has the authority to
                review medical records that originate as a result of BPA
                Safety Program activities and OSHA regulations.
                Audiometric records are part of the EMFS, but are
                physically located in the Safety Office in support of
                BPA's hearing conservation program. These records are to
                be included in the EMF upon separation or transfer of an
                employee from BPA.

            2.  **Injury Compensation Specialist** has the
                responsibility of reviewing and maintaining all OWCP
                files.

            3.  **Drug and Alcohol Testing Program Coordinator** has the
                responsibility of maintaining drug and alcohol testing
                records.

```{=html}
<!-- -->
```
D.  **BPA Privacy Act/Freedom of Information Act Officer** has the
    responsibility for determining the appropriate release of
    information under the Freedom of Information Act (FOIA). As the
    Authorizing Official designated by the FOIA Officer, the Medical
    Program Manager is responsible for identifying, locating, collecting
    and determining availability of requested information. FOIA requests
    for information contained in the EMFS must be referred to the
    Freedom of Information Act Officer for review.

    II. **LOCATION AND SECURITY OF
        EMF'S**[]{#__RefHeading___Toc187024642 .anchor}

```{=html}
<!-- -->
```
A.  **The physical location of medical records will be at the BPA
    Headquarters Office is restricted to the following individuals:**

    1.  The Medical Program Manager

    2.  The Manager, Safety and Health

    3.  The BPA Headquarters Human Capital Management staff, limited to
        assisting the EMFS Manager with transmission as required by OPM

    4.  The Injury Compensation Specialist.

    5.  The Reasonable Accommodations Coordinator

    6.  The Drug and Alcohol Testing Coordinator

    7.  The Health Unit medical staff

B.  **Security of Files:** Paper Medical Records must be kept in a
    locked cabinet and must be physically separate from other records.
    Electronic Medical Records must be password protected, encrypted and
    access auditable. Unauthorized access **will not** be possible.

    II. **EXCLUSIONS FROM THE EMF'S**[]{#__RefHeading___Toc187024643
        .anchor}

> The following types of records are **[not]{.underline}** part of the
> EMFS.

A.  **Employee Assistance and Counseling Records:** Records that are
    created when an employee enters and participates in BPA's Employee
    Assistance Program (e.g., drug or alcohol abuse or personal
    counseling).

B.  **Agency FECA Records**: Copies of claims and medical documentation
    submitted as part of a claim under FECA, and retained by BPA with
    the official file residing with Department of Labor.

C.  **Non-Occupational/Patient Records:** Records of medical treatment
    or examination not related to employment (e.g., records of voluntary
    employee physical examinations, administration of allergy shots, or
    records of non-work-related medical treatment or examination).

    II. **ESTABLISHMENT, TRANSMITTAL, AND RECEIPT OF EMF'S**
        []{#__RefHeading___Toc187024644 .anchor}

```{=html}
<!-- -->
```
A.  EMF's (SF-66D) contain records designated for retention and may also
    contain short-term medical records, as long as the employee and
    his/her EMF remain at BPA. EMF's will be established as follows:

    1.  The MRC at Headquarters will establish the EMF in accordance
        with the guidance provided in 5 CFR 293. The SF-66D, Employee
        Medical Folder, is the only type of file folder that may be used
        to establish the EMF.

    2.  An EMF will be established when medical records exist that are
        appropriate for filing in the EMF if an EMF has not previously
        been established.

B.  The MRC at Headquarters is responsible for the transmittal of the
    EMF to the NPRC or an employee's new agency (including another
    employing office within the Department). The EMF will be transmitted
    only to the appropriate official at the NPRC or to the EMFS Manager
    (and only the EMFS Manager) at the employee's new agency.

    1.  A Human Capital Management staff will notify the MRCs when an
        employee is leaving BPA and requests that all medical records
        pertaining to the employee be transmitted to the Manager,
        Medical Program within 20 working days.

    2.  The Medical Program Manager will consolidate this information
        and make it available for transmission to the NPRC.

C.  The MRC at Headquarters is authorized to receive an EMF from another
    agency, the NPRC, or another organization within the Department. The
    EMF will be requested from the previous agency at the same time as
    the employee's OPF. The EMF will be maintained by Headquarters until
    the employee leaves BPA.

    II. **ACCESS TO AND DISCLOSURE OF MEDICAL
        RECORDS**[]{#__RefHeading___Toc187024645 .anchor}

```{=html}
<!-- -->
```
A.  Medical records are subject to the Privacy Act. The EMFS Manager
    must ensure that the provisions of the Privacy Act are strictly
    adhered to. Guidance on this issue is available in 5 CFR, Part 293,
    Subpart E, Employee Medical File System of Records, DOE-33 and from
    the Privacy Act/Freedom of Information Act Officer.

B.  The MRC maintains medical records as part of his/her official
    duties**.** OPM has published "routine uses" for these records in
    its systems-of-records notice OPM/GOVT-10. Additional guidance is
    provided in the U.S Department of Energy - DOE-33. A records
    custodian is not required to release the records just because he/she
    receives a request for the records. The first responsibility of an
    MRC is to protect the confidentiality of the records; therefore, the
    scope of any request should be carefully examined and narrowed
    whenever feasible. Only the specific record sought or a portion of
    that record should be released; or if appropriate, a report by the
    EMFS Manager on the contents of the file should be furnished in lieu
    of the record itself. If an MRC is unsure about whether or not
    he/she should release the records, he/she should consult with the
    EMFS Manager or the BPA Privacy Act/Freedom of Information Act
    Officer. Additionally, it is BPA policy that medical evaluations and
    other restricted medical information that describe an employee's
    medical condition not to be released to the employee's manager or
    other in his or her chain of command. Instead, only the resulting
    job restrictions indicated by the medical record, rather than the
    underlying medical condition, are to be released.

C.  Unauthorized disclosure of medical records exposes the individual
    releasing the information to the penalties (including fines) of the
    Privacy Act. An MRC or the EMFS Manager should release these records
    only to the individual(s) who require the data to perform their
    official duties in accordance with OMP/GOVT-10 and DOE-33. The BPA
    EMFS has been set up to make such an occurrence very rare, since
    employees who require the records to perform their official duties
    have been identified as an MRC for those records. Only the EMFS
    Manager may authorize "routine use" releases of information from the
    EMF Release of records to (1) other than a Federal agency the
    employee has been transferred to; (2) a proper adjudicating agency
    (e.g., OWCP or OPM); or (3) for a purpose other than that identified
    as a "routine use" can only be authorized by the Privacy Act
    Officer.

D.  All disclosures of medical records must be documented and requested
    in writing. This request must include the name and organization of
    the requestor and the purpose of the request. Documentation of
    disclosures under "routine use" and of short-term records must be
    retained for 5 years, or the life of the record, whichever is
    longer. The record of the disclosure of long-term medical records is
    retained permanently in the EMF.

E.  Employees have the right to access all of their EMFS records. This
    includes the right to designate in writing another party to
    represent them, providing the written designation specifies the
    record and name of the representative. Guidance on this issue is
    available in 5 CFR, Part 293.504(b), Employee Medical File System of
    Records. When a request for access involves medical or psychological
    records that require special handling, the requester will be advised
    that the material is only to be provided to the requester\'s
    physician**.** Upon receipt of the designation and upon verification
    of the physician\'s identity, the records will be made available to
    the physician, who will have full authority to disclose those
    records to the data subject when appropriate. If any records are
    withheld from the requester, he/she must be informed in writing of
    his/her right to submit a written appeal to:

> U. S. Office of Personnel Management
>
> Assistant Director for Workforce Information
>
> Human Resources Systems Service
>
> 1900 E. Street NW
>
> Washington, DC 20415-0001

F.  Freedom of Information Act (FOIA) requests for records in the EMFS
    must be referred to the BPA Freedom of Information Act Officer.

# EFFECT OF HIPAA ON BPA'S AUTHORITY, AS AN EMPLOYER, TO OBTAIN AND MAINTAIN MEDICAL INFORMATION

A.  HIPPA requirements do not affect BPA's authority to: (1) order or
    offer medical examinations; (2) request employees to provide medical
    documentation for the purpose of making employment-related
    determinations; and/or (3) maintain employee medical records that
    are described in Federal Regulations (e.g., in 5 CFR 339, 5 CFR 630,
    5 CFR 293 and 20 CFR Chapter 1). HIPAA does not pertain to, or place
    any restrictions on, the circumstances under which medical
    documentation may be acquired by BPA, and/or medical examinations
    and evaluations are conducted by BPA or on behalf of BPA.

B.  When an employee requests leave for medical reasons (including under
    the Family and Medical Leave Act or the Family Friendly Leave Act)
    or when an employee requests reasonable accommodation for a medical
    condition, he/she is required to provide adequate medical
    information to BPA to support his/her request, including a consent
    for release of information in some cases, if the employee wants his
    or her request to be considered. If he/she does not provide the
    requested information, his/her request may not receive
    consideration. (See Personnel Letters 630-1, Leave Administration
    and 900-2, BPA Reasonable Accommodation Plan).

    II. **AMENDMENT OF MEDICAL RECORDS**[]{#__RefHeading___Toc187024647
        .anchor}

        Under the Privacy Act, an individual is permitted to request any
        amendment of an EMFS record, including a change in a record, the
        removal of a document, or the substitution of one medical
        opinion in lieu of another. A decision not to change the record
        in the exact manner requested is considered a denial requiring
        notification of the individual's right of appeal.

    III. **RETENTION OF MEDICAL RECORDS**[]{#__RefHeading___Toc187024648
         .anchor}

```{=html}
<!-- -->
```
A.  Medical records (see 5 CFR, Part 293, Subpart E, Employee Medical
    File System of Records, for description) are retained by BPA for the
    length of employment. Upon transfer, they are to be forwarded to the
    receiving agency along with the OPF. If the employee separates from
    Federal service, the EMF is to be transferred to the National
    Personnel Records Center within 90 days of separation. NPRC will
    maintain these records in accordance with NARA regulations,
    currently 30 years or for as long as the OPF is maintained, 5 CFR,
    293.511.

B.  Records arising in connection with employee drug and/or alcohol
    testing under Executive Order 12564 are retained for two years. The
    EMFS Manager may decide to retain such records for a longer
    duration. They are stored separately from the EMF and may not be
    placed in the EMF when the employee transfers to another Federal
    agency or leaves the Federal service.

C.  Medical records that are not placed in the EMF are disposed of by
    shredding, burning or secure deletion.

D.  The agency copy of OWCP claim information under the Federal
    Employees Compensation Act (FECA) is retained by BPA and maintained
    in an agency working file and are not part of the EMF. A notice of
    injury not filed with OWCP is to be placed in the employee's EMF and
    retained in accordance with OPM regulations governing disposal of
    the EMF. When a claim is filed with the Office of Workers'
    Compensation Programs (OWCP), the official file is retained by the
    Department of Labor (DOL).

    1.  Copies of documents retained by BPA as part of the agency
        working file of OWCP / FECA claims are retained in accordance
        with the BPA Records Manual retention and disposition file
        guide.

    2.  When the BPA copy of OWCP records (i.e., the FECA file) is
        retained, while the employee is being compensated but is no
        longer a BPA employee, or when medical records need to be
        maintained by BPA for some other reason, the following
        procedures will be followed:

        a.  A notation will be placed in the employee's Official
            Personnel Folder stating the EMF has been retained by BPA.

        b.  BPA will not destroy records during the specified retention
            period .If BPA ceases to have use for the records prior to
            the destruction schedule, it will ship the EMF to the NPRC
            for storage.

    ```{=html}
    <!-- -->
    ```
    II. **OWNERSHIP OF MEDICAL RECORDS**[]{#__RefHeading___Toc187024649
        .anchor}

> Medical records in the EMFS are the property of the OPM, not BPA.

III. **REFERENCES**[]{#__RefHeading___Toc187024650 .anchor}

-   5 CFR, Part 293, Subpart E, Employee Medical File System Records.

-   Office of Personnel Management (OPM), Privacy Act of 1974, System of
    Records, OPM/GOVT-10, Employee Medical File System.

-   5 CFR, Part 339, Subpart C, Medical Examinations, Records, and
    Reports.

-   DOE-33

-   Executive Order 12564, Drug Testing.

-   Mandatory Guidelines for Federal Workplace Drug Testing Programs,
    issued by Health and Human Services.

-   49 CFR, Part 40, Procedures for Transportation Workplace Drug and
    Alcohol Testing Programs.

-   PL 630-1, Leave Administration

-   PL 900-2, Reasonable Accommodation

-   Health Insurance Portability and Accountability Act of 1996.

J. Cleve Brooks

Chief Human Capital Officer