North Carolina Administrative Code
Title 13 - LABOR
Chapter 07 - OFFICE OF OCCUPATIONAL SAFETY AND HEALTH
Subchapter A - GENERAL RULES AND OPERATIONAL PROCEDURES
Section .0900 - ACCESS TO EMPLOYEE MEDICAL RECORDS
Section 07A .0903 - SECURITY PROCEDURES; RETENTION AND DESTRUCTION OF RECORDS

(a) All medical information obtained pursuant to an investigation that contains direct personal identifiers shall be separated from the rest of the investigation file and coded with a unique identifying number for each employee. The medical information with its numerical code shall thereafter be secured in a locked cabinet or vault.

(b) The photocopying or other duplication of personally identifiable medical information shall be limited to what is necessary to accomplish the purposes for which the information was obtained.

(c) The protective measures established by the rules in this Section apply to all worksheets, duplicate copies, or other documents containing personally identifiable medical information.

(d) Transfers of personally identifiable medical information shall be by hand delivery, certified mail, or other equally protective means.

(e) In accordance with the Department records retention schedule, personally identifiable medical information and lists of coded direct personal identifiers shall be destroyed or returned to the original record holder when no longer needed for the purposes for which they were obtained or when the case file is closed.