[Code of Federal Regulations]
[Title 5, Volume 1]
[Revised as of January 1, 2002]
From the U.S. Government Printing Office via GPO Access
[CITE: 5CFR293.503]

[Page 96]
 
                    TITLE 5--ADMINISTRATIVE PERSONNEL
 
                CHAPTER I--OFFICE OF PERSONNEL MANAGEMENT
 
PART 293--PERSONNEL RECORDS--Table of Contents
 
             Subpart E--Employee Medical File System Records
 
Sec. 293.503  Implementing instructions.

    Agencies must issue written internal instructions describing how 
their EMFS is to be implemented. These instructions must--
    (a) Describe overall operation of the system within the agency 
including the designation of the agency official who will be responsible 
for overall system management. When the agency has a medical officer, 
that individual must be named the system manager. The system manager may 
then designate others within the agency to handle the day-to-day 
management of the records, e.g., the custodian of the records at the 
site where they are maintained;
    (b) Be prepared with joint participation by agency medical, health, 
and safety, and personnel officers;
    (c) Describe where and under whose custody employee occupational 
medical records will be physically maintained;
    (d) Designate which agency office(s) will be responsible for 
deciding when and what occupational medical records are to be disclosed 
either to other agency officials or outside the agency;
    (e) Ensure proper records retention and security, and preserve 
confidentiality of doctor/patient relationships;
    (f) Provide that when the agency is requesting an EMF from the 
National Personnel Records Center (NPRC), the request form will show the 
name, title, and address of that agency's system manager or designee, 
who is the only official authorized to receive the EMF;
    (g) Be consistent with Office regulations relating to personnel 
actions when medical evidence is a factor (5 CFR parts 339, 432, 630, 
752, and 831);
    (h) Provide guidance on how an accounting of any record disclosure, 
as required by the Privacy Act (5 U.S.C. 552a(c)), will be done in a way 
that ensures that the accounting will be available for the life of the 
EMF;
    (i) When long-term occupational medical records exist, provide for 
the creation of an EMF for an employee transferring to another agency or 
leaving Government service, and whether an EMF is to be established at 
the time an employee is being reassigned within the agency;
    (j) Ensure a right of access (consistent with any special Privacy 
Act handling procedures invoked) to the records, in whatever format they 
are maintained, by the employee or a designated representative;
    (k) Ensure that a knowledgeable official determines that all 
appropriate long-term occupational medical records are in an EMF prior 
to its transfer to another agency, to the NPRC, or to another office 
within the same employing agency;
    (l) Ensure that all long-term occupational medical records an agency 
receives in an EMF are maintained, whether in that same EMF or by some 
other agency procedure, and forwarded to a subsequent employing agency 
or to NPRC;
    (m) Ensure that, if occupational medical records are to be 
physically located in the same office as the Official Personnel Folder 
(OPF), the records are maintained physically apart from each other;
    (n) Sets forth a policy that distinguishes, particularly for 
purposes of records disclosure, records in the nature of physician 
treatment records (which are generally not appropriate for disclosure to 
non-medical officials) from other medical reports properly available to 
officials making management decisions concerning the employee;
    (o) Provide guidance that distinguishes records properly subject to 
this part from those (e.g., Postal Service or Foreign Service employee 
medical records) subject to different rules, particularly in Privacy Act 
and Freedom of Information Act matters;
    (p) Ensure that guidance regarding the processing of Privacy Act 
matters is consistent with Office regulations implementing the Privacy 
Act at 5 CFR parts 293 and 297; and
    (q) Ensure that no security classification is assigned to an EMF by 
including therein any occupational medical record that has such a 
classification. In this regard, the agency creating the classified 
medical record is required to retain it separately from the EMF while 
placing a notice in the EMF of its existence and describing where 
requests for this record are to be submitted.

[[Page 97]]