15.2 Record Retention, Privacy and Recovery

Training-record design and applicable fields

Useful training records support verification, follow-up and continuity. Required fields depend on the applicable rule; a recommended administrative record should not be presented as a universal legal minimum.

Record the learner, course/version, date, instructor or evaluator, relevant results and follow-up. Use a unique identifier when appropriate, but avoid unnecessary sensitive data. Separate attendance, completion, assessment and authorization so that a roster cannot be mistaken for competence.

OSHA Record Retention Periods: Regulatory Standards

Retention mandates vary significantly across specific OSHA standards. EHS managers and CITs must maintain a comprehensive retention schedule:

The Critical Distinction: OSHA 29 CFR 1910.1020

A common and serious compliance error on professional certification examinations is confusing routine safety training records with records governed by OSHA 29 CFR 1910.1020 (Access to Employee Exposure and Medical Records).

Distinguishing Record Classifications

• Training records: Evidence of instruction or evaluation, retained under the particular applicable schedule.
• Exposure records: Information about exposure, including qualifying monitoring or other defined records.
• Medical records: Health information subject to specific access, confidentiality and retention arrangements. Classify the record before selecting retention and access controls.

Learning Management System (LMS) Data Integrity and Audit Readiness

Modern industrial facilities rely on electronic Learning Management Systems (LMS) to track regulatory qualifications. An electronic system must maintain strict data integrity standards to satisfy regulatory audits:

• Assign access permissions according to role and sensitivity.
• Preserve reliable change history and approved corrections.
• Back up records and test recovery, including evidence of restored readability and completeness.
• Use a documented retention and disposal schedule with any required holds.
• Verify migration counts and sample restored records instead of assuming that a completed upload proves integrity.

Implementing a recoverable record system

A record system must make the relevant evidence available when needed, while controlling access and retention. Decide which records are kept on site, off site or in both places, and how a user locates them. Separate routine course records from sensitive medical information. Link records with an appropriate identifier without exposing unnecessary personal data in a class report.

Define the authoritative copy and correction process. If a paper roster is transcribed into a database, verify names, dates, course versions and results against the source. An upload count can match while individual records are linked to the wrong learner. Sample content and check known exceptions. Preserve the necessary source evidence according to the applicable schedule rather than discarding it merely because scanning finished.

Backup is a preserved copy; recovery is the demonstrated ability to restore usable evidence. Assign responsibility, define what loss and delay are acceptable for the program, and test restoration. A backup notification alone does not establish that a file can be opened, read or matched with the learner. Test permissions after restoration as well as file integrity.

For example, a cloud provider outage prevents roster retrieval during an internal review. An approved recovery copy lets the authorized reviewer obtain the necessary course and assessment evidence. If that copy contains only a summary count, it may not meet the need. Review what must be recovered before the outage rather than discovering the gap during it.

Document retention, disposal, holds, access and recovery responsibilities. When changing systems or providers, validate exports and usable formats, and plan the transition. Keep continuity across platform changes; a vendor contract ending does not end the employer's record obligations.

Employee records, fit-test records, bloodborne-pathogens records, and permit records.

Checking an access request and correcting a record

Identify the record type and the requester's authority before releasing information. Access arrangements for medical records differ from those for ordinary attendance. Refer uncertain disclosure questions to the designated record owner. An instructor should not send a full medical file merely because a reviewer wants confirmation of program readiness.

If a learner reports an incorrect completion entry, compare it with the underlying attendance and assessment evidence. Correct through the approved process and retain appropriate change history. Do not overwrite a failed assessment with a passing status without the required later evidence. A correction of data and a successful reassessment are different events.

Use a small migration or recovery review that includes known exceptions: a learner with incomplete work, an updated course version, a corrected entry and a record with restricted access. These cases test whether the system preserves meaning as well as counts. A spreadsheet containing the right number of names can still lose the distinction between attendance and qualification.

Review retention and recovery when systems, contracts or policies change. Ensure that necessary records remain readable and retrievable for their applicable period, and that disposal is authorized. A tested system supports continuity across personnel changes because the evidence and ownership do not depend on one instructor's memory.

Key takeaways

• Bloodborne-pathogens training records are retained three years; fit-test records until the next fit test.
• Exposure and medical records have distinct general retention rules and exceptions.
• A recoverable record system requires tested restoration, appropriate access and traceability.