293.503—Implementing instructions.
Agencies must issue written internal instructions describing how their EMFS is to be implemented. These instructions must—
(a)
Describe overall operation of the system within the agency including the designation of the agency official who will be responsible for overall system management. When the agency has a medical officer, that individual must be named the system manager. The system manager may then designate others within the agency to handle the day-to-day management of the records, e.g., the custodian of the records at the site where they are maintained;
(b)
Be prepared with joint participation by agency medical, health, and safety, and personnel officers;
(c)
Describe where and under whose custody employee occupational medical records will be physically maintained;
(d)
Designate which agency office(s) will be responsible for deciding when and what occupational medical records are to be disclosed either to other agency officials or outside the agency;
(e)
Ensure proper records retention and security, and preserve confidentiality of doctor/patient relationships;
(f)
Provide that when the agency is requesting an EMF from the National Personnel Records Center (NPRC), the request form will show the name, title, and address of that agency's system manager or designee, who is the only official authorized to receive the EMF;
(g)
Be consistent with Office regulations relating to personnel actions when medical evidence is a factor ( 5 CFR parts 339, 432, 630, 752, and 831 );
(h)
Provide guidance on how an accounting of any record disclosure, as required by the Privacy Act (5 U.S.C. 552a(c) ), will be done in a way that ensures that the accounting will be available for the life of the EMF;
(i)
When long-term occupational medical records exist, provide for the creation of an EMF for an employee transferring to another agency or leaving Government service, and whether an EMF is to be established at the time an employee is being reassigned within the agency;
(j)
Ensure a right of access (consistent with any special Privacy Act handling procedures invoked) to the records, in whatever format they are maintained, by the employee or a designated representative;
(k)
Ensure that a knowledgeable official determines that all appropriate long-term occupational medical records are in an EMF prior to its transfer to another agency, to the NPRC, or to another office within the same employing agency;
(l)
Ensure that all long-term occupational medical records an agency receives in an EMF are maintained, whether in that same EMF or by some other agency procedure, and forwarded to a subsequent employing agency or to NPRC;
(m)
Ensure that, if occupational medical records are to be physically located in the same office as the Official Personnel Folder (OPF), the records are maintained physically apart from each other;
(n)
Sets forth a policy that distinguishes, particularly for purposes of records disclosure, records in the nature of physician treatment records (which are generally not appropriate for disclosure to non-medical officials) from other medical reports properly available to officials making management decisions concerning the employee;
(o)
Provide guidance that distinguishes records properly subject to this part from those (e.g., Postal Service or Foreign Service employee medical records) subject to different rules, particularly in Privacy Act and Freedom of Information Act matters;
(p)
Ensure that guidance regarding the processing of Privacy Act matters is consistent with Office regulations implementing the Privacy Act at 5 CFR parts 293 and 297; and
(q)
Ensure that no security classification is assigned to an EMF by including therein any occupational medical record that has such a classification. In this regard, the agency creating the classified medical record is required to retain it separately from the EMF while placing a notice in the EMF of its existence and describing where requests for this record are to be submitted.