If you run an electronics recycling operation and you haven't built a formal medical surveillance program, you're carrying more audit risk than you probably realize. This is one of the areas where R2v3 raised the bar significantly over R2v2 — and it's one of the areas where I see facilities show up to their certification audit underprepared.
The good news is that the requirements are logical and buildable. The hard part is that they touch HR, EHS, operations, and your occupational health provider all at once — and if those groups aren't coordinating, programs develop gaps. This article walks through what R2v3 actually requires, where facilities tend to fall short, and how to build something that holds up under scrutiny.
What R2v3 Actually Requires on Worker Health
The core obligation lives in R2v3 Core Requirement 2 (CR2): Worker Health and Safety, specifically the provisions on medical surveillance and biological monitoring. But CR2 doesn't operate in isolation — it cross-references the EHS Legal Register requirement and pushes facilities toward compliance with applicable OSHA standards and, where relevant, international equivalents.
The standard requires that facilities:
- Identify workers with occupational exposure to focus materials (more on that term in a moment)
- Provide medical surveillance appropriate to the exposure profile
- Maintain records of surveillance in a way that protects employee privacy
- Ensure that surveillance findings can inform corrective actions in the EHS program
That last point matters more than most facilities appreciate. Surveillance that feeds into a binder and never connects back to your hazard controls is surveillance in name only. R2v3 wants to see a loop — exposure → monitoring → findings → program adjustment.
What "Focus Materials" Have to Do With Medical Surveillance
R2v3 is built around the concept of focus materials — the specific substances in e-scrap that pose the greatest risk to workers and the environment. The current list includes lead, mercury, cadmium, hexavalent chromium, beryllium, and several others.
Your medical surveillance obligations run directly through this list. If workers are routinely handling, shredding, disassembling, or otherwise disturbing materials that contain focus materials — and that's most electronics recycling work — then you need to be asking whether OSHA's substance-specific standards apply. Several of them do, and they carry their own medical surveillance requirements:
- 29 CFR 1910.1025 (Lead): requires biological monitoring (blood lead levels) when worker air exposure exceeds the action level of 30 µg/m³ (8-hour TWA), with medical removal protection provisions
- 29 CFR 1910.1027 (Cadmium): requires initial and periodic medical exams including biological monitoring for cadmium in blood and urine
- 29 CFR 1910.1028 (Benzene): relevant for facilities with certain solvent cleaning operations
- 29 CFR 1910.1026 (Hexavalent Chromium): requires medical surveillance for workers exposed at or above the action level of 2.5 µg/m³
The R2v3 auditor is going to want to see that you've matched your focus material inventory to the applicable OSHA standards and built your medical surveillance program around what those standards actually require. "We do annual physicals" is not a sufficient answer.
The Exposure Determination Step Most Facilities Skip
Before any surveillance can be meaningful, you need a defensible exposure determination. This means air monitoring data — not assumptions. OSHA's substance-specific standards define how exposure determination is done, and R2v3 auditors have become increasingly sophisticated about asking for it.
In my experience working with 200+ electronics recyclers, the exposure determination step is the single most common gap I find during pre-audit assessments. Facilities often assume that because their process looks similar to a neighboring facility's, the exposure profile must be similar too. That assumption doesn't hold up. Shredder configurations, throughput volumes, ventilation design, and the specific equipment streams being processed all affect airborne concentrations in ways that aren't predictable without measurement.
A complete exposure determination for a typical e-scrap facility should include:
- Initial air monitoring for focus material analytes during representative operations
- Employee exposure groupings (similar exposure groups, or SEGs) that cluster workers by task and exposure potential
- Periodic re-monitoring after process changes, new equipment streams, or facility modifications
- Documentation that connects monitoring results to specific job classifications
Once you have this, the medical surveillance requirements follow logically from the data.
What a Compliant Medical Surveillance Program Looks Like
A compliant program under R2v3 isn't just a set of exams — it's a managed system. Here's how the core components fit together:
| Program Component | What R2v3/OSHA Requires | Common Gap |
|---|---|---|
| Baseline medical exam | Before initial assignment to exposed tasks | Skipped for existing employees at program launch |
| Periodic exams | Frequency varies by substance (annual for lead, cadmium) | Intervals allowed to drift |
| Biological monitoring | Blood lead, urine cadmium, etc. per applicable standard | Ordered through wrong lab panel; wrong analytes |
| Medical removal protection | Required under lead standard when BLL ≥ 50 µg/dL | Employers unaware of the return-to-work provisions |
| Physician written opinion | PLHCP must provide findings to employer and employee | Opinion documents stored but never reviewed |
| Record retention | 30 years for most substance-specific medical records | Records not retained beyond employment period |
| Employee access | Workers have right to access their own records | Access request procedures not documented |
The record retention requirement tends to catch people off guard. Under OSHA's Access to Employee Exposure and Medical Records standard (29 CFR 1910.1020), medical records must be retained for the duration of employment plus 30 years. That's a long time, and it means you need a records management infrastructure — not just a filing cabinet.
Biological Monitoring vs. Medical Surveillance: The Distinction Matters
These terms get used interchangeably in conversation, but they're different things and the distinction matters when you're building a program.
Biological monitoring measures what's actually in the worker's body — blood lead levels (BLLs), urinary cadmium, exhaled nitric oxide. It's a direct measure of internal dose, and it's what OSHA's substance-specific standards key many of their action triggers to.
Medical surveillance is the broader category — it includes biological monitoring but also medical history, physical examinations, symptom questionnaires, pulmonary function testing, and physician review. The full surveillance program is designed to detect early signs of occupational disease before the worker has been harmed in any lasting way.
In R2v3 terms, you need both. Biological monitoring tells you whether your engineering controls are keeping exposures at safe levels; the broader medical surveillance catches anything the monitoring might miss and creates a documented baseline for each worker.
The Role of the PLHCP (and Why "Just Using a Clinic" Isn't Enough)
Your Professional Licensed Health Care Professional is a critical part of your program, not a commodity vendor. Under the OSHA lead standard, the PLHCP must be familiar with the standard's requirements and must provide written opinions that address whether the employee has any detected medical conditions that would increase risk from exposure and whether there are any recommended limitations on exposure.
What I see a lot of facilities do is send workers to a local occupational health clinic and order a "occupational health panel." That's a starting point, but if the clinic doesn't know you're doing lead-heavy operations, they may not order blood lead levels. If they don't understand the R2v3/OSHA context, the written opinion they provide may not address the right questions. The physician written opinion has to specifically state whether the employee has any findings that would place them at increased risk — general physical findings don't satisfy the standard.
It's worth spending the time to brief your occupational health provider on your exposure profile, your focus materials list, and what the applicable OSHA standards require. That conversation makes the difference between surveillance that's compliant and surveillance that creates a false sense of security.
How R2v3 Auditors Evaluate Your Medical Surveillance Program
R2v3 auditors approach medical surveillance with a document-and-interview methodology. They're going to ask for:
- Your written EHS program or medical surveillance plan
- Evidence that the program covers all applicable focus materials
- Air monitoring data (the exposure determination)
- Records of baseline and periodic exams (de-identified or redacted where required)
- Physician written opinions
- Evidence that findings have been reviewed and that any required medical removal actions have been taken
- Employee training records showing workers understand the program and their rights
They'll also interview workers. A common audit finding is a discrepancy between what the written program says and what workers actually know — workers who don't know they have a right to access their medical records, or who don't know what substances they're potentially exposed to. That discrepancy is an audit finding even if all the paperwork is technically in order.
R2v3's first-time audit pass rate at certified facilities working with a qualified consultant is significantly higher than the industry average — in my practice, 100% of clients pass their initial audit on the first attempt — but medical surveillance gaps are among the top reasons other facilities don't achieve that.
Building the Program: A Practical Starting Point
If you're starting from scratch or trying to close gaps in an existing program, here's the sequence I recommend:
Step 1 — Map your focus materials to job tasks. For each job classification, document which focus materials they may encounter and in what form (intact assemblies, shredded material, solder fume, etc.).
Step 2 — Conduct or retrieve air monitoring data. If you don't have recent industrial hygiene data, get it. This is the foundation everything else rests on.
Step 3 — Identify applicable OSHA standards. Match your exposure profile to the substance-specific standards. Note the action levels, PELs, and medical surveillance triggers.
Step 4 — Retain and brief a PLHCP. Choose an occupational medicine provider who understands your industry. Brief them on your focus materials, your monitoring data, and what the standards require.
Step 5 — Enroll workers in baseline surveillance. Start with workers who have the highest exposure potential. Document the enrollment, the exam dates, and the biological monitoring results.
Step 6 — Build your records infrastructure. Set up a records system that can hold documents for the duration of employment plus 30 years. Many facilities use a combination of their HR system and secure third-party document storage.
Step 7 — Connect the program to your corrective action process. When biological monitoring results trend upward or a physician finds something concerning, that finding should trigger a documented review of engineering controls and work practices — not just a note in the file.
Step 8 — Train workers. Workers need to understand what substances they're exposed to, what the monitoring is for, what their rights are, and who to contact if they have health concerns. This training should be documented.
A Few Things That Tend to Surprise People
The lead standard's medical removal protection provisions are real and have real costs. If a worker's blood lead level reaches 50 µg/dL, OSHA's lead standard requires you to remove that worker from lead-exposed work and maintain their wages, seniority, and other employment rights for up to 18 months. Facilities that haven't read 29 CFR 1910.1025(k) are sometimes genuinely surprised to learn this.
State plan states may have stricter requirements. California, Michigan, Washington, and other state plan states can have medical surveillance requirements that exceed federal OSHA. If you operate in those states, your legal register needs to reflect the state standard, and your program needs to meet the higher bar.
OSHA's recordkeeping standard (29 CFR 1910.1020) applies regardless of whether you ever had a positive finding. The 30-year retention obligation runs from the date of the last employment, not from the date of any adverse finding. Negative records still need to be retained.
R2v3 expects continuous improvement. A medical surveillance program that was adequate when you got certified needs to be re-evaluated periodically — when your process changes, when you add a new material stream, when monitoring results suggest exposure levels have shifted. Static programs drift out of compliance faster than most facilities expect.
The Bottom Line
Medical surveillance under R2v3 is one of those areas where the standard is asking you to do something genuinely important — protect the people doing hazardous work — and building the program well serves both your workers and your audit outcomes. The two things don't have to be in tension.
What I've found in practice is that facilities that approach this as a worker protection program first and a compliance exercise second build better programs. They ask better questions of their PLHCP, they take monitoring results more seriously, and they connect the program back to their engineering controls the way the standard intends.
If you're heading toward an R2v3 audit and you're not confident in your medical surveillance program, that's a gap worth closing before the auditor arrives. Reach out to Certify Consulting to talk through where your program stands and what it would take to get it audit-ready.
You can also explore our broader guidance on R2v3 EHS requirements and focus material management on theR2consultant.com — we've built out resources specifically for facilities working through the operational demands of the standard.
Last updated: 2026-04-28
Jared Clark
Principal Consultant, Certify Consulting
Jared Clark is the founder of Certify Consulting, helping organizations achieve and maintain compliance with international standards and regulatory requirements.