In this case, we attempt to reconcile the privacy interests of employees in their medical records with the significant public interest in research designed to improve occupational safety and health.

The National Institute for Occupational Safety and Health (hereinafter NIOSH) was established by the Occupational Safety and Health Act of 1970, 29 U.S.C. §§ 651 et seq. (1976). NIOSH has the authority to "develop and establish recommended occupational safety and health standards," 29 U.S.C. § 671(c)(1), and to conduct research concerning occupational safety and health, 29 U.S.C. §§ 671(c)(2), 669. In particular, it has the authority to conduct a health hazard evaluation, which entails an investigation to

determine following a written request by any employer or authorized representative of employees, specifying with reasonable particularity the grounds on which the request is made, whether any substance normally found in the place of employment has potentially toxic effects in such concentrations as used or found.

29 U.S.C. § 669(a)(6).

On February 22, 1978, NIOSH received a written request for a health hazard evaluation from an officer of the International Union of Electrical Workers, Local 601, an authorized representative of the employees at Westinghouse Electric Corporation's plant in Trafford, Pennsylvania. The Trafford plant manufactures, inter alia, electric insulators by means of an epoxy mold process. The complaint concerned two areas in the Trafford plant, the "bushings aisle" or TC-72, and the "epoxy aisle" or TC-74, and alleged that workers were suffering allergic reactions as a result of exposure to methyl ethyl ketone. The Director of NIOSH initiated an investigation pursuant to his authority under 29 U.S.C. § 669(a)(6).

On April 21, 1978, an industrial hygienist and two physicians employed by NIOSH performed a walk-through inspection. They determined that the conditions which led to the complaint concerning TC-72 had been remedied and no further evaluation of that area was required. However, although methyl ethyl ketone was found not to be a potential health hazard, hexahydrophthalic anhydride, or HHPA, was used in significant quantities in TC-74, and the physicians suspected that it might be causing allergic reactions in some workers. The physicians therefore recommended that environmental and medical testing be done regarding the presence and effect of HHPA in the TC-74 area.

Dr. Thomas Wilcox, a Medical Project Officer in the Hazard Evaluation and Technical Assistance Branch of NIOSH, and G. Edward Burroughs, an industrial hygienist, visited the site and requested access to the company's medical records of potentially affected employees in the TC-74 area. A Westinghouse official replied that access would be difficult because the records were considered confidential.1

On December 28, Wilcox sent written notice to Westinghouse that the health hazard evaluation would be conducted in January, 1979. He requested a list of present TC-74 employees and of past TC-74 employees working elsewhere in the plant, access to the medical records of these employees and of other employees with intermittent exposure to the TC-74 area who were willing to participate in the evaluation, and an outline of the routine procedures for health monitoring of TC-74 employees. Westinghouse supplied a list of present TC-74 employees, maintained that it could not supply a list of its present employees no longer working on that aisle, denied access to the medical records, and did not inform NIOSH concerning the health monitoring procedures.

Thereafter, the Director of NIOSH issued a subpoena duces tecum to Westinghouse's custodian of records at the Trafford plant, requiring the production of "(m)edical records of all employees presently employed in the TC-74 area and the medical records of all employees who formerly worked in the TC-74 area and who now work elsewhere in the plant." Westinghouse refused to honor the subpoena.

Meanwhile, Wilcox performed blood tests and pulmonary function tests and conducted medical interviews with a majority of the present TC-74 employees. He found detectable levels of HHPA antibodies in 12 out of 28 employees tested. Several of these employees complained of allergic symptoms while in or near the TC-74 area. Some employees' lung capacity was less than that which would be expected for persons of their age, height, sex and race. A summary of Wilcox's preliminary findings was distributed to Westinghouse and to TC-74 employees in March 1979. Each employee participating in the study also received his or her own laboratory results and a personal letter from Wilcox explaining their medical significance.

Wilcox repeated his request for the employees' medical records maintained by Westinghouse. In reply, Westinghouse informed NIOSH that it would supply those records (1) if the employees provided "written informed consent" authorizing Westinghouse to supply the records and (2) if Westinghouse was "provided with written assurance by the United States Government that the contents of these records will not be disclosed to third parties."

NIOSH then filed this action in the district court seeking an order to enforce its subpoena. Following a hearing, the district court granted NIOSH's petition and ordered full enforcement of the subpoena. United States v. Westinghouse Electric Corp., 483 F. Supp. 1265 (W.D.Pa.1980). The court found that the subpoena therefore met all the requirements for enforcement of an administrative subpoena outlined in United States v. Morton Salt Co., 338 U.S. 632, 70 S. Ct. 357, 94 L. Ed. 401 (1950). The court rejected Westinghouse's claim that the information was protected from disclosure, holding that even if Westinghouse had asserted a physician-patient privilege it would have been to no avail because "(n)o physician-patient privilege exists as a matter of federal common law" and Pennsylvania's physician-patient privilege was too narrow to cover this material since it applied only to communications which would blacken the patient's reputation. The court relied instead on Whalen v. Roe, 429 U.S. 589, 97 S. Ct. 869, 51 L. Ed. 2d 64 (1977), and E. I. duPont de Nemours & Co. v. Finklea, 442 F. Supp. 821 (S.D.W.Va.1977), which upheld an agency's authority to view medical records needed in the public interest. The court also found that Westinghouse had not demonstrated that individually identifiable medical records would be improperly disclosed, and that NIOSH's procedures of safekeeping the records and of removing the names and addresses of the individuals in its compilation of published data provided sufficiently adequate assurance of non-disclosure. Westinghouse filed this appeal, and enforcement of the order was stayed pending disposition of the appeal.

Although the government does not challenge Westinghouse's standing to assert its employees' privacy interests before us,2 we raise that issue sua sponte.

The modern law of standing was the subject of a comprehensive review in our recent decision in Americans United for Separation of Church and State, Inc. v. HEW, 619 F.2d 252 (3d Cir. 1980). There, we noted that no more is required "than an allegation that the challenged official action has caused the plaintiff 'injury in fact, economic or otherwise.' " Id. at 256. This requirement is based on the necessity that the plaintiff have such a "personal stake in the outcome" of the controversy to assure " 'that concrete adverseness which sharpens the presentation of issues upon which the court so largely depends for elimination of difficult ... questions.' " Id., quoting Baker v. Carr, 369 U.S. 186, 204, 82 S. Ct. 691, 703, 7 L. Ed. 2d 663 (1962). Without intimating any general rule about an employer's ability to vindicate the rights of its employees in other situations,3 under the circumstances of this case Westinghouse has the necessary concrete adverseness to present the issues. The subpoena at issue is directed to Westinghouse and requires production of documents in its possession. Failure to comply with the subpoena will subject it to the penalty of a contempt sanction. Furthermore, it has an ongoing relationship with its employees and it asserts that an adverse decision on the merits of the constitutional claim regarding employee privacy may adversely affect the flow of medical information which it needs from them.4 As a practical matter, the absence of any notice to the employees of the subpoena means that no person other than Westinghouse would be likely to raise the privacy claim. Indeed, this claim may be effectively lost if we do not hear it now.

We see no basis for concern here that Westinghouse will make anything less than a vigorous defense of the right to privacy with the necessary degree of adverseness to the government's position. See Baker v. Carr, supra. Since the underlying prudential bars to standing are absent, we conclude that Westinghouse has demonstrated sufficient interest in the litigation to have standing to be heard on the merits of its arguments concerning both the validity of the subpoena and whether its employees have any privacy rights in the material sought by NIOSH. Our holding is consistent with the approach to employer standing taken by other courts in analogous situations. See United States v. Allis-Chalmers Corp., 498 F. Supp. 1027, at 1029 No. 79-C-450 (E.D.Wis.1980); General Motors Corp. v. Director of the National Institute of Occupational Safety and Health (NIOSH), 459 F. Supp. 235 (S.D.Ohio 1978); E. I. duPont de Nemours and Co. v. Finklea, 442 F. Supp. 821 (S.D.W.Va.1977).

The requirements for judicial enforcement of an administrative subpoena duces tecum were set forth in United States v. Morton Salt Co., 338 U.S. 632, 652, 70 S. Ct. 357, 368, 94 L. Ed. 401 (1950): (1) the inquiry must be within the authority of the agency, (2) the demand for production must not be too indefinite, and (3) the information sought must be reasonably relevant to the authorized inquiry. The definiteness of the demand for production has not seriously been challenged by Westinghouse since the documents requested have been adequately identified. Instead, Westinghouse disputes both the authority of NIOSH to seek these documents, and the relevance of the documents requested.

The Occupational Safety and Health Act of 1970 authorizes the Secretary of HEW to make inspections and question employers, 29 U.S.C. § 669(b), and to issue subpoenas to obtain the production of evidence, 29 U.S.C. §§ 657(b), 669(b); these powers are extended to NIOSH, 29 U.S.C. § 671(c). Westinghouse does not challenge this statutory authority but instead argues that NIOSH's own regulation restricts the scope of its examination in health hazard evaluations. The relevant regulation provides:

In connection with any (health hazard) investigation, ... NIOSH employees may question privately any employer, owner, operator, agent, or employee and review records required by the Act and regulations, and other related records.

42 C.F.R. 85.5(a) (1979). Westinghouse would have us construe this regulation as a limitation self-imposed by NIOSH that restricts its examinations to only those records which must be retained under specific provision of the statute or regulations. Westinghouse claims that since no provision of the Act or validly promulgated regulation specifically requires it to maintain and retain employees' medical records, NIOSH has no authority to examine these records which it maintains on a voluntary basis.

We are unwilling to take so narrow a view of NIOSH's authority or regulation. Westinghouse's interpretation would read out of the regulation NIOSH's authority to examine "other related records", which NIOSH regards as referring to records related to the purpose of the investigation. The agency's construction of its own regulation is entitled to deference. United States v. Larionoff, 431 U.S. 864, 872-73, 97 S. Ct. 2150, 2155-2156, 53 L. Ed. 2d 48 (1977); Northern Indiana Public Service Co. v. Porter County Chapter of the Izaak Walton League of America, 423 U.S. 12, 15, 96 S. Ct. 172, 173, 46 L. Ed. 2d 156 (1975); Bowles v. Seminole Rock & Sand Co., 325 U.S. 410, 413-14, 65 S. Ct. 1215, 1217, 89 L. Ed. 1700 (1945). We find NIOSH's interpretation to be reasonable, particularly when any other construction would unduly hamper its statutory obligation to conduct statutorily mandated research and investigations.

Westinghouse's challenge to the relevance of the records is directed to the scope of the NIOSH request. In essence, it claims that NIOSH has not met its burden of showing why it is entitled to see the entire medical files identified by employee name and address, and that, at most, NIOSH is entitled to examination of excerpts of those records which contain reports of pulmonary function tests, blood tests and allergic reactions.

NIOSH's burden of showing relevance is met when it demonstrates the documents are reasonably relevant to its authorized inquiry. NIOSH has amply sustained that burden in this case. The potential of HHPA to induce asthmatic conditions through prolonged exposure was unknown prior to this health hazard evaluation. There is evidence that asthmatic conditions resulting from an allergic reaction to chemicals such as HHPA can be serious, and even life-threatening.

NIOSH seeks to discover whether the high levels of antibodies to HHPA found in its own medical examinations of the employees currently working in the TC-74 area existed before the employees began working in that area. It also seeks to compare the results of the pulmonary function tests which it conducted and which showed a lesser than expected lung capacity with the results of comparable tests performed before the employees were exposed to the substances in the TC-74 area. Dr. Wilcox, the NIOSH physician in charge of the medical investigation component of this health hazard evaluation, testified that he suspects that HHPA may induce occupational asthma in workers exposed to it over a period of time. In this connection, he seeks to determine whether the employees' breathing abilities have degenerated over a period of time. He is also investigating the effects on the blood of repeated exposure to HHPA and is trying to ascertain if the antibody to HHPA is frequently elevated in allergic conditions.

In order to conduct this research and investigation, identification of the employees is needed to correlate the data collected by Dr. Wilcox with that contained in the medical records. The records of past as well as present employees exposed to that area are needed to provide as complete a sampling as possible, and to permit observation of the incidence or rate at which employees will develop reactions. The employee's complete medical record needs to be examined to ascertain the frequency of complaints regarding allergies. Thus, evidence which may seem inconsequential in isolation, such as a cough or shortness of breath, may be meaningful if the severity of the symptom increases or if there is a high incidence of its occurrence. It is also relevant to ascertain if allergic or asthmatic symptoms referred to in the files decreased after the employees were no longer exposed to the substances in the TC-74 area.

Westinghouse's proposal that NIOSH be allowed to examine only excerpted data from the medical records would unduly hamper the NIOSH investigation. The entire file must be made available so that a trained and creative professional can consider whether any factor, heretofore unsuspected, may have a relationship to the exposure. Valid medical research and investigation deserves no less, and we therefore sustain the district court's finding that the subpoena satisfies the criteria for judicial enforcement. Accordingly, we turn to Westinghouse's second claim, that the confidentiality of the employees' medical records is protected by their right of privacy.

Proliferation in the collection, recording and dissemination of individualized information has made the public, Congress and the judiciary increasingly alert to the threat such activity can pose to one of the most fundamental and cherished rights of American citizenship, falling within the right characterized by Justice Brandeis as "the right to be let alone." See Olmstead v. United States, 277 U.S. 438, 478, 48 S. Ct. 564, 572, 72 L. Ed. 944 (1928) (dissenting). Much of the concern has been with governmental accumulation of data and the ability of government officials to put information technology to uses detrimental to individual privacy, which have been facilitated by the spread of data banks and by the increasing storage in computers of sensitive information relating to the personal lives and activities of private citizens. The Senate Government Operations Committee included in its Report on the Privacy Act excerpts of the testimony of Professor Arthur Miller where he stated, "The information gathering and surveillance activities of the Federal Government have expanded to such an extent that they are becoming a threat to several of every American's basic rights, the rights of privacy, speech, assembly, association, and petition of Government." The Privacy Act of 1974, S.Rep. No. 1183, 93rd Cong., 2d Sess. 7, reprinted in (1974) U.S.Code Cong. & Admin.News, pp. 6916, 6922.

Congressional reaction to government inroads on citizens' privacy culminated in the passage of the Privacy Act of 1974, 5 U.S.C. §§ 552a(a)-(q) (1976), which requires departments and agencies of the executive branch and their employees to observe certain rules in the computerization, collection, management, use and disclosure of personal information about individuals. Congress has also included in statutes relating to discrete subject areas provisions protecting an individual's privacy in the information collected, and limiting the circumstances under which there can be inspection and disclosure. See, e. g., Internal Revenue Code § 6103 (limiting disclosure of tax returns and tax information) discussed in United States v. Bacheler, 611 F.2d 443, 445-47 (3d Cir. 1979); 2 U.S.C. § 603(c)(2)(C) (1976) (protecting personal material in Congressional budget data); 20 U.S.C. § 1417(c) (1976) (requiring protection of personal information about handicapped students). Similarly, agencies which collect and maintain individualized data have issued regulations governing access to such data in an effort to minimize intrusion by others into the private affairs of the individuals involved. See, e. g., 17 C.F.R. §§ 200.301-200.312 (1980) (personal information in S.E.C. records); 38 C.F.R. §§ 1.500-1.584 (1979) (veterans administration records); 45 C.F.R. §§ 5b.1-5b.12, 99.1-99.67 (1979), (educational, medical and other records under control of H.E.W.).

Although the full measure of the constitutional protection of the right to privacy has not yet been delineated, we know that it extends to two types of privacy interests: "One is the individual interest in avoiding disclosure of personal matters, and another is the interest in independence in making certain kinds of important decisions." Whalen v. Roe, 429 U.S. 589, 599-600, 97 S. Ct. 869, 876, 51 L. Ed. 2d 64 (1977) (footnotes omitted). The latter decisions have encompassed "matters relating to marriage, procreation, contraception, family relationships, and child rearing and education." Paul v. Davis, 424 U.S. 693, 713, 96 S. Ct. 1155, 1166, 47 L. Ed. 2d 405 (1976). The privacy interest asserted in this case falls within the first category referred to in Whalen v. Roe, the right not to have an individual's private affairs made public by the government.

There can be no question that an employee's medical records, which may contain intimate facts of a personal nature, are well within the ambit of materials entitled to privacy protection.5 Information about one's body and state of health is matter which the individual is ordinarily entitled to retain within the "private enclave where he may lead a private life."6 It has been recognized in various contexts that medical records and information stand on a different plane than other relevant material. For example, the Federal Rules of Civil Procedure impose a higher burden for discovery of reports of the physical and mental condition of a party or other person than for discovery generally. Compare Fed.R.Civ.P. 35 with Fed.R.Civ.P. 26(b). See also 8 Wright and Miller, Federal Practice and Procedure: Civil, §§ 2237, 2238 (1970). Medical files are the subject of a specific exemption under the Freedom of Information Act. 5 U.S.C. § 552(b)(6) (1976). This difference in treatment reflects a recognition that information concerning one's body has a special character. The medical information requested in this case is more extensive than the mere fact of prescription drug usage by identified patients considered in Whalen v. Roe and may be more revealing of intimate details. Therefore, we hold that it falls within one of the zones of privacy entitled to protection.

Westinghouse concedes that even material which is subject to protection must be produced or disclosed upon a showing of proper governmental interest. As the Court has stated:

(D)isclosures of private medical information to doctors, to hospital personnel, to insurance companies, and to public health agencies are often an essential part of modern medical practice even when the disclosure may reflect unfavorably on the character of the patient. Requiring such disclosures to representatives of the State having responsibility for the health of the community, does not automatically amount to an impermissible invasion of privacy.

Whalen v. Roe, 429 U.S. at 602, 97 S.Ct. at 877 (footnote omitted). In recognition that the right of an individual to control access to her or his medical history is not absolute, courts and legislatures have determined that public health or other public concerns may support access to facts an individual might otherwise choose to withhold. On this basis, disclosures regarding past medical history, present illness, or the fact of treatment have been required. The Court in Whalen v. Roe gave as illustrations the statutory reporting requirements relating to venereal disease, child abuse, injuries caused by deadly weapons and certification of fetal death. 429 U.S. at 602 n.29, 97 S. Ct. at 878. Generally, the reporting requirements which have been upheld have been those in which the government has advanced a need to acquire the information to develop treatment programs or control threats to public health.

A statutory requirement that medical facilities and physicians performing abortions must maintain records of relevant maternal health and life data which was subject to inspection by local, state or national public health officers was sustained in Planned Parenthood of Missouri v. Danforth, 428 U.S. 52, 79-81, 96 S. Ct. 2831, 2845-2846, 49 L. Ed. 2d 788 (1976). The Court invalidated various parts of Missouri's abortion legislation but accepted the state's rationale that the record keeping and reporting requirements were reasonably directed to the preservation of maternal health, commenting that these provisions, "while perhaps approaching impermissible limits, are not constitutionally offensive in themselves." Id. at 81, 96 S.Ct. at 2846. In Whalen v. Roe, 429 U.S. 589, 97 S. Ct. 869, 51 L. Ed. 2d 64 (1977), the Court upheld the state requirement that physicians record on official forms information concerning prescriptions for certain potentially harmful drugs, including identification of the physician, pharmacy, drug, dosage, and patient's name, address and age. The Court of Appeals for the Second Circuit, relying on Whalen v. Roe, upheld the validity of a subpoena for all medical records of patients treated by a physician with Laetrile or a similar drug. Schachter v. Whalen, 581 F.2d 35 (2d Cir. 1978), aff'g. 445 F. Supp. 1376 (S.D.N.Y.1978) (subpoena issued in course of inquiry into professional misconduct).

In the cases in which a court has allowed some intrusion into the zone of privacy surrounding medical records, it has usually done so only after finding that the societal interest in disclosure outweighs the privacy interest on the specific facts of the case. In Detroit Edison Co. v. NLRB, 440 U.S. 301, 313-17, 99 S. Ct. 1123, 1130-1132, 59 L. Ed. 2d 333 (1979), the interests of the NLRB and the labor union in giving the union access to employees' scores in psychological aptitude tests to assist the union in processing a grievance were weighed against the strong interest of the Company and its employees in maintaining confidentiality. The Court held the NLRB had improperly compelled disclosure because "(t)he Board has cited no principle of national labor policy to warrant a remedy that would unnecessarily disserve (the Company's interest in test secrecy) and we are unable to identify one." Id. at 315, 99 S.Ct. at 1131.

Thus, as in most other areas of the law, we must engage in the delicate task of weighing competing interests. The factors which should be considered in deciding whether an intrusion into an individual's privacy is justified are the type of record requested, the information it does or might contain, the potential for harm in any subsequent nonconsensual disclosure, the injury from disclosure to the relationship in which the record was generated, the adequacy of safeguards to prevent unauthorized disclosure, the degree of need for access, and whether there is an express statutory mandate, articulated public policy, or other recognizable public interest militating toward access.

Applying those factors in this case, we consider first that NIOSH was established as part of the comprehensive statutory scheme dealing with occupational health and safety embodied in the Occupational Safety and Health Act of 1970, 29 U.S.C. §§ 651 et seq. (1976). In enacting that statute, Congress noted the " 'grim current scene' .... (i)n the field of occupational health," and sought, by passage of the statute, "to reduce the number and severity of work-related injuries and illnesses which, despite current efforts of employers and government, are resulting in ever-increasing human misery and economic loss." Occupational Safety and Health Act of 1970, S.Rep. No. 1282, 91st Cong., 2d Sess. (1970), reprinted in (1970) U.S.Code Cong. & Admin.News, pp. 5177, 5178, 5177. It was hoped and expected that NIOSH would "provide occupational health and safety research with the visibility and status it merits...." Id. at 5197. Among the special "research, experiments, and demonstrations" which it is statutorily mandated to conduct are those "necessary to produce criteria ... identifying toxic substances," 29 U.S.C. § 669(a)(2); those necessary to development of criteria "which will describe exposure levels that are safe for various periods of employment;" 29 U.S.C. § 669(a)(3); and those necessary "to explore new problems, including those created by new technology in occupational safety and health, which may require ameliorative action" beyond that provided for in the Act; 29 U.S.C. § 669(a) (4). The research activity in this case, a health hazard evaluation, requires that the Secretary determine "whether any substance normally found in the place of employment has potentially toxic effects in such concentrations as used or found...." 29 U.S.C. § 669(a)(6).

Thus, the interest in occupational safety and health to the employees in the particular plant, employees in other plants, future employees and the public at large is substantial. It ranks with the other public interests which have been found to justify intrusion into records and information normally considered private.

Turning next to the degree of need for access, we have found in section III that NIOSH has shown a reasonable need for the entire medical file of the employees as requested. It seeks those records in order to be able to compare its findings of high levels of antibodies to HHPA and reduced pulmonary function with the comparable findings in the employees before they were exposed to the substances in the TC-74 area, and during the course of such exposure. Its need for all of the medical files requested in their complete form has also been satisfactorily demonstrated.

Westinghouse has not produced any evidence to show that the information which the medical records contain is of such a high degree of sensitivity that the intrusion could be considered severe or that the employees are likely to suffer any adverse effects from disclosure to NIOSH personnel. Most, if not all, of the information in the files will be results of routine testing, such as X-rays, blood tests, pulmonary function tests, hearing and visual tests. This material, although private, is not generally regarded as sensitive. Furthermore, since Westinghouse's testing and NIOSH's examination of the records are both conducted for the purpose of protecting the individual employee from potential hazards, it is not likely that the disclosures are likely to inhibit the employee from undergoing subsequent periodic examinations required of Westinghouse employees.

Finally, we must consider whether there are effective provisions for security of the information against subsequent unauthorized disclosure. This is a factor referred to in both Whalen v. Roe, supra, and Detroit Edison Co. v. NLRB, supra. In Whalen v. Roe, the Court described the extensive security procedures required by statute and regulation, including storage of the information in vaults and locked cabinets in secure areas surrounded by alarm fences, limited retention of five years, and special computer operating procedures. Only a defined and relatively small group of investigators and staff had access, and were subject to statutory sanctions for improper disclosure. In Detroit Edison, where access to the test results was denied, the Court referred to the absence of efficacious guarantees against disclosure. Further, there were no express provisions for the physical security of the information. In Schachter v. Whalen, supra, the Court of Appeals for the Second Circuit held that security precautions that were substantial but "not foolproof" were adequate, and approved a coding system used to disguise the identities of the patients in any subsequent use of the data.

Westinghouse argues that the security of the information in this case is inadequate. It stresses that the statute authorizes use of outside contractors for data processing and analysis, and contains neither means to police compliance with nondisclosure nor adequate sanctions for unwarranted disclosure. It also argues that removal by NIOSH of individual identifiers before disclosure to those parties is made will be inadequate, since only obvious identifiers, such as names and addresses, are deleted, but that identification may still be possible because more idiosyncratic identifiers will be included in the disclosed materials. For these reasons, Westinghouse conditioned its compliance with NIOSH's request for the records in issue on the provision by the government of written assurance that the contents of the employees' medical records will not be disclosed to third parties, a condition the government has refused to accept.

The district court considered Westinghouse's contention at the hearing conducted on the motion to compel compliance by Westinghouse with the subpoena duces tecum issued by the Director of NIOSH. The court concluded that the "evidence indicates that NIOSH's procedures of safekeeping the records and of removing the names and addresses of the individuals in its compilation of published data represents sufficiently adequate assurance of non-disclosure by the petitioner (NIOSH)." 483 F. Supp. at 1269. We see no reason to disturb this conclusion.

The applicable regulation expressly provides that unless otherwise specifically provided, "no disclosure will be made of information of a personal and private nature, such as information in personnel and medical files, ... and any other information of a private and personal nature." 45 C.F.R. § 5.71(a) (1979). Only aggregate data is included in the forms of the study distributed to employees and others. The excerpted data which is retained by NIOSH is maintained in locked cabinets, inside the Medical Section of the agency, in rooms locked during non-office hours. Material from small studies is not placed on computers; data from large studies is removed from the computer after six months. NIOSH has represented that no outside contractors are used for small studies, such as the one in issue here, and that when such contractors are used, they are bound to nondisclosure by their contract with NIOSH, as required by 5 U.S.C. § 552a(m). In the absence of any contrary evidence produced by Westinghouse, we cannot conclude that there are inadequate safeguards against disclosure. See also E. I. duPont de Nemours & Co. v. Finklea, 442 F. Supp. at 825.

Accordingly, we believe that the strong public interest in facilitating the research and investigations of NIOSH justify this minimal intrusion into the privacy which surrounds the employees' medical records, and that Westinghouse is not justified in its blanket refusal to give NIOSH access to them or to condition their disclosure on compliance with its unilaterally imposed terms.

The balancing of competing interests which we undertook in Part IV necessarily weighed the general privacy interests of the Westinghouse employees in their medical records against the need for research relating to occupational health and safety. When weighing these interests, the public need prevailed over the claim that medical records in general were protected from discovery. We recognize, however, that there may be information in a particular file which an employee may consider highly sensitive. Westinghouse has represented that the files are not limited to employment-related concerns but include records of the employees' personal consultations with the company physician and the physician's ministrations on a broad spectrum of health matters. Employees absent from work for medical reasons must clear through the medical department on their return. The medical records also contain reference to payments made under Westinghouse's comprehensive medical insurance program. Since the employees had no prior notice that their medical records might be subject to subsequent examination, they may have raised with the company physician medical matters unrelated to their employment which they consider highly confidential. We cannot assume that an employee's claim of privacy as to particular sensitive data in that employee's file will always be outweighed by NIOSH's need for such material.

Although Westinghouse has been permitted to assert the general claim of privacy on behalf of all of the employees, and has done so vigorously on the employees' behalf, each employee is entitled to make an individual judgment as to whether s/he regards the information so sensitive that it outweighs that employee's interest in assisting NIOSH in a health hazard investigation that may benefit the employee. We do not think it appropriate to permit Westinghouse to assert the claims of individual employees to privacy in particular documents. Each employee is uniquely capable of evaluating the degree of confidentiality which s/he attaches to discrete items of information in his or her file.

Westinghouse has suggested that the employees' privacy rights will not be adequately preserved unless their written consents are obtained. One district court has already conditioned the disclosure of personal identifiers on conducting a due process hearing. General Motors Corp. v. Director of NIOSH, 459 F. Supp. 235, 240 (S.D.Ohio 1978). We believe that the requirement of securing written consent may impose too great an impediment to NIOSH's ability to carry out its statutory mandate. Although the number of employees involved in this particular investigation is not unwieldy, totalling no more than 100 employees, there may be other instances where the number of employees involved makes securing written consent difficult. Furthermore, there is the possibility that some employees will withhold consent either arbitrarily or because they do not understand the full nature of the investigation. Finally, some employees may withhold consent because they believe that is the course desired by their employer.

Under the circumstances, we believe the most appropriate procedure is to require NIOSH to give prior notice to the employees whose medical records it seeks to examine and to permit the employees to raise a personal claim of privacy, if they desire. The form of notice may vary in each case but it should contain information as to the fact and purpose of the investigation and the documents NIOSH seeks to examine, and should advise the employees that if they do not object in writing by a date certain, specifying the type of material they seek to protect, their consent to disclosure will be assumed.7 The mechanics of the required notice can be arranged by the district court in accordance with the circumstances of the particular case. NIOSH's request to see 5,000 x-rays of steel workers can be handled differently than its request for information of a more personal nature. In the former case, there may be no problem if objections are sent directly to NIOSH. That course may not be appropriate where more intimate data is involved. The touchstone should be provision for reasonable notice to as many affected individuals as can reasonably be reached; an opportunity for them to raise their objections, if any, expeditiously and inexpensively; preservation of confidentiality as to the objections and the material itself from unwarranted disclosure; and prompt disposition so that NIOSH's evaluation is not hampered. We are confident that the district court will be able to oversee this procedure which should, in the main, be self-executing by the parties.

The procedure we have outlined attempts to accommodate the legitimate interests of all those concerned. It should not unduly delay NIOSH's investigation, since NIOSH may proceed to examine the files to which no objection has been made as soon as the date for filing objections has passed. The short delay until notice is given should not significantly affect its investigation, and problems of emergencies can be handled on an ad hoc basis. For their part, the employees will have been given notice, to the extent reasonably possible, thereby protecting their individual rights of privacy. It may be that employee objections will be so infrequent and the material claimed to be protected so tangential to its investigation, that NIOSH will not press its request for disclosure. If it does, then the district court can balance the competing interests before ordering disclosure of the material, taking due care at all times to preserve the confidentiality of the medical records from disclosure to any third party both while the claim is being considered and after it has been decided.

Accordingly, we will remand this case to the district court for further proceedings in accordance with this opinion.