The short version
- 46 CFR 140.505(a) requires towing vessel operators to keep health and safety incident records including any associated medical records.
- The same paragraph gives the crewmember an affirmative right to their own records on request. It is a federal access right with no stated procedure.
- HHS states the HIPAA Privacy Rule does not protect employment records and in most cases does not apply to the actions of an employer.
- 46 CFR 140.915 lists ten categories for the towing vessel record and not one is medical. Medical records sit deliberately outside it.
- Three parties can demand medical information on three unrelated bases, and each expects a different file.
The answer you will find was written for somebody else’s flag
Search this question and the results are consistent and confident. They are also, for an American operator, about the wrong country.
A live capture of the first page in August 2026 returned a yacht crew training site, a Bahamas Maritime Authority summary, the China Classification Society, a cruising blog, the Estonian State Gazette, an IMO rules aggregator, a Facebook post, a documents checklist and a Dutch regulation viewer. Not one United States source. Programmatic checks on the generated summary returned false for “46 CFR”, false for “46 USC”, false for “Coast Guard” and false for “HIPAA”. The only regime it named was the Maritime Labour Convention, which the United States has never ratified, and whose 2024 amendment set is covered in what changed for medical care.
It then offered retention periods of “2 to 5 years depending on flag state rules” and closed by asking what the vessel’s flag state is. For an American operator the flag state is the United States, and the answer contained nothing about United States law at all.
| Question | What the ranking answers say | What United States law says |
|---|---|---|
| Governing regime | MLC 2006, Regulation 4.1, flag state rules | 46 CFR and 46 USC. The United States has not ratified the MLC |
| Confidentiality | Files must stay private, shared only with treating staff or maritime authorities | A crewmember has an affirmative right to their own records on request[1], and HIPAA generally does not reach employment records at all[7] |
| Retention | Two to five years, by flag state | No single federal period for crew medical records. Retention is driven by the longest applicable clock |
What United States law actually requires you to keep
Three separate instruments create medical record duties, and they attach to different vessels by different routes. None of them is a general “medical logbook” rule of the kind the international guidance describes.
| Duty | Authority | Reaches |
|---|---|---|
| Health and safety incident records, including any associated medical records | 46 CFR 140.505(a)[1] | Towing vessels under Subchapter M. It also creates the access right below |
| Each illness or injury, its nature, and the medical treatment given | 46 USC 11301(b)[2], restated for small passenger vessels on foreign voyages at 185.280[4], covered in the Subchapter T article | Vessels required to keep an official logbook. Missing entries carry a civil penalty[3] |
| Casualty file, where the injury clears the federal threshold | 46 CFR 4.05-10, Form CG-2692[6], plus 28.90 for fishing vessels[5] | Every commercial vessel, by one route or another. The fishing picture is in the six federal obligations |
One negative is as useful as the three positives. 46 CFR 140.915 lists ten categories of item to be recorded on a towing vessel, covering personnel records, safety orientation, drills, examinations, navigation equipment, assessments, training, oil discharges, towing gear and fire equipment. None of them is medical[9]. Medical records are deliberately outside the towing vessel record, which means filing them inside it puts a private file into a document produced on demand.
The access right nobody has read
140.505(a) is quoted often for its first sentence and almost never for its third. The section requires the owner or managing operator to implement procedures for reporting unsafe conditions and to keep records of health and safety incidents on board including any associated medical records. Then it says this:
46 CFR 140.505(a), final sentence
“Upon request, the owner or managing operator must provide crewmembers with incident reports and the crewmember’s own associated medical records.”[1]
That is a federal access right, held by the crewmember, exercisable on request, with no stated procedure and no stated timescale. It exists whether or not the company has a policy, and a company that keeps incident paperwork in a shared operations folder cannot satisfy it cleanly, because producing one crewmember’s records means separating them from everybody else’s first. How that responsibility is assigned ashore is the subject of owner or designated person, and how a voyage plan changes what gets recorded is in planning by voyage length.
It is also, quietly, the opposite of the advice the ranking pages give. The generated summary says medical files should be shared “only with treating medical staff or official maritime authorities”. Under 140.505(a) the person the file is about is entitled to it, and they are not on that list.
HIPAA does not do what most operators think
The reflex assumption is that crew medical records are HIPAA protected, so the company is both obliged to withhold them and covered if it does. Neither half survives contact with the source.
The Department of Health and Human Services is explicit. The Privacy Rule protects health information held by covered entities, and a covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with covered transactions[8]. An employer is none of those in its capacity as an employer. HHS states plainly that the Privacy Rule “does not protect your employment records, even if the information in those records is health-related”, and that “in most cases, the Privacy Rule does not apply to the actions of an employer”[7].
What follows from that, and what does not
It does not follow that crew medical information can be handled carelessly. Other law, contract terms and plain professional duty still apply, and a physician or clinic treating the crewmember is very likely a covered entity even where the operator is not. What follows is narrower and more useful: HIPAA is not the rule you are complying with, so it cannot be the reason you refuse a crewmember their own file. The rule you are complying with is 140.505(a), and it points the other way.
Who can demand what
Three parties ask for medical information from a vessel operator, on three unrelated bases, and each expects a different object. Confusing them is what turns a records request into an incident.
- The crewmember asks under 140.505(a) and is entitled to the incident report and their own associated medical records[1]. What they get is a personal file, and it has to be separable from everyone else’s.
- The Coast Guard asks through the casualty regime. The written report on Form CG-2692 is due within five days[6], and where the event also meets the serious marine incident definition[11] the file grows to include the testing record. That sequence is set out in the death on board procedure.
- The DEA asks about anything scheduled, under its own record regime in 21 CFR part 1304[10]. It is not interested in the clinical picture at all, only in the drug accounting, which is why those records belong in a separate file. The full set is in recordkeeping aboard a vessel and the DEA document checklist.
Three demands, three files. A single folder called “medical” satisfies none of them well and exposes the vessel on all three.
Build the file so it survives all three
- Separate at the point of creation, not at the point of request. One file per person for clinical content, one casualty file per event, one controlled substances file for the vessel. Merging is easy afterwards. Unpicking is not.
- Record treatment at item level. What was given, by name and strength, because that record is the evidence for the federal reporting threshold explained in the beyond first aid article, and “treated the wound” evidences nothing.
- Write the logbook entry as a logbook entry. 46 USC 11301(b) puts illness, injury and treatment in the official logbook, not in a clinical note, and 11303 attaches a penalty to a missing entry[2][3].
- Set one retention policy against the longest clock you can identify, and write down which clock it was. There is no single federal period, so a documented reason beats a number with no origin.
- Name who answers a 140.505(a) request, and give them a route. The right has no stated timescale, which is not a reason to be slow. Ownership is the subject of owner or designated person.
Step one is the whole exercise. Everything else follows from having separated the files on the day rather than under pressure. Where this sits in a wider programme is the six decisions, what an inspection of it looks like is a compliance audit, and which equipment rule your class falls under is the vessel class comparison. If you want the structure built and reviewed by a board certified emergency physician, that is maritime medical consulting. The index is in the guidance library and the reviewer on the about page.
Common questions
Does HIPAA protect crew medical records held by a vessel operator?
Generally no. The Department of Health and Human Services states that the Privacy Rule “does not protect your employment records, even if the information in those records is health-related”, and that “in most cases, the Privacy Rule does not apply to the actions of an employer”. A vessel operator holding crew health information is acting as an employer, not as a covered entity. Treating HIPAA as the governing rule is the most common mistake on this subject.
What medical records does United States law actually require a vessel to keep?
It depends on the class. Towing vessels must keep records of health and safety incidents including any associated medical records under 46 CFR 140.505(a). Vessels keeping an official logbook must record each illness or injury and the medical treatment given under 46 USC 11301(b). Small passenger vessels on foreign voyages restate that at 185.280.
Can a crewmember demand a copy of their own medical records?
On a towing vessel, yes, and this is the sentence almost nobody has read. 46 CFR 140.505(a) states that on request the owner or managing operator must provide crewmembers with incident reports and the crewmember’s own associated medical records. It is a federal access right that exists whether or not the company has a policy for it. Where that duty sits in a shore organisation is covered in owner or designated person.
How long do we have to keep them?
United States vessel regulations do not set a single retention period for crew medical records, which is why the answers online quote flag state figures instead. Retention in practice is driven by the longest applicable clock: casualty files, controlled substance records under 21 CFR part 1304, and the limitation periods that apply to injury claims. Set one policy against the longest of those, and record why. See recordkeeping aboard a vessel.
Are medical records part of the towing vessel record?
No, and the distinction matters. 46 CFR 140.915 lists ten categories of item to be recorded and not one of them is medical. The medical duty sits in 140.505(a) instead. Filing medical records inside the towing vessel record mixes a private file into a document that is routinely produced on demand.
Who else can ask for these records?
Three parties, on three different bases. The crewmember, under the 140.505(a) access right. The Coast Guard, through the casualty regime, including the written report on Form CG-2692 under 4.05-10. And the DEA, for anything scheduled, under its own record rules. Each expects a different thing, which is the subject of the DEA document checklist.
Does the treatment record affect whether we have to report an injury?
Directly. The federal reporting threshold turns on whether treatment went beyond first aid and whether the person was rendered unfit for routine duties, so the record of what was administered is the evidence for both limbs. A record saying “treated the wound” answers neither. The threshold is explained in the beyond first aid article.
