OSHA injury recordkeeping forms

Yes — you must use OSHA Forms 300, 300-A, and 301 or equivalent forms that contain the same information and are completed using the same instructions. See 1904.29(a) for the basic requirement and the OSHA interpretation at https://www.osha.gov/laws-regs/standardinterpretations/2025-04-29 which explains that software-generated documents can qualify as "equivalent forms" if they meet the equivalence criteria in 1904.29(b)(4).

• An "equivalent form" must have the same information, be as readable and understandable, and be completed using the same instructions as the OSHA form it replaces.
• If you use software to generate the forms, the system must be able to produce equivalent OSHA 300 and 300A forms when needed (see https://www.osha.gov/laws-regs/standardinterpretations/2025-04-29).

You must enter your business information at the top of the OSHA 300 Log and record a one- or two-line description for each recordable injury or illness, then summarize the year on the OSHA 300-A. See 1904.29(b)(1).

• Include establishment name and address and other business details at the top of the form.
• For each recordable case, enter the case number, employee name (unless a privacy case), date, job title, a brief description of the injury/illness and its cause, and classification boxes.
• At year end, complete the OSHA 300-A Summary with totals and post it where required.

Yes — you must complete an OSHA 301 Incident Report or an equivalent form for every recordable injury or illness entered on the OSHA 300 Log. See 1904.29(b)(2).

• Many employers use an insurance or clinic form as the OSHA 301 equivalent but must add any missing OSHA-required information.
• Keep the OSHA 301 (or equivalent) together with your other recordkeeping files so you can provide them when required.

You must enter each recordable injury or illness on the OSHA 300 Log and complete the OSHA 301 Incident Report within seven calendar days after you receive information that a recordable event has occurred. See 1904.29(b)(3).

• The seven-day clock starts when management becomes aware (not just when an employee reports it).
• If you later learn of additional details, update the entries promptly to keep records accurate.

A form is "equivalent" if it contains the same information, is as readable and understandable, and is completed using the same instructions as the OSHA form it replaces. See 1904.29(b)(4) and OSHA's interpretation at https://www.osha.gov/laws-regs/standardinterpretations/2025-04-29 which confirms electronic or software-generated forms can be equivalent when they meet these criteria.

• Employers commonly use insurance forms as OSHA 301 equivalents but must add any missing OSHA-required fields.
• If using a different layout or electronic format, ensure the content and instructions match OSHA's forms so the records are understandable to users and inspectors.

Yes — you may keep OSHA records on a computer system provided the system can produce equivalent OSHA forms when needed for access and inspection. See 1904.29(b)(5) and OSHA's interpretation at https://www.osha.gov/laws-regs/standardinterpretations/2025-04-29 which clarifies that electronic formats (Excel, CSV, software-generated forms) are acceptable if they produce equivalent 300/300A/301 outputs.

• Your system must be able to generate legible, understandable versions of the OSHA 300, 300-A, and 301 when requested by employees or government representatives.
• Maintain backups and a process to retrieve records within required timeframes.

Yes — if the case qualifies as a "privacy concern case" you may enter "privacy case" instead of the employee's name on the OSHA 300 Log. See 1904.29(b)(6).

• You must keep a separate confidential list linking the case numbers to employee names so you can update records and provide identifications to government representatives if requested.
• Use this option only for the specific privacy categories listed in 1904.29(b)(7).

You must treat the following as "privacy concern cases": injuries or illnesses to an intimate body part or reproductive system; injuries from sexual assault; mental illnesses; HIV infection, hepatitis, or tuberculosis; needlesticks or cuts from contaminated sharp objects; and other illnesses when the employee voluntarily requests name removal. See 1904.29(b)(7) and its subparts for the complete list.

• The regulation lists the categories explicitly in 1904.29(b)(7)(i)–(vi).
• If you remove the name, maintain a confidential mapping of case numbers to employee names for internal tracking and to provide to government officials upon request.

No — you may not classify additional types of injuries or illnesses as privacy concern cases; the list in 1904.29(b)(7) is complete. See 1904.29(b)(8) which explicitly prohibits adding other categories.

• If an employee asks you to omit their name for a case not covered by the list, you must decline and enter the name as required.
• You should follow the specific categories and procedures set out in the regulation to ensure consistent treatment across cases.

Yes — if you reasonably believe that the remaining description would identify the employee, you may use discretion to describe the privacy concern case more generally while still providing enough information to identify the cause and general severity. See 1904.29(b)(9).

• You must still enter enough detail to indicate the incident cause and severity (for example, "injury from assault" or "lower abdominal injury" for reproductive organ injuries as illustrated in 1904.29(b)(10)).
• Keep the confidential list of names linked to case numbers even if you generalize public descriptions.

You may only disclose Forms 300 and 301 with personally identifying information to three types of outside parties: an auditor or consultant hired by the employer; as needed to process a workers' compensation or other insurance claim; or to a public health or law enforcement agency under the conditions of 45 CFR 164.512. See 1904.29(b)(10) and its subparts 1904.29(b)(10)(i), 1904.29(b)(10)(ii), and 1904.29(b)(10)(iii).

• If you voluntarily disclose records to anyone else, remove or hide employees’ names and other personally identifying information first.
• The public health/law enforcement exception references the privacy standard at 45 CFR 164.512 for when disclosures are permitted without patient authorization.

You must provide access to the OSHA 300 Log to employees, former employees, and authorized employee representatives, but you may protect privacy cases by omitting names (entering "privacy case") and keeping a confidential list linking case numbers to names. See 1904.35(b)(2) and the privacy provisions in 1904.29(b)(6)–(9).

• When granting access, make records available in a readable format and in a reasonable time.
• If you omitted a name because of a privacy concern, you must maintain the confidential mapping so you can supply identifying information to government representatives if requested.

Yes — all OSHA injury and illness recordkeeping forms, including equivalent or software-generated forms, must be available for inspection and copying by authorized government representatives. See 1904.40 and OSHA's interpretation at https://www.osha.gov/laws-regs/standardinterpretations/2025-04-29 which reiterates that equivalent electronic forms must be producible for inspection.

• Ensure your software can print or export OSHA-equivalent 300, 300A, and 301 forms so inspectors can review them.
• Keep records organized and accessible for timely production during inspections.

Establishments meeting the size and industry thresholds specified must electronically submit OSHA Form 300A each year by March 2 for the previous calendar year. See the April 16, 2024 memorandum at https://www.osha.gov/laws-regs/standardinterpretations/2024-04-16 which summarizes submission requirements and deadlines.

• Establishments with 250+ employees subject to Part 1904 must submit Form 300A data.
• Establishments with 20–249 employees in certain higher-hazard industries listed in Appendix A must submit Form 300A.
• The memo also explains that some larger establishments in certain industries must also submit Forms 300 and 301, and that OSHA may issue citations for failure to submit until the six-month enforcement window closes (see the memo for details at https://www.osha.gov/laws-regs/standardinterpretations/2024-04-16).

No — when used alone, the application of heated paraffin wax is considered hot therapy and therefore classified as first aid, not medical treatment beyond first aid, so the case is not recordable on that basis alone. See the October 22, 2024 letter at https://www.osha.gov/laws-regs/standardinterpretations/2024-10-22 which explains that paraffin wax meets the hot/cold therapy first-aid exception.

• If paraffin wax is used together with medical treatments that qualify as medical treatment beyond first aid (e.g., prescription drugs, physical therapy) or the case involves restricted work or days away, then the case may be recordable.
• The letter cautions that many significant cases involve additional treatments that make the case recordable even if paraffin wax was applied.

A software system must produce forms that meet the "equivalent form" requirements by including the same information, being as readable and understandable, and following the same instructions as OSHA forms, and it must be able to generate those forms for access and inspections. See the April 29, 2025 letter at https://www.osha.gov/laws-regs/standardinterpretations/2025-04-29 and 1904.29(b)(4).

• The software can store records in common file formats (Excel, CSV) but must reliably produce OSHA-equivalent 300, 300A, and 301 outputs.
• Equivalent electronic forms must be producible for employees and authorized government representatives under 1904.35 and 1904.40.
• Keep documentation describing how the software maps fields to OSHA requirements to demonstrate equivalence during audits or inspections.

You may disclose OSHA Forms with employee-identifying information to an auditor or consultant hired by the employer, but if you otherwise voluntarily disclose records to outside parties you must remove names and personally identifying information unless one of the limited exceptions applies. See 1904.29(b)(10)(i) and the access requirements in 1904.35.

• When an auditor/consultant is retained for safety program evaluation, you may share records with identifying information as allowed by 1904.29(b)(10)(i).
• For any other third party, remove names (or use "privacy case" where applicable) and other personal identifiers before disclosure per 1904.29(b)(10).
• Keep a confidential mapping of names to case numbers for internal use and to provide to government representatives if requested.

You must provide the actual employee name and the complete record to government representatives upon request; removing the name on the publicly viewed OSHA 300 Log does not waive your obligation to supply full records to inspectors. See 1904.29(b)(6) and the access provisions in 1904.35(b)(2).

• Maintain a confidential list linking case numbers to employee names so you can respond promptly to governmental requests.
• Failure to produce complete records to authorized government representatives may be treated as noncompliance during an inspection.

No — if the only treatment for a work-related musculoskeletal injury is limited to first aid, Active Release Techniques (ART) alone, or exercises/stretching that meet the first-aid definition, the case generally is not recordable; however, the case becomes recordable if it meets any recording criterion (e.g., restricted work, days away, medical treatment beyond first aid). See the May 2, 2024 memo at https://www.osha.gov/laws-regs/standardinterpretations/2024-05-02 which explains how first aid, ART, and exercise/stretching affect recordability.

• First aid treatments are listed in the memo and are generally not recordable when they are the only treatment.
• If the injury results in restricted duty, days away from work, medical treatment beyond first aid, or is diagnosed as a significant injury by a licensed health care provider, you must record it.

You may disclose identifying employee health information to a public health authority or law enforcement agency when the disclosure falls within the permissible uses and disclosures outlined in the Department of Health and Human Services standard at 45 CFR 164.512; in those situations you are not required to remove personally identifying information from OSHA Forms. See 1904.29(b)(10)(iii) and the referenced standard at https://www.osha.gov/laws-regs/regulations/standardnumber/45.

• Typical examples include certain public health surveillance, reporting, and law enforcement activities where consent is not required under HIPAA rules.
• Before disclosing, verify that the request or purpose satisfies the conditions in 45 CFR 164.512 and document your basis for disclosure.