Current Occupational Safety and Health Administration (OSHA) recordkeeping requirements, codified at 29 C.F.R. Part 1904, mandate that covered employers record certain work-related injuries and illnesses sustained by employees on their OSHA 300 Log. OSHA regulations also require that employers report on their Form 301 certain information, including: 1) work-related in-patient hospitalization, amputation or loss of an eye within 24 hours and 2) all work-related fatalities within eight hours.

Effective Jan. 1, 2024, OSHA issued a new rule requiring establishments with 100 or more employees in designated industries with high injury and illness rates to electronically submit the foregoing information to OSHA once a year through the agency's new Injury Tracking Application (ITA). OSHA will use the data to analyze occupational injuries, illness and hazardous conditions in workplaces and will also make the information available for public access.

OSHA has taken steps to minimize the collection of personally identifiable information (PII) and safeguard sensitive information, and employers should follow certain steps to protect PII during the electronic submission process.

Common Questions and Recommended Steps for Employers

1. Who Is Required to Submit Information from the Form 300 Log and Form 301 Incident Report Under the New Regulation?

Establishments with 100 or more employees in high-hazard industries are required to submit case-specific information from their OSHA Form 300 Log and Form 301 Incident Report once a year. According to the new rule, establishments located in states that are covered federally by OSHA can determine if they are required to submit through OSHA's ITA coverage application website. Establishments covered by a state plan should directly contact their respective plan.

For implementing the new rule, OSHA added Appendix B, which designates the industries required to submit data for Forms 300 and 301. The determination as to whether an employer must electronically submit recordkeeping data to OSHA is based on the number of employees and industry classification at an establishment, rather than the firm as a whole.

Establishments that meet any of the following criteria during the previous calendar year, however, do not need to electronically submit their information to OSHA under the new rule:

• the establishment's peak employment during the previous calendar year was 19 or fewer employees, regardless of the establishment's industry
• the establishment's industry is listed on Appendix A to Subpart B of OSHA's recordkeeping regulation, regardless of the number of employees working at the establishment
• the establishment had a peak employment between 20 and 249 employees during the previous calendar year and the establishment's industry is not on Appendix A to Subpart E of OSHA's recordkeeping regulation

2. How Does the New Rule Affect Employers Who Must Already Submit Information to OSHA Annually on Their Form 300A?

Establishments with 20 to 249 employees in certain industries will continue to be required to electronically submit information from their OSHA Form 300A annual summary to OSHA once a year.

All establishments with 250 or more employees that are required to keep records under OSHA's injury and illness recordkeeping regulation will also continue to be required to electronically submit information from their Form 300A to OSHA once a year. As part of the new rule, OSHA updated the North American Industry Classification System (NAICS) codes used in Appendix A, which designates the industries required to submit their Form 300A data.

3. How Does an Establishment Electronically Submit the Information?

Establishments must use OSHA's new ITA to submit data from their OSHA Form 300A Annual Summary, OSHA Form 300 Log and OSHA Form 301 Incident Report. Establishments can submit the data in any of the following three ways:

• use the ITA webform to manually enter the establishment's data
• upload a CSV file to the ITA
• use an application programming interface (API) feed to transmit data electronically

4. When Must an Establishment Make Electronic Submissions Under the New Rule?

Establishments are required to make annual data submissions. The ITA began accepting submissions of 2023 injury and illness data on Jan. 2, 2024. Establishments must submit the form by March 2 of the calendar year following the year covered by the forms. For example, by March 2024, an establishment must submit information contained in the forms covering calendar year 2023. If the submission due date of March 2 has passed, establishments that meet the reporting requirements and failed to do so must still submit the required recordkeeping data through the ITA and can do so until Dec. 31.

5. What Information Must Be Provided?

When making electronic submissions to OSHA, establishments must include their company name. OSHA will then post certain data submitted by establishments on a public website. Establishments are also required to submit through the ITA information about an injured employee, such as job title, date hired and gender, that, in some limited circumstances, could be used to identify individual employees in conjunction with other data. However, an establishment must not submit non-mandatory information if it could reasonably be used to identify employees directly.

6. What Steps Must an Establishment Follow with Respect to Protecting an Employee's PII?

Establishments must ensure that they do not submit PII in their electronic submissions. PII includes any information that could reasonably be expected to identify employees directly, such as by their name, address, Social Security number or other identifying number or code, telephone number, healthcare provider information, family member information or email address. PII also includes information that could indirectly identify an employee, such as gender, race, ethnicity or occupation.

Establishments should also review Form 300 Log and Form 301 Incident Reports and remove unnecessary PII from the narrative fields before submitting them to the ITA. For privacy concern cases as defined by 29 C.F.R. Part 1904.29(b)(7), establishments should enter "privacy concern case" on the Form 300 Log instead of the employee's name and keep a separate, confidential list of case numbers and employee names for privacy concern cases so that the establishment can update the cases and provide the information to the government upon request.

However, establishments must still submit an injured or ill employee's date of birth through the ITA. To protect this PII, the ITA will automatically convert the date of birth information to an employee's age.

7. How Will OSHA Protect the Identity of the Injured or Ill Workers Whose Data Is Submitted?

OSHA will protect worker privacy by taking several steps with respect to data submitted through the ITA, including by:

• not collecting worker names or addresses
• reminding employers not to submit information that could directly identify workers
• automatically converting all birthdates to age upon submission through the ITA and discarding the birthdate data
• not making publicly available any data concerning an employee's age, gender, date hired and whether the worker was treated in the emergency room and/or hospitalized overnight as an inpatient
• using automated information technology and some manual review to detect and remove remaining information that could reasonably be expected to identify an individual directly

8. What Challenges Could the New Rule's Required Electronic Submission of Data Pose to Employers?

There could likely be additional administrative burdens and related costs to an establishment in having to comply with the rule's deadlines, creating an account on OSHA's website, inputting information in a manner that is compliant with the rule's PII proscriptions and navigating changes that may have to be made when changing account holders – both as to training and accessing the electronic reporting portal.

Additionally, increased regulation and requirements imposed on establishments and their business operations bring greater potential for liability by way of OSHA citations and fines should an establishment fail to comply with the new rule or make the necessary submissions. The rule could also expose establishments to errors in data uploading.

9. What Effect Might the Publicizing of Data on OSHA's Website Have for an Employer?

OSHA's publicizing an employer's injury information may have both positive and negative consequences. First, injury information will become more accessible to employees, workers and third parties seeking to evaluate a company's safety record. Second, this additional information may affect an employer's reputation. For example, it may positively affect an employer if it has a strong record of safety, or it may negatively impact it if it shows high occurrences of injury and safety incidents. Third, the published information will provide overall greater transparency and access to safety and injury information and data.

Next Steps

Employers should determine whether the new rule applies to them and review their current policies that address recordkeeping and reporting to OSHA. Employers who will be subject to the new rule must take steps to set up their electronic reporting accounts and become familiar with the system to avoid delays and errors.