29 CFR § 1904.29 - Forms.
(a) Basic requirement. You must use OSHA 300, 300–A, and 301 forms, or equivalent forms, for recordable injuries and illnesses. The OSHA 300 form is called the Log of Work-Related Injuries and Illnesses, the 300–A is the Summary of Work-Related Injuries and Illnesses, and the OSHA 301 form is called the Injury and Illness Incident Report.
(b) Implementation—(1) What do I need to do to complete the OSHA 300 Log? You must enter information about your business at the top of the OSHA 300 Log, enter a one or two line description for each recordable injury or illness, and summarize this information on the OSHA 300–A at the end of the year.
(2) What do I need to do to complete the OSHA 301 Incident Report? You must complete an OSHA 301 Incident Report form, or an equivalent form, for each recordable injury or illness entered on the OSHA 300 Log.
(3) How quickly must each injury or illness be recorded? You must enter each recordable injury or illness on the OSHA 300 Log and 301 Incident Report within seven (7) calendar days of receiving information that a recordable injury or illness has occurred.
(4) What is an equivalent form? An equivalent form is one that has the same information, is as readable and understandable, and is completed using the same instructions as the OSHA form it replaces. Many employers use an insurance form instead of the OSHA 301 Incident Report, or supplement an insurance form by adding any additional information required by OSHA.
(5) May I keep my records on a computer? Yes, if the computer can produce equivalent forms when they are needed, as described under §§ 1904.35 and 1904.40, you may keep your records using the computer system.
(6) Are there situations where I do not put the employee's name on the forms for privacy reasons? Yes, if you have a “privacy concern case,” you may not enter the employee's name on the OSHA 300 Log. Instead, enter “privacy case” in the space normally used for the employee's name. This will protect the privacy of the injured or ill employee when another employee, a former employee, or an authorized employee representative is provided access to the OSHA 300 Log under § 1904.35(b)(2). You must keep a separate, confidential list of the case numbers and employee names for your privacy concern cases so you can update the cases and provide the information to the government if asked to do so.
(7) How do I determine if an injury or illness is a privacy concern case? You must consider the following injuries or illnesses to be privacy concern cases:
(i) An injury or illness to an intimate body part or the reproductive system;
(ii) An injury or illness resulting from a sexual assault;
(iii) Mental illnesses;
(iv) HIV infection, hepatitis, or tuberculosis;
(v) Needlestick injuries and cuts from sharp objects that are contaminated with another person's blood or other potentially infectious material (see § 1904.8 for definitions); and
(vi) Other illnesses, if the employee voluntarily requests that his or her name not be entered on the log.
(8) May I classify any other types of injuries and illnesses as privacy concern cases? No, this is a complete list of all injuries and illnesses considered privacy concern cases for part 1904 purposes.
(9) If I have removed the employee's name, but still believe that the employee may be identified from the information on the forms, is there anything else that I can do to further protect the employee's privacy? Yes, if you have a reasonable basis to believe that information describing the privacy concern case may be personally identifiable even though the employee's name has been omitted, you may use discretion in describing the injury or illness on both the OSHA 300 and 301 forms. You must enter enough information to identify the cause of the incident and the general severity of the injury or illness, but you do not need to include details of an intimate or private nature. For example, a sexual assault case could be described as “injury from assault,” or an injury to a reproductive organ could be described as “lower abdominal injury.”
(10) What must I do to protect employee privacy if I wish to provide access to the OSHA Forms 300 and 301 to persons other than government representatives, employees, former employees or authorized representatives? If you decide to voluntarily disclose the Forms to persons other than government representatives, employees, former employees or authorized representatives (as required by §§ 1904.35 and 1904.40), you must remove or hide the employees' names and other personally identifying information, except for the following cases. You may disclose the Forms with personally identifying information only:
(i) to an auditor or consultant hired by the employer to evaluate the safety and health program;
(ii) to the extent necessary for processing a claim for workers' compensation or other insurance benefits; or
(iii) to a public health authority or law enforcement agency for uses and disclosures for which consent, an authorization, or opportunity to agree or object is not required under Department of Health and Human Services Standards for Privacy of Individually Identifiable Health Information, 45 CFR 164.512.