OSHA Form 300: Injury and Illness Recordkeeping Rules
Who keeps the OSHA 300 log, what counts as recordable versus first aid, the 300A certification and posting window, and the March 2 filing.
OSHA Forms 300, 300A and 301
Two different partial exemptions that catch different businesses, the line between first aid and medical treatment that decides most cases, the seven-day entry clock, the certification employers keep getting wrong, and the electronic filing deadline that arrives a month after the summary goes up
The first injury I ever had to write up was a cut hand. Somebody caught the back of their hand on a bracket, went to an urgent care clinic, came back with three stitches and a bandage, and was at their desk the same afternoon. No time off, no restrictions, no drama. I filed the paperwork the clinic gave me and moved on.
That case was recordable, and I did not record it. Stitches are medical treatment, medical treatment beyond first aid is one of the general recording criteria, and it does not matter in the slightest that the person lost no time. I found this out much later, reading the regulation properly for the first time, and the uncomfortable part was realising how confidently wrong I had been.
This is the whole recordkeeping obligation in one place: who has to do it, which two exemptions exist and what they do not cover, how you decide whether a case goes on the log, what each of the three forms is for, the certification and posting rules, and the electronic filing deadline. I build the people and records tooling for businesses without an HR department at FirstHR. This is general information rather than legal advice.
What Recordkeeping Is
OSHA injury and illness recordkeeping is the duty to log every work-related injury and illness that meets the recording criteria, keep the records for five years, and post an annual summary where employees can read it. The rules sit in 29 CFR Part 1904 and they apply to most employers.
The scale is worth holding in mind. Private industry employers reported 2.5 million nonfatal workplace injuries and illnesses for 2024, a total recordable case rate of 2.3 per 100 full-time equivalent workers, according to the Bureau of Labor Statistics Survey of Occupational Injuries and Illnesses released in January 2026. That is roughly one recordable case for every forty-three full-time workers in a year.
What makes this obligation awkward is that the records are not filed anywhere by default, so nobody tells you when you have got it wrong until an inspector reads the log.
Who Is Exempt and Who Only Thinks They Are
There are two separate partial exemptions, they work differently, and confusing them is the single most common mistake in this area. One is based on company size. The other is based on the industry classification of each establishment, and it has nothing to do with headcount at all.
The size test in the regulation is stricter than employers remember it. It is ten or fewer employees at all times during the previous calendar year, which means peak headcount rather than average, counted across the whole company rather than per location, and covering everyone on your payroll plus temporary workers whose day-to-day work you supervise.
The industry test works the other way round. If an establishment is classified in a NAICS code listed in Appendix A to Subpart B, that establishment keeps no records regardless of size, unless OSHA or the Bureau of Labor Statistics asks in writing (29 CFR 1904.2). The list covers a lot of low-hazard office and retail work: legal services, accounting, insurance carriers, most finance, many professional and technical services, and a long tail of shops.
A quirk worth knowing: the appendix is built on 2007 NAICS codes. If your industry code changed or disappeared in a later NAICS revision, that does not change your exempt status, and OSHA has said so. What does change your status is a genuine change in what the establishment does.
The word partial in both exemptions is doing real work. Neither exemption removes any safety standard, the general duty clause, the required poster, the training obligations attached to specific standards, or the duty to keep records if the agency asks. And neither one touches the reporting duty, which is where the exemption myth turns expensive.
Recording and Reporting Are Two Different Duties
Recording means writing a case into your own forms and keeping them on your premises. Reporting means telling OSHA directly, by phone or through the online form, within hours. The two duties have different triggers, different deadlines, and different exemptions, and employers routinely believe that doing one satisfies the other.
| Recording | Reporting | |
|---|---|---|
| What it means | Entering the case on your 300 log and 301 form | Notifying OSHA directly of a severe outcome |
| Trigger | Any work-related case meeting the recording criteria | Fatality, in-patient hospitalization, amputation, loss of an eye |
| Deadline | 7 calendar days from learning of the case | 8 hours for a death, 24 hours for the other three |
| Who is exempt | Employers under the size or industry partial exemption | Nobody covered by the Act |
| Where it goes | Your own records, kept on site for five years | The nearest OSHA area office, the 800 number, or the online form |
| Who sees it | Employees, their representatives, OSHA on request | OSHA immediately, and it often prompts an inspection |
The reporting windows have a second clock inside them that people miss. A fatality is reportable if the death occurs within thirty days of the work-related incident, and the eight hours run from the death rather than from the incident. A hospitalization, amputation or eye loss is reportable if it occurs within twenty-four hours of the incident, and the twenty-four-hour reporting clock runs from the event.
A few outcomes look severe and are not reportable. A motor vehicle accident on a public street or highway does not require a report unless it happened in a construction work zone. Incidents on commercial or public transportation, such as an airplane or a bus, are outside it. And an admission for observation or diagnostic testing only is not an in-patient hospitalization for this purpose.
After hours, the 800 number and the online form are the only two routes that count. Voicemail, fax and email do not discharge the duty, which matters because the eight-hour window on a night-shift fatality is almost entirely outside office hours.
What Makes a Case Recordable
A case goes on the log when three things are true: it is work-related, it is a new case rather than the continuation of one already recorded, and it meets at least one of the general recording criteria. Those criteria are death, days away from work, restricted work or transfer to another job, medical treatment beyond first aid, loss of consciousness, or a significant injury or illness diagnosed by a physician or other licensed health care professional.
Work-relatedness is presumed if an event or exposure in the work environment either caused the condition or significantly aggravated a pre-existing one. The presumption is rebuttable and the regulation lists the exceptions, which include a person present as a member of the general public, symptoms that surface at work but result solely from a non-work event, voluntary participation in a wellness or recreational activity, eating your own food, personal grooming, self-inflicted injury, a motor vehicle incident in a company car park during a normal commute, the common cold or flu, and mental illness unless the employee voluntarily offers an opinion from a licensed mental health professional.
The line that decides most real cases is the one between medical treatment and first aid. That line is not a judgment call: the regulation gives a closed list of treatments that count as first aid, and anything on the list is first aid regardless of who provides it, where it is provided, or how many times it is repeated (29 CFR 1904.7).
First aid covers non-prescription medication at non-prescription strength, tetanus immunizations, cleaning or flushing surface wounds, wound coverings including butterfly closures, hot and cold therapy, non-rigid supports such as elastic wraps, temporary immobilization used only while transporting somebody, draining a blister or relieving pressure under a nail, eye patches, removing foreign material from the eye by irrigation or swab, removing splinters by simple means, finger guards, massage, and drinking fluids for heat stress. Everything else that is treatment is medical treatment.
| What happened | Recordable | Why |
|---|---|---|
| Cut treated with butterfly closures, back at work | No | Wound coverings are on the first aid list |
| Same cut closed with three stitches | Yes | Sutures are medical treatment beyond first aid |
| Sprain wrapped in an elastic bandage | No | Non-rigid support is first aid |
| Same sprain put in a rigid splint as treatment | Yes | Rigid support used to treat, not just to transport |
| Employee given a single prescription pill, not taken | Yes | Prescription medication is medical treatment whether or not it is used |
| Employee told to take over-the-counter painkillers | No | Non-prescription strength is first aid |
| Ibuprofen given at prescription strength | Yes | Non-prescription drug at prescription strength is treatment |
| Doctor restricts lifting for two days, employee stays at work | Yes | Restricted work is a criterion on its own |
| Employee sent home for the rest of the shift only | No | The day of the injury is not counted as a day away |
| Employee off the next two days on doctor’s advice | Yes | Days away from work, counted from the day after |
| Fainted briefly after a chemical smell, no treatment | Yes | Loss of consciousness is a criterion on its own |
| Twisted an ankle in the car park while arriving | No | Commuting exception, unless work conditions caused it |
| Flu caught from a colleague at work | No | Common cold and flu are excepted by the regulation |
| Needlestick from a contaminated sharp, no symptoms | Yes | Specific recording criterion, recorded as an injury |
Day counts have their own rules and they are counted in calendar days, not working days. Counting starts the day after the injury or onset, weekends and holidays are included if the person would not have been able to work, and the count stops when a physician says the employee can return to normal duties. Both the days-away and the restricted-work totals are capped at 180 days.
Recording a case is explicitly not an admission of fault or a determination of workers compensation eligibility, and the two systems do not use the same tests. A case can be recordable and the claim denied. A claim can be paid on a case that never met the recording criteria.
Form 300 Is the Log
Form 300 is a single running list, one per establishment, with one line per recordable case. It carries the case number, the employee name, the job title, the date of injury or onset, where the event occurred, a short description, the classification of the outcome, the day counts, and a tick in one of six injury or illness type columns.
The classification columns are exclusive. Each case is classified once, at its most serious outcome: death, days away from work, job transfer or restriction, or other recordable case. If somebody starts with restricted duty and later loses days, you move the tick rather than adding a second one, and you correct the entry rather than opening a new line.
You keep a separate log for each establishment expected to be operational for more than one year. Short-term establishments, meaning those in existence for a year or less, can be grouped, and employees who do not report to a fixed location are linked to the establishment they receive assignments from. For most small businesses that means one log, which is the simplest version of the rule.
Equivalent forms are permitted. A substitute is acceptable if it contains the same information, is as readable and understandable, and is completed using the same instructions, which is what allows a spreadsheet or a piece of software to stand in for the printed form. Electronic records are fine as long as you can produce equivalent paper forms when somebody with a right to them asks.
Form 301 Is the Incident Record
Form 301 is completed once per recordable case, within the same seven calendar days as the log entry, and it holds the narrative detail the log has no room for. What the employee was doing before the incident, what happened, what the injury or illness was, and what object or substance directly harmed them.
It also captures the treating professional and facility, whether the person was treated in an emergency room, and whether they were hospitalized overnight as an in-patient. Those last two fields are the ones people leave blank, and they are the ones that connect the record to the reporting duty.
A workers compensation first report of injury or an insurance carrier form may be used instead of the 301, but only if it contains all the same information (29 CFR 1904.29). In practice most state first-report forms are missing at least one field, so the practical answer is to keep using the carrier form and attach a short supplement covering the gaps rather than duplicating everything.
The seven-day clock runs from the moment you receive information that a recordable case occurred, not from the date of the incident. If a supervisor knew on Monday and told you on Thursday, three days of the window are gone, which argues for a reporting route that does not pass through a supervisor’s inbox.
Form 300A, the Certification and the Posting Window
Form 300A is the annual summary. After the calendar year closes you review the log for completeness and accuracy, transfer the totals onto the summary along with the average number of employees and the total hours worked, have a company executive certify it, and post it from February 1 to April 30 of the following year.
The certification is where I see the most avoidable errors. It is not a formality and it is not delegable to whoever keeps the records. The four eligible categories are deliberately senior, because the point of the signature is that somebody with authority has looked at the log and personally believes it is correct and complete.
The zero summary catches people too. A business with a clean year still posts a summary showing zeros, because the posting tells employees what was recorded, and nothing recorded is information. Skipping it because there was nothing to report is a recordkeeping violation with no underlying injury behind it.
April 30 also means through the end of April 30. Taking the summary down in early March, once the electronic filing deadline has passed, is a habit I have watched several employers fall into because the two dates sit so close together.
Who Has to File Electronically
Electronic submission is a separate duty from posting, it applies to a minority of establishments, and the test turns on both establishment size and industry. Covered establishments file through the Injury Tracking Application by March 2 of the year after the year the records cover.
| Establishment profile | What gets submitted | Deadline |
|---|---|---|
| Peak employment of 19 or fewer last year | Nothing | Not applicable |
| 20 to 249 employees, industry in Appendix A to Subpart E | Form 300A only | March 2 |
| 20 to 249 employees, industry not in Appendix A to Subpart E | Nothing | Not applicable |
| 250 or more employees, not partially exempt by industry | Form 300A | March 2 |
| 100 or more employees, industry in Appendix B to Subpart E | Forms 300 and 301 data plus the 300A | March 2 |
| Any establishment asked in writing by OSHA or BLS | Whatever the request specifies | As stated in the request |
Three details decide most borderline cases. The count is per establishment, not per company, so a business with several small sites can be below the threshold everywhere while employing several hundred people. It is peak employment at any point during the previous calendar year, not the average. And it includes every employee at that establishment, full time, part time, seasonal and temporary alike.
The submission runs through OSHA’s Injury Tracking Application, either by typing the data into a web form, uploading a CSV, or connecting through the API, and you need your Employer Identification Number to file (OSHA Injury Tracking Application). If you miss March 2, the system still accepts late submissions through December 31, which does not make the filing timely but is a great deal better than not filing at all.
The 100-employee tier is the one that changed the calculus for mid-sized employers in designated high-hazard industries, because it is the only tier that requires case-level detail from the 300 and 301 rather than just the summary totals. If your establishment sits in Appendix B to Subpart E, the quality of your individual case descriptions stops being an internal matter.
Privacy Cases and Keeping Names Off the Log
Six categories of case are privacy concern cases, and for those you leave the employee name off the 300 log entirely and write the words privacy case in the name column. You then keep a separate, confidential list matching case numbers to names, stored with the same five-year retention as the log itself.
The six are: an injury or illness to an intimate body part or the reproductive system; an injury or illness resulting from a sexual assault; a mental illness; a case of HIV infection, hepatitis or tuberculosis; a needlestick or sharps injury contaminated with another person’s blood or other potentially infectious material; and any other illness where the employee voluntarily asks that their name not be entered.
That last category is narrower than it looks. The employee-request route applies to illnesses, not to injuries, so somebody who broke an ankle cannot ask to be anonymised on that basis. The other five categories are mandatory, which means you leave the name off whether or not the employee asks, and whether or not they would prefer it there.
Store the confidential case list wherever your other restricted records live rather than in the folder the log sits in. Medical information arriving with the case does not belong in a personnel file either.
Retention, and Who Can Demand a Copy
You keep the 300 log, the 300A summary, the 301 incident reports and the privacy case list for five years following the end of the calendar year those records cover. In practice that means six years of files sitting in the cabinet at any given moment.
During those five years the log is the only one of the four with a live maintenance duty. If a recordable case surfaces late, or a case turns out to belong in a different classification, you go back into the stored log and update it, crossing out or deleting what was there. The summary and the incident reports do not have to be updated, although you are free to do so.
Access rights are where the deadlines get short. A current employee, a former employee or their personal representative can ask for a copy of the 300 log for any establishment where that person worked, and you have to provide it by the end of the next business day with the names left on. Their own 301 incident report comes on the same next-business-day deadline.
An authorized employee representative, typically a union, gets the 300 log by the end of the next business day as well, but only the part of the 301 that describes the case, and within seven calendar days rather than one. The first copy in each case is free, and you may charge reasonable retrieval and copying costs for further copies.
Underneath all of this sits a requirement that gets almost no attention. You must have a reasonable procedure for employees to report injuries and illnesses promptly, tell each employee what it is, and tell them they have the right to report without being retaliated against. A procedure that would deter a reasonable employee from reporting is not reasonable, which puts discipline schemes and safety bonus programmes tied to injury counts on dangerous ground.
Where Small Employers Get This Wrong
Nine patterns account for nearly every recordkeeping problem I have seen, and none of them involve anybody trying to hide an injury.
Using average headcount for the size exemption is first. The test is ten or fewer at all times during the previous calendar year, company-wide, so a summer of eleven people ends the exemption for the following year.
Treating the industry exemption as company-wide is second. It applies establishment by establishment, so a company with an exempt office and a non-exempt warehouse keeps a log for the warehouse.
Equating no lost time with not recordable is third, and it is the one that caught me. Medical treatment beyond first aid, restricted duty, and loss of consciousness are each criteria on their own, with no time away required.
Deferring to the clinic is fourth. A discharge note saying first aid only is clinical shorthand rather than a recordability determination, and the decision belongs to you, made against the closed list in the regulation.
Waiting for the workers compensation claim is fifth. The seven-day clock does not pause for a claim decision, and the two systems use different tests, so the outcome of the claim tells you very little about the log.
The wrong signature on the 300A is sixth. A safety coordinator, an office manager or an outside consultant certifying the summary is not a company executive within the meaning of the rule.
Skipping the zero summary is seventh, and it produces a citation with no injury behind it. Miscounting days is eighth: calendar days, starting the day after, capped at 180.
And never revisiting a stored log is ninth. The duty to update runs for the full five years, which is why the annual review before the summary is worth doing properly rather than transferring totals mechanically.
State plan states add a layer worth checking. Roughly half the country operates under a state plan, and a state plan must be at least as effective as the federal programme but may impose additional recordkeeping and reporting requirements, including different reporting phone numbers and in some cases broader triggers.
Frequently Asked Questions
Who is exempt from keeping the OSHA 300 log?
Two separate partial exemptions exist and either one is enough. The first is size: an employer with ten or fewer employees at all times during the previous calendar year does not have to keep the records, counted company-wide across every location rather than per site. The second is industry: an establishment classified in one of the NAICS codes listed in Appendix A to Subpart B is exempt regardless of how many people it employs, and that test runs location by location. Neither exemption removes the duty to phone OSHA about a fatality, an in-patient hospitalization, an amputation or the loss of an eye. Neither removes the duty to keep records if OSHA or the Bureau of Labor Statistics writes and asks you to. And neither touches the safety standards themselves.
What is the difference between OSHA Forms 300, 300A and 301?
The 300 is the log: one running list per establishment with one line per recordable case, showing who, when, where, a short description, the classification and the day counts. The 301 is the incident report: one form per case carrying the detail the log cannot hold, including what the employee was doing, how the incident happened, the object or substance involved and where the person was treated. Both are due within seven calendar days of learning a recordable case occurred. The 300A is the annual summary: year-end totals from the log plus average employment and hours worked, certified by a company executive and posted from February 1 to April 30 of the following year. Employees and their representatives can request the 300 and the 301, but only the 300A is posted without anyone asking.
Is an injury recordable if the employee only received first aid?
No, provided first aid is the only treatment given and no other recording criterion is met. The regulation defines first aid as a closed list rather than a judgment call, and anything on that list is first aid no matter who administers it or where. The list includes non-prescription medication at non-prescription strength, tetanus shots, cleaning or flushing surface wounds, bandages and butterfly closures, hot or cold therapy, non-rigid supports such as elastic wraps, temporary immobilization used only to transport someone, draining a blister, eye patches, removing splinters or foreign material from the eye by irrigation or swab, finger guards, massage and drinking fluids for heat stress. A single dose of prescription medication is medical treatment even if the employee never swallows it. So is a rigid splint used as treatment rather than for transport, and so are stitches.
When do you have to post the OSHA 300A summary?
From February 1 to April 30 of the year following the year the records cover, at each establishment, in the place where you normally post notices to employees. Three points catch employers out. The first is that a year with no recordable cases still requires a posted summary with zeros in the totals; there is no such thing as skipping the posting because nothing happened. The second is that the summary must be certified before it goes up, by an owner, a corporate officer, the highest ranking company official working at that establishment, or that person’s immediate supervisor. A safety coordinator or office manager signing on their own authority is not a valid certification. The third is that taking it down early is its own violation, and April 30 means the end of April 30.
Does a small business have to submit OSHA forms electronically?
Most do not, but the test is about the establishment rather than the company, and it turns on both size and industry. An establishment with peak employment of nineteen or fewer during the previous calendar year never submits. An establishment with twenty to two hundred and forty-nine employees submits Form 300A only if its industry appears in Appendix A to Subpart E. An establishment with two hundred and fifty or more employees submits Form 300A unless its industry is partially exempt under Appendix A to Subpart B. An establishment with one hundred or more employees in an industry listed in Appendix B to Subpart E submits data from Forms 300 and 301 as well as the 300A. The deadline is March 2 of the following year, filed through the Injury Tracking Application, and a missed deadline can still be filed until December 31.
How long do you have to keep OSHA 300 logs and 301 forms?
Five years following the end of the calendar year the records cover. That applies to the 300 log, the 300A summary, the 301 incident reports and the confidential privacy case list, and it is longer than most employers assume. During those five years the log is the one document you have a live duty to maintain: if you discover a recordable case you missed, or a case turns out to belong in a different classification, you go back into the stored log and fix it. The annual summary and the incident reports do not have to be updated, although nothing stops you. If you buy a business, you take on the duty to preserve the records for the remainder of the five-year period, and the seller has to hand them over.
Can employees see the OSHA 300 log?
Yes, and the deadlines are short. A current employee, a former employee or their personal representative can ask for a copy of the 300 log for any establishment where the person worked, and you have until the end of the next business day to provide it, with employee names left on. The same next-business-day deadline applies to a person asking for their own 301 incident report. An authorized employee representative gets the 300 log by the end of the next business day too, but only the section of the 301 describing the case, and within seven calendar days rather than one. The first copy is free. You also have to tell employees how to report an injury and that they will not be retaliated against for doing so.
Does recording a case mean admitting the injury was your fault?
No, and the regulation says so directly. Recording a case is not an admission of fault, of a violation, or of eligibility for workers compensation benefits, and the recordability tests deliberately do not match the tests any state uses to decide a compensation claim. That mismatch runs both ways. A claim can be denied and the case still belongs on your log, because the log turns on work-relatedness and treatment rather than on compensability. A claim can be paid on a case that never became recordable, because first aid alone does not meet the criteria. Waiting for the claim outcome before making an entry is one of the most common ways employers blow the seven-day deadline, and it produces a log that is late rather than accurate.