OSHA Form 300: Injury and Illness Recordkeeping Rules
Who keeps the OSHA 300 log, what counts as recordable versus first aid, the 300A certification and posting window, and the March 2 filing.
The first injury I ever had to write up was a cut hand. Somebody caught the back of their hand on a bracket, went to an urgent care clinic, came back with three stitches and a bandage, and was at their desk the same afternoon. No time off, no restrictions, no drama. I filed the paperwork the clinic gave me and moved on.
That case was recordable, and I did not record it. Stitches are medical treatment, medical treatment beyond first aid is one of the general recording criteria, and it does not matter in the slightest that the person lost no time. I found this out much later, reading the regulation properly for the first time, and the uncomfortable part was realizing how confidently wrong I had been.
This is the whole recordkeeping obligation in one place: who has to do it, which two exemptions exist and what they do not cover, how you decide whether a case goes on the log, what each of the three forms is for, the certification and posting rules, and the electronic filing deadline. I build the people and records tooling for businesses without an HR department at FirstHR. This is general information rather than legal advice.
What Recordkeeping Is
OSHA injury and illness recordkeeping is the duty to log every work-related injury and illness that meets the recording criteria, keep the records for five years, and post an annual summary where employees can read it. The rules sit in 29 CFR Part 1904 and they apply to most employers.
Private industry employers reported 2.5 million nonfatal workplace injuries and illnesses for 2024, a total recordable case rate of 2.3 per 100 full-time equivalent workers, according to the Bureau of Labor Statistics Survey of Occupational Injuries and Illnesses released on January 22, 2026. That is roughly one recordable case for every forty-three full-time workers in a year.
What makes this obligation awkward is that the records are not filed anywhere by default, so nobody tells you when you have got it wrong until an inspector reads the log. The first question is whether you have to keep them at all.
Who Is Exempt and Who Only Thinks They Are
There are two separate partial exemptions, they work differently, and confusing them is one of the most common mistakes in this area. One is based on company size. The other is based on the industry classification of each establishment, and it has nothing to do with headcount at all.
The size test in the regulation is stricter than employers remember it. It is ten or fewer employees at all times during the previous calendar year (29 CFR 1904.1), which means peak headcount rather than average, counted across the whole company rather than per location, and covering everyone on your payroll plus temporary workers whose day-to-day work you supervise.
The industry test works the other way round. If an establishment is classified in a NAICS code listed in Appendix A to Subpart B, that establishment keeps no records regardless of size, unless OSHA or the Bureau of Labor Statistics asks in writing (29 CFR 1904.2). The list covers a lot of low-hazard office and retail work: legal services, accounting, insurance carriers, most finance, many professional and technical services, and a long tail of shops.
A quirk worth knowing: the appendix is built on 2007 NAICS codes. If your industry code changed or disappeared in a later NAICS revision, that does not change your exempt status, and OSHA has said so. What does change your status is a genuine change in what the establishment does.
Both exemptions are partial. Neither removes any safety standard, the general duty clause, the required OSHA poster, the training obligations attached to specific standards, or the duty to keep records if the agency asks. And neither one touches the reporting duty, which is where the exemption myth turns expensive.
Recording and Reporting Are Two Different Duties
Recording means writing a case into your own forms and keeping them in your own files. Reporting means telling OSHA directly, by phone or through the online form, within hours. The two duties have different triggers, different deadlines, and different exemptions, and employers routinely believe that doing one satisfies the other.
| Recording | Reporting | |
|---|---|---|
| What it means | Entering the case on your 300 log and 301 form | Notifying OSHA directly of a severe outcome |
| Trigger | Any work-related case meeting the recording criteria | Fatality, in-patient hospitalization, amputation, or loss of an eye |
| Deadline | 7 calendar days from learning of the case | 8 hours for a death, 24 hours for the other three |
| Who is exempt | Employers under the size or industry partial exemption | Nobody covered by the Act |
| Where it goes | Your own records, kept for five years | The nearest OSHA area office, the 800 number, or the online form |
| Who sees it | Employees, their representatives, OSHA on request | OSHA immediately, and it often prompts an inspection |
The reporting windows have a second clock inside them that people miss. A fatality is reportable if the death occurs within thirty days of the work-related incident, and the eight hours run from the death rather than from the incident. A hospitalization, amputation or eye loss is reportable if it occurs within twenty-four hours of the incident, and the twenty-four-hour reporting clock then runs from that outcome, not from the incident.
A few outcomes look severe and are not reportable. A motor vehicle accident on a public street or highway does not require a report unless it happened in a construction work zone. Incidents on commercial or public transportation, such as an airplane or a bus, are outside the duty as well. And an admission for observation or diagnostic testing only is not an in-patient hospitalization for this purpose.
After hours, the 800 number and the online form are the only two routes that count. Voicemail, fax and email do not discharge the duty, which matters because the eight-hour window on a night-shift fatality is almost entirely outside office hours.
What Makes a Case Recordable
A case goes on the log when three things are true: it is work-related, it is a new case rather than the continuation of one already recorded, and it meets at least one of the general recording criteria. Those criteria are death, days away from work, restricted work or transfer to another job, medical treatment beyond first aid, loss of consciousness, or a significant injury or illness diagnosed by a physician or other licensed health care professional.
Work-relatedness is presumed if an event or exposure in the work environment either caused or contributed to the condition or significantly aggravated a pre-existing one. The presumption is rebuttable, and the regulation lists the exceptions (29 CFR 1904.5).
The exceptions include a person present as a member of the general public, symptoms that surface at work but result solely from a non-work event, voluntary participation in a wellness or recreational activity, eating your own food, personal grooming, self-inflicted injury, a motor vehicle incident in a company parking lot during a normal commute, the common cold or flu, and mental illness unless the employee voluntarily offers an opinion from a licensed mental health professional.
The line that decides most real cases is the one between medical treatment and first aid. That line is not a judgment call: the regulation gives a closed list of treatments that count as first aid, and anything on the list is first aid regardless of who provides it, where it is provided, or how many times it is repeated (29 CFR 1904.7).
First aid covers non-prescription medication at non-prescription strength, tetanus immunizations, cleaning or flushing surface wounds, wound coverings including butterfly closures, hot and cold therapy, non-rigid supports such as elastic wraps, temporary immobilization used only while transporting somebody, draining a blister or relieving pressure under a nail, eye patches, removing foreign material from the eye by irrigation or swab, removing splinters from other areas by simple means, finger guards, massage, and drinking fluids for heat stress. Everything else that is treatment is medical treatment.
| What happened | Recordable | Why |
|---|---|---|
| Cut treated with butterfly closures, back at work | No | Wound coverings are on the first aid list |
| Same cut closed with three stitches | Yes | Sutures are medical treatment beyond first aid |
| Sprain wrapped in an elastic bandage | No | Non-rigid support is first aid |
| Same sprain put in a rigid splint as treatment | Yes | Rigid support used to treat, not just to transport |
| Employee given a single prescription pill, not taken | Yes | Prescription medication is medical treatment whether or not it is used |
| Employee told to take over-the-counter painkillers | No | Non-prescription strength is first aid |
| Ibuprofen given at prescription strength | Yes | Non-prescription drug at prescription strength is treatment |
| Doctor bars lifting for two days for a stocker who lifts daily | Yes | Restricting a routine job function is a criterion on its own |
| Employee sent home for the rest of the shift only | No | The day of the injury is not counted as a day away |
| Employee off the next two days on doctor’s advice | Yes | Days away from work, counted from the day after |
| Fainted briefly after a chemical smell, no treatment | Yes | Loss of consciousness is a criterion on its own |
| Car accident in the company parking lot while arriving | No | Commuting exception covers motor vehicle accidents only, not a fall in the lot |
| Flu caught from a colleague at work | No | Common cold and flu are excepted by the regulation |
| Needlestick from a contaminated sharp, no symptoms | Yes | Specific recording criterion, recorded as an injury |
Day counts run in calendar days, not working days. Counting starts the day after the injury or onset, and weekends and holidays are included if the person would not have been able to work.
The two counts end differently. Days away stop on the date a physician recommends a return to work, restricted days stop when the restriction ends, and both totals can be capped at 180 days.
Recording a case is explicitly not an admission of fault or a determination of workers compensation eligibility, and the two systems do not use the same tests. A case can be recordable and the claim denied. A claim can be paid on a case that never met the recording criteria.
Whichever way a case goes, write the decision down at the moment you make it, with the reason beside it. A year later the log tells you what you concluded and nothing about why, and the why is what an inspector asks about first.
Form 300 Is the Log
Form 300 is a single running list, one per establishment, with one line per recordable case. It carries the case number, the employee name, the job title, the date of injury or onset, where the event occurred, a short description, the classification of the outcome, the day counts, and a tick in one of six injury or illness type columns.
The classification columns are exclusive. Each case is classified once, at its most serious outcome: death, days away from work, job transfer or restriction, or other recordable case. If somebody starts with restricted duty and later loses days, you move the tick rather than adding a second one, and you correct the entry rather than opening a new line.
You keep a separate log for each establishment expected to be in operation for one year or longer. Short-term establishments, meaning those that will exist for less than a year, can be grouped, and employees who work at several locations or at none of them must still be linked to one of your establishments for recordkeeping purposes (29 CFR 1904.30). For most small businesses that means one log, which is the simplest version of the rule.
Equivalent forms are permitted. A substitute is acceptable if it contains the same information, is as readable and understandable, and is completed using the same instructions, which is what allows a spreadsheet or a piece of software to stand in for the printed form. Electronic records are fine as long as you can produce equivalent paper forms when somebody with a right to them asks.
Form 301 Is the Incident Record
Form 301 is completed once per recordable case, within the same seven calendar days as the log entry, and it holds the narrative detail the log has no room for: what the employee was doing before the incident, what happened, what the injury or illness was, and what object or substance directly harmed them.
Form 301 also captures the treating professional and facility, whether the person was treated in an emergency room, and whether they were hospitalized overnight as an in-patient. Those last two fields are the ones people leave blank, and they are the ones that connect the record to the reporting duty.
A workers compensation first report of injury or an insurance carrier form may be used instead of the 301, but only if it contains all the same information (29 CFR 1904.29).
The regulation notes that many employers supplement an insurance form with whatever extra information OSHA requires, so keep using the carrier form and attach a short supplement covering any gaps rather than duplicating everything.
The seven-day clock runs from the moment you receive information that a recordable case occurred, not from the date of the incident. If a supervisor knew on Monday and told you on Thursday, three days of the window are gone, which argues for a reporting route that does not pass through a supervisor’s inbox.
Form 300A, the Certification and the Posting Window
Form 300A is the annual summary. After the calendar year closes you review the log for completeness and accuracy, transfer the totals onto the summary along with the average number of employees and the total hours worked, have a company executive certify it, and post it from February 1 to April 30 of the following year.
The certification is where I see the most avoidable errors. It is not a formality and it is not delegable to whoever keeps the records. The four eligible categories are deliberately senior (29 CFR 1904.32), because the point of the signature is that somebody with authority has looked at the log and personally believes it is correct and complete.
The zero summary catches people too. A business with a clean year still posts a summary showing zeros, because the posting tells employees what was recorded, and nothing recorded is information. Skipping it because there was nothing to report is a recordkeeping violation with no underlying injury behind it.
April 30 also means through the end of April 30. Taking the summary down in early March, once the electronic filing deadline has passed, is a habit I have watched several employers fall into because the two dates sit so close together.
Who Has to File Electronically
Electronic submission is a separate duty from posting, it applies to a minority of establishments, and the test turns on both establishment size and industry. Covered establishments file through the Injury Tracking Application by March 2 of the year after the year the records cover (29 CFR 1904.41).
| Establishment profile | What gets submitted | Deadline |
|---|---|---|
| Peak employment of 19 or fewer last year | Nothing | Not applicable |
| 20 to 249 employees, industry in Appendix A to Subpart E | Form 300A only | March 2 |
| 20 to 249 employees, industry not in Appendix A to Subpart E | Nothing | Not applicable |
| 250 or more employees, not partially exempt by industry | Form 300A | March 2 |
| 100 or more employees, industry in Appendix B to Subpart E | Forms 300 and 301 data plus the 300A | March 2 |
| Any establishment asked in writing by OSHA or BLS | Whatever the request specifies | As stated in the request |
The last row overrides the rest. An establishment of any size, including one with 19 or fewer employees, files whatever a written request from OSHA or BLS asks for.
Three details decide most borderline cases. The count is per establishment, not per company, so a business with several small sites can be below the threshold everywhere while employing several hundred people. It is peak employment at any point during the previous calendar year, not the average. And it includes every employee at that establishment, full time, part time, seasonal and temporary alike.
The submission runs through OSHA’s Injury Tracking Application, either by typing the data into a web form, uploading a CSV, or connecting through the API, and you need your Employer Identification Number to file (OSHA Injury Tracking Application). If you miss March 2, the system still accepts late submissions through December 31, which does not make the filing timely but is a great deal better than not filing at all.
The 100-employee tier is the one that changed the calculus for mid-sized employers in designated high-hazard industries, because it is the only tier that requires case-level detail from the 300 and 301 rather than just the summary totals. If your establishment sits in Appendix B to Subpart E, the quality of your individual case descriptions stops being an internal matter.
Kelly KapoorCustomer ServiceUp to Date
Darryl PhilbinWarehouseNeeds Attention
Ryan HowardSalesUp to DatePrivacy Cases and Keeping Names Off the Log
Six categories of case are privacy concern cases, and for those you leave the employee name off the 300 log entirely and write the words privacy case in the name column. You then keep a separate, confidential list matching case numbers to names, stored with the same five-year retention as the log itself.
The six are: an injury or illness to an intimate body part or the reproductive system; an injury or illness resulting from a sexual assault; a mental illness; a case of HIV infection, hepatitis or tuberculosis; a needlestick or sharps injury contaminated with another person’s blood or other potentially infectious material; and any other illness where the employee voluntarily asks that their name not be entered.
That last category is narrower than it looks. The employee-request route applies to illnesses, not to injuries, so somebody who broke an ankle cannot ask to be anonymized on that basis. The other five categories are mandatory: you leave the name off whether or not the employee asks, and even if they would prefer it there.
The list itself is short by design: enough to reconnect a case number to a person, and nothing more. Keep it as its own file, on the same five-year clock as the log it belongs to.
| A | B | C | D | E | F | G | H | I | J | |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Case number on the 300 log | Log year | Establishment | Date of injury or onset | Employee name | Which of the six categories applies | Mandatory or at the employee's request | Retain through end of | Where this list is stored | Who may open it |
| 2 | ||||||||||
| 3 | ||||||||||
| 4 | ||||||||||
| 5 |
Store the confidential case list wherever your other restricted records live rather than in the folder the log sits in. Medical information arriving with the case does not belong in a personnel file either.
Retention, and Who Can Demand a Copy
You keep the 300 log, the 300A summary, the 301 incident reports and the privacy case list for five years following the end of the calendar year those records cover (29 CFR 1904.33). In practice that means six years of files sitting in the cabinet at any given moment.
During those five years the log is the only one of the four with a live maintenance duty. If a recordable case surfaces late, or a case turns out to belong in a different classification, you go back into the stored log and update it, crossing out or deleting what was there. The summary and the incident reports do not have to be updated, although you are free to do so.
Access rights are where the deadlines get short. A current employee, a former employee or their personal representative can ask for a copy of the 300 log for any establishment where that person worked, and you have to provide it by the end of the next business day with the names left on (29 CFR 1904.35). Their own 301 incident report comes on the same next-business-day deadline.
An authorized employee representative, typically a union, gets the 300 log by the end of the next business day as well, but only the part of the 301 that describes the case, and within seven calendar days rather than one. The first copy in each case is free, and you may charge reasonable retrieval and copying costs for further copies.
Underneath all of this sits a requirement that gets almost no attention. You must have a reasonable procedure for employees to report injuries and illnesses promptly, tell each employee what it is, and tell them they have the right to report without being retaliated against. A procedure that would deter a reasonable employee from reporting is not reasonable, which puts discipline schemes and safety bonus programs tied to injury counts on dangerous ground.
Where Small Employers Get This Wrong
Nine patterns account for nearly every recordkeeping problem I have seen, and none of them involve anybody trying to hide an injury.
Using average headcount for the size exemption is first. The test is ten or fewer at all times during the previous calendar year, company-wide, so a summer of eleven people ends the exemption for the following year.
Treating the industry exemption as company-wide is second. It applies establishment by establishment, so a company with an exempt office and a non-exempt warehouse keeps a log for the warehouse.
Equating no lost time with not recordable is third, and it is the one that caught me. Medical treatment beyond first aid, restricted duty, and loss of consciousness are each criteria on their own, with no time away required.
Deferring to the clinic is fourth. A discharge note saying first aid only is clinical shorthand rather than a recordability determination, and the decision belongs to you, made against the closed list in the regulation.
Waiting for the workers compensation claim is fifth. The seven-day clock does not pause for a claim decision, and the two systems use different tests, so the outcome of the claim tells you very little about the log.
The wrong signature on the 300A is sixth. A safety coordinator, an office manager or an outside consultant certifying the summary in that capacity is not a company executive within the meaning of the rule.
Skipping the zero summary is seventh, and it produces a citation with no injury behind it. Miscounting days is eighth: calendar days, starting the day after, with 180 as the most you need to count.
And never revisiting a stored log is ninth. The duty to update runs for the full five years, which is why the annual review before the summary is worth doing properly rather than transferring totals mechanically.
Beyond those nine, check whether your state runs its own OSHA program. Twenty-two OSHA-approved state plans cover private sector employers alongside state and local government workers, and seven more jurisdictions cover state and local government workers only, which leaves private employers in those seven under federal OSHA (OSHA State Plans).
A state plan must be at least as effective as the federal program, and it may go further. Additional recordkeeping and reporting requirements are permitted, including different reporting phone numbers and in some cases broader triggers, so check your own state before assuming the federal rules are the whole picture.
One part of this cannot vary: the recording test itself. Every state plan must use the federal criteria for which injuries and illnesses are recordable and how they are recorded (29 CFR 1904.37), so the recordability tests and the first aid list in this guide apply in every state.
Frequently Asked Questions
Who is exempt from keeping the OSHA 300 log?
Two separate partial exemptions exist, and meeting either one is enough. The size exemption applies if your company had ten or fewer employees at every point in the previous calendar year, counting everyone across all locations instead of site by site. The industry exemption applies to an establishment whose NAICS code appears in Appendix A to Subpart B, however many people work there, and it is judged location by location. Exempt does not mean off the hook entirely. You still have to phone OSHA when someone dies, is admitted to a hospital as an in-patient, has an amputation or loses an eye, and you still have to keep records when either OSHA or the Bureau of Labor Statistics asks you to in writing. The safety standards themselves keep applying too.
What is the difference between OSHA Forms 300, 300A and 301?
The 300 is the running log, kept once per establishment, with a line for each recordable case covering the employee, date, location, a short description, how the case was classified and the day counts. The 301 is a separate report filled out for every case, and it holds what the log cannot: the employee’s activity beforehand, how the incident unfolded, the object or substance involved and where treatment happened. You complete both within seven calendar days after you learn a recordable case occurred. The 300A is the yearly summary of the log’s totals together with average employment and hours worked. A company executive certifies it before it is posted from February 1 through April 30 of the following year. Employees and their representatives can ask to see the 300 and the 301, but only the 300A is posted unprompted.
Is an injury recordable if the employee only received first aid?
No, as long as first aid is the only care given and no other recording criterion applies. The regulation treats first aid as a fixed, closed list rather than a judgment call, so any item on it counts as first aid regardless of who gives it or where. The list covers over-the-counter medication at over-the-counter strength, tetanus shots, cleaning and flushing surface wounds, bandages and butterfly closures, hot or cold therapy, elastic wraps and other non-rigid supports, immobilizing a person solely for transport, draining a blister, eye patches, irrigating or using a cotton swab to remove foreign bodies from the eye, using simple means such as tweezers to remove splinters from other areas, massage, finger guards, and drinking fluids to relieve heat stress. Anything beyond that list is medical treatment. Even one dose of prescription medication counts, whether or not the employee takes it, and so do stitches and a rigid splint applied as treatment rather than for transport.
When do you have to post the OSHA 300A summary?
From February 1 through April 30 of the year after the one the records cover. It goes up at each establishment, wherever you usually put notices for employees. Three points catch employers out. First, a year with no recordable cases still needs a posted summary, with zeros in the totals; having nothing to report is not a reason to skip it. Second, certification comes before posting, and only four kinds of person can do it: a corporate officer, the most senior company official working at that establishment, that official’s immediate supervisor, or an owner when the business is a sole proprietorship or partnership. A safety coordinator or office manager acting on their own authority does not count. Third, removing the summary early is a violation of its own, and April 30 runs to the end of the day.
Does a small business have to submit OSHA forms electronically?
Most do not, but the test is about the establishment rather than the company, and it turns on both size and industry. An establishment with peak employment of nineteen or fewer during the previous calendar year submits nothing unless OSHA notifies it by mail of a specific data collection. An establishment with twenty to two hundred and forty-nine employees submits Form 300A only if its industry appears in Appendix A to Subpart E. An establishment with two hundred and fifty or more employees submits Form 300A unless its industry is partially exempt under Appendix A to Subpart B. An establishment with one hundred or more employees in an industry listed in Appendix B to Subpart E submits data from Forms 300 and 301 as well as the 300A. The deadline is March 2 of the following year, filed through the Injury Tracking Application, and a missed deadline can still be filed until December 31.
How long do you have to keep OSHA 300 logs and 301 forms?
Five years, counted from the end of the calendar year each record covers. This applies to the 300 log, the 300A summary, the 301 incident reports and the confidential privacy case list, which is a longer stretch than most employers expect. The log is the one record you must actively maintain during that time. If you find a recordable case you missed, or a case moves to a different classification, you open the stored log and correct it. Summaries and incident reports need no updates, though you may make them. If you buy a business, the duty to preserve its records for whatever remains of the five years passes to you, and the seller must hand them over.
Can employees see the OSHA 300 log?
Yes, and you have little time to respond. Current and former employees, and anyone acting as their personal representative, can ask for the 300 log covering any site they worked at, and you must give them a copy, names included, by the close of the next business day. Their own 301 incident report carries that same one-day limit. A union or other authorized employee representative also gets the 300 log by the end of the next business day, but only the portion of the 301 that describes the case, and for that portion you have seven calendar days rather than one. The first copy is free. Separately, you must explain to employees how to report an injury and tell them they will not be retaliated against for doing so.
Does recording a case mean admitting the injury was your fault?
No. The regulation states plainly that entering a case on the log is not an admission of fault, of a violation, or of eligibility for workers compensation benefits. OSHA’s recording tests and state workers compensation systems measure different things, so the outcomes can diverge in either direction. A claim can be denied while the case still has to be logged, since recording depends on work-relatedness and on the treatment given, not on whether the claim is compensable. And a claim can be paid on a case that was never recordable, because first aid alone does not meet the criteria. Holding off on an entry until the claim is decided is among the most frequent reasons employers miss the seven-day deadline, and it leaves you with a log that is late instead of accurate.
Make HR the easy part of running your business
Onboarding, e-signatures, training and core HR in one place. Up and running in 5 minutes.
- 7-day free trial
- No credit card required
- Cancel anytime