The final rule that will require some establishments to electronically submit OSHA record keeping data has been unleashed. And, it's not evil; complying with it shouldn't ruin anyone's day. The final rule is less stringent than the proposed rule had originally planned it to be.

OSHA's final rule went into effect January 1, 2017. The first batch of data (year 2016 data) was originally scheduled to be due by July 1, 2017. However, OSHA didn't develop its electronic data submission mechanism by the July 1 deadline, so December 1 is most likely going to be the new deadline. Click here for more about that. Year 2017 data is scheduled to be due by July 1, 2018. Beginning in 2019 (2018 data), the deadline will be moved up to March 2. There are no changes to the requirements regarding OSHA record keeping responsibilities (though some were reiterated); nothing has changed except that some employers will be submitting data electronically.

Scroll beyond the downloads to review the summary in full detail, or click one of the following to jump to a specific section:


Clicking on a download will open a new browser window where you can view and/or download. You may freely circulate these.

  • Summary of OSHA's New Record Keeping Rule - The majority of the text on this final rule web page was copied from this document; the four-page PDF is a handier and more portable version of the information found on this page.
  • PowerPoint of the Final Rule - May be freely presented, distributed, and shared by individuals, corporations, and safety and environmental associations that do not charge for attendance. Commercial use ist verboten (ja wohl!) and subject to U.S. copyright laws.
  • Final Rule - This is the complete 273 page final rule PDF, for your complete reading enjoyment! If you only want to know what the new rule requires and how it affects you, then view the summary.
  • List of High Hazard Industries - This is the new rule's list of "high hazard industries," identified by NAICS code. This is important because any establishment (with 20 to 249 employees) in this industry list will be required to electronically submit the OSHA 300A annually.


There are two groups of business establishments that are required to submit data. The first group includes establishments with 250 or more employees. The second group includes establishments with 20 to 249 employees, but only in industries identified by the final rule as "high hazard."

Please note that the employee number "triggers" are based on employees at a particular ESTABLISHMENT, and NOT the total number of employees company-wide. An establishment is any physical location in operation for at least a year. Two examples follow.

ABC Company has 300 employees, all operating at one location; ABC is obviously required to submit data. But, assume that XYZ Corporation also has 300 employees, but three physical locations, and that 100 employees are assigned to each location. Is XYZ required to submit data? No. The size of the establishment triggers data submission, not the total size of the corporate workforce. This treatment is in line with the 1904 standard's existing requirement that instructs us to record injuries and illnesses by establishment. While many multi-location businesses create aggregate company-wide 300A summary forms combining data from all of their establishments, they are not required to do so. And, they will not be required to electronically submit composite company-wide data. This is a good thing; a great deal of data would otherwise be submitted twice and therefore skew the collected data.

This aforementioned establishment treatment also applies to those with 20 to 249 employees; 50 employees in one location triggers data submission, while five employees each at 10 locations means no data submission for any of them. Please note that data submission is not required for ALL establishments with 20 to 249 employees, as is the case with establishments of 250 or more employees. For this smaller group, only those in high hazard industries (classified by NAICS code and characterized by historical incident rates) are required to submit data. The list of high hazard industries will NOT change every year. The final rule does say that the list may change, but any changes would require a further rulemaking process, so I don't anticipate this list changing very often.

Also, from time to time, OSHA will request "special purpose" data submission. OSHA may want to collect data from all establishments with a particular NAICS code, for example residential roofing contractors. Or, it may want to collect data for all establishments involved with handling infectious materials. Any establishments that meet a special purpose data collection initiative will receive written notification from OSHA, so there will be no surprises. Please note that these special purpose data initiatives will even apply to establishments that are not otherwise required to submit data; in these cases, even establishments with just 15 employees will be required to take part in the particular special purpose data collection effort.


Establishments with 250 or more employees are required to submit data from the OSHA forms 301 (incident report), 300 (log) and 300A (summary). Please note that for the first submission year, 2017, only the 300A data will be submitted; data from the 301 and 300 will be required beginning in 2018. This phase-in scheme is undoubtedly due to the unprecedented volume of data that OSHA is going to be receiving in 2017 when it becomes operational, and the fact that the system won't have been combat proven yet. It will be a far easier task to work the bugs out of a system that isn't completely inundated with data the very first time it's used.

Establishments of 20 to 249 employees, in high hazard industries, are required to submit only the 300A.

Data will be submitted annually. This is great news; the proposed rule called for quarterly submission of data. During the comment period of the rulemaking process, interested citizens and industry groups voiced their concerns; many of them were not thrilled with the idea of submitting quarterly data, mostly on logistical grounds. And, the folks at OSHA listened, and ultimately agreed. I have always encouraged business leaders to participate in the rulemaking process by submitting their ideas during the comment period, and this is why; OSHA takes our concerns seriously.


The first batch of data (year 2016 data) was originally scheduled to be due by July 1, 2017. However, OSHA didn't develop its electronic data submission mechanism by the July 1 deadline, so December 1 is most likely going to be the new deadline. Click here for more about that.

In 2018, establishments with 250 or more employees will be required to submit data from their 2017 301 incident report and 300 log, along with the 300A, by July 1.

Beginning in 2019, the submission deadline will be moved up to March 2 for all establishments required to submit data. Since this will still be a full month past the requirement to post the 300A summary form in the workplace, there shouldn't be any reason for not submitting the data on time.


Personally identifiable information will NOT be collected. All of the information on the 300A summary form will be collected; there is nothing of a personal nature. The 300 log form will omit employee names. The 301 incident report form will omit data from the entire left side of the form (fields one through nine). Since personally identifiable info will not be collected, employee privacy should prevail.

Also, the final rule says that the electronic data collection system will include safeguards to ensure that inadvertently submitted personally identifiable information is not collected. For example, it's possible that a person may mistakenly include information of this nature on the 300 log - the record keeper could indicate "Bob had three stitches" in the brief description field for the case. OSHA is intending to implement a system that will scrub Bob's name in such a case.


All collected data, minus the aforementioned personally identifiable information, will be publicly available on the OSHA website. This data will be available for all interested parties to see, as is currently the case for an employer's OSHA violation history.


OSHA calls it the Injury Tracking Application (ITA). It's a very simple website to use. Users create an account like they would on any other site that would call for a username and password. Select a username and provide your basic information. Then, OSHA will email you. Once you verify it's you, continue with account set up.

Once the account is setup, you'll find that the process to report your data is ridiculously easy. You create entries for establishments. And, then you enter respective 300A data (300 and 301 data starting in 2018 for establishments with 250 or more employees). There are also options to upload Microsoft Excel .csv files, but I recommend manual entry for ease of use.

I cannot emphasize how easy the ITA is to use. The only difficulty in the whole process will be determining whether cases should (or should not be) recorded on the record keeping forms in the first place. If you have any doubts about your record keeping forms, please email or call and we'll figure it out.


The greatly increased volume of data that OSHA will receive will be of great value from an occupational injury and illness epidemiology standpoint. Whether OSHA, injury epidemiologists and various other safety number crunchers, and the general public at large, will be able to succeed in utilizing this data won't be known for years.

And, now for the million dollar question... Will OSHA also use this data specifically to target establishments and/or entire industries with high incident rates? YES. The final rule states that it will be used to enhance OSHA's enforcement efforts, and there is no reason why it would not. Again, it will be years before we'll know whether OSHA has succeeded in this regard.

OSHA has utilized incident rates to dial in enforcement activity for years; this door is already wide open. There are various enhanced enforcement programs that are at least partly based on incident rates. For example, due to the National Emphasis Program for excavation activity (a very high hazard activity), any trench can be inspected without OSHA first having observed an imminent danger situation or receiving a complaint or referral. Just having a worker in a trench can trigger an inspection. If incident rates weren't so high for excavation work, this wouldn't be the case. There are quite a few national, regional, and local emphasis programs! Other initiatives, such as Site-Specific Targeting, also resulted in inspections opened on account of incident rates.


The new rule also restates some existing requirements. Employers can't retaliate against employees for reporting injury and illness cases and must inform employees of their right to report such cases (free of retaliation). And, the employer's reporting procedure must be reasonable and not discourage reporting. There is nothing new here and therefore no new burden on employers has been created.

One may wonder why the federal government is spending our tax dollars on creating new rules with provisions that simply restate existing ones. OSHA believes that restating and re-clarifying existing requirements will persuade non-compliant employers to finally get with it. Of course, this is wishful thinking. The only employers not already complying with these requirements are owned and operated by those who truly don't care about employee safety and health, who can't be expected to begin complying just because a rule has been restated.