OSHA's recordkeeping regulations — codified in 29 CFR 1904 — require most employers to track and report work-related injuries and illnesses. For employers who aren't compliance specialists, the rules can feel opaque. This guide breaks down who must comply, what forms are required, and what timelines apply.
Who Must Comply with OSHA Recordkeeping?
Two categories of employers are exempt from routine OSHA recordkeeping requirements:
- Small employers: Employers with 10 or fewer employees at all times during the previous calendar year are exempt from maintaining injury and illness records (though they must still report severe injuries)
- Low-hazard industries: Employers in certain industry classifications (NAICS codes) with historically low injury rates are partially exempt. These include many retail, finance, insurance, real estate, and professional service sectors.
If you have 11 or more employees and operate in a non-exempt industry, OSHA recordkeeping applies to you. Note that even exempt employers must report work-related fatalities, hospitalizations, amputations, and losses of an eye directly to OSHA.
Being partially exempt from recordkeeping does NOT exempt you from OSHA's general duty clause or safety standards. It only means you are not required to maintain injury logs under 29 CFR 1904.
The Three OSHA Recordkeeping Forms
OSHA 300 — Log of Work-Related Injuries and Illnesses
The OSHA 300 is your running record of all recordable work-related injuries and illnesses throughout the year. Each recordable incident gets its own row, documenting:
- Case number and date of injury
- Employee name, job title, and work department
- Where the event occurred and brief description of the injury
- Classification: days away from work, restricted/transfer, other recordable
- Number of days away from work or days of restriction/transfer
- Injury type: injury, skin disorder, respiratory condition, poisoning, hearing loss, all other illness
The OSHA 300 must be updated within seven calendar days of learning that a recordable injury occurred. The log must be retained for five years.
OSHA 300A — Summary of Work-Related Injuries and Illnesses
The OSHA 300A is an annual summary of the totals from your OSHA 300 log. Key requirements:
- Must be completed and certified by a company executive (owner, officer, or senior executive)
- Must be posted in a visible workplace location from February 1 through April 30 each year
- Must be posted even if there were zero recordable incidents (post the form with all zeros)
- Must be retained for five years
OSHA 301 — Injury and Illness Incident Report
The OSHA 301 is an individual incident report completed for each recordable case on the OSHA 300. It documents more detail about how the injury occurred, the circumstances, and the treatment provided. Many workers' comp First Report of Injury forms serve the same purpose and may be used as a substitute if they contain equivalent information.
The OSHA 301 must also be retained for five years and must be made available to employees, former employees, and their representatives upon request within four business hours.
Reporting Timelines
There are two distinct reporting timeframes under 29 CFR 1904:
- Recordkeeping (OSHA 300/301): Update within 7 calendar days of learning about a recordable injury
- Severe injury reporting to OSHA:
- Work-related fatality: report to OSHA within 8 hours
- In-patient hospitalization of 1 or more employees: report within 24 hours
- Amputation: report within 24 hours
- Loss of an eye: report within 24 hours
Severe injury reports can be made by calling OSHA directly (1-800-321-OSHA) or online through OSHA's website. Failure to report within these timelines can result in separate citations and penalties.
Electronic Submission Requirements
OSHA's Injury Tracking Application (ITA) requires certain employers to submit their injury and illness data electronically. Under the current rule:
- Establishments with 250+ employees in industries that must routinely keep records must submit their OSHA 300A data annually
- Establishments with 20–249 employees in designated high-hazard industries must submit OSHA 300A data annually
- Some high-hazard industries at any size may have additional submission requirements
Submission deadlines and industry lists are published on OSHA's website and update periodically. Check current requirements with your OSHA regional office or compliance consultant.
Employee Access Rights
Employees have specific rights regarding your recordkeeping forms:
- Employees, former employees, and their representatives must be given access to the OSHA 300 log within 4 business hours of a request
- Employees may request copies of the OSHA 301 for their own incident — which must be provided by the end of the next business day
- Employee names on the OSHA 300 may not be obscured when providing access to the log
Connection to Injury Response
Accurate recordkeeping requires accurate injury documentation from the moment of care. If you don't have clear records of exactly what treatment was provided at the time of injury, classification decisions become uncertain — and uncertain classifications tend to default to "recordable" under audit.
A structured injury response plan that includes documentation requirements from the first moment of care — what was treated, by whom, with what materials — creates the paper trail that supports accurate OSHA 300 entries. For employers who use on-site first aid response, the EMT or paramedic's care record provides exactly this documentation.
Frequently Asked Questions
What are the penalties for OSHA recordkeeping violations?
Serious OSHA violations can result in penalties up to $16,550 per violation (as of 2025, adjusted annually for inflation). Willful or repeated violations can reach $165,514 per violation. Recordkeeping violations — failing to record, failing to post, failure to provide employee access — are each separate potential citations.
Does OSHA verify our records?
Yes. OSHA inspectors routinely request OSHA 300 logs during inspections, whether programmed (industry targeting) or incident-triggered. OSHA also runs the Data Initiative, which collects electronically submitted data and can identify establishments with unusually low injury rates that may warrant verification.
Can we correct errors on the OSHA 300?
Yes. If you discover an error — an injury was incorrectly classified, a case should be added or removed — you should correct it promptly and document why the correction was made. The corrected log is the record of compliance, not the original entry.