Every February 1, a quiet ritual plays out in break rooms, warehouse offices, and back-of-house corridors across America: a manager prints a single piece of paper, tapes it to a corkboard, and walks away. That piece of paper is OSHA Form 300A — the Annual Summary of Work-Related Injuries and Illnesses — and forgetting to post it is one of the most common recordkeeping citations OSHA writes. The penalty for a single missed posting now exceeds $16,000 per violation, and the agency increasingly chains recordkeeping failures into willful or repeat findings that climb past $160,000 per item.
The recordkeeping rules under 29 CFR Part 1904 have been on the books since 2001, but the past three years have brought the biggest changes in two decades. The 2024 final rule expanded electronic submission to require Forms 300 and 301 — not just the 300A summary — for establishments with 100 or more employees in designated high-hazard industries. The Injury Tracking Application (ITA) now publishes establishment-level data in a searchable public database. And the agency's enforcement focus has shifted toward audits of the underlying recordability decisions, not just the paperwork.
If you operate a construction firm, manufacturer, warehouse, hospital, restaurant, retail chain, or any other workplace with more than 10 employees, this guide will walk you through what to record, when to record it, who has to submit electronically, and how to build a recordkeeping program that survives the OSHA Compliance Safety and Health Officer (CSHO) who knocks on your door.
What the Three Forms Actually Do
OSHA's recordkeeping system rests on a three-form architecture, and confusing the forms is the most common source of compliance errors.
Form 300 is the rolling log. Every recordable work-related injury and illness during the calendar year gets one line. The log captures the case number, the employee's name (with privacy-case substitutions), the job title, the date of injury or illness, where the event occurred, a description of the injury, the outcome classification (death, days away, restricted work, other recordable), and the number of days away or restricted.
Form 300A is the annual summary. At the end of each calendar year, you total the cases from the Form 300 log into the 300A summary by case type and by injury or illness classification, sign it under penalty of perjury, and post it from February 1 through April 30 in a conspicuous workplace location. The 300A is the form your employees, former employees, and their representatives have a right to see.
Form 301 is the incident report. For each recordable case, you must complete a Form 301 (or an equivalent form like a workers' compensation first report of injury) within seven calendar days of receiving information that a recordable injury or illness occurred. The 301 captures the case detail: who, what, where, when, how the injury happened, the object or substance that directly harmed the employee, and the body part affected.
You may use OSHA's forms or any equivalent that captures the same information with the same level of detail. Most modern EHS software, HRIS platforms, and workers' compensation carriers offer integrated 300/300A/301 modules.
Who Has to Keep Records
The basic rule is straightforward: if you had more than 10 employees at any point during the previous calendar year and your establishment is not on the partial-exemption list, you must keep Part 1904 records. Headcount is measured across all establishments and all employees of the employer, including part-time, temporary, and seasonal workers — not establishment by establishment.
The 10-or-fewer exemption. Employers who had 10 or fewer employees across the entire enterprise at any point in the prior calendar year are partially exempt from routine recordkeeping. They must still report fatalities and severe injuries under § 1904.39, and they must keep records if OSHA, BLS, or a state agency asks them in writing to do so.
The partial industry exemption. Establishments classified in certain low-hazard NAICS codes listed in Non-Mandatory Appendix A to Subpart B are partially exempt from routine recordkeeping. The list includes most retail trade; finance, insurance, and real estate; legal, accounting, and consulting services; advertising agencies; medical and dental offices; museums; and many other office-based industries. The classification is by establishment, not by employer — so a manufacturer with a separate corporate headquarters establishment may have to keep records for the plant but not the office. The list is based on 2007 NAICS codes, so if your industry's code has been renamed or restructured, the exemption follows the historical classification.
Critically, the partial exemption does not relieve you of the duty to report fatalities, in-patient hospitalizations, amputations, or losses of an eye to OSHA under § 1904.39, no matter how small your headcount or how exempt your industry.
The Recordability Decision Tree
Most recordkeeping mistakes are not paperwork errors — they are recordability judgment errors. The recordability test under §§ 1904.4 through 1904.7 is a decision tree, and every line on the Form 300 begins with the same four questions.
Step 1: Did an injury or illness occur? A bruise, a strain, a cut, a hearing-threshold shift, a positive bloodborne pathogen test, a diagnosed mental illness with work-related causation — anything that affects a worker's body counts.
Step 2: Is the case work-related? Under § 1904.5, an injury or illness is work-related if an event or exposure in the work environment either caused or contributed to the condition, or significantly aggravated a pre-existing condition. Work-relatedness is presumed for events that happen in the work environment unless one of the nine specific exceptions in § 1904.5(b)(2) applies — voluntary participation in wellness programs, eating personal food, common colds and flu, motor vehicle accidents in employer parking lots while commuting, and a few others.
Step 3: Is the case a new case? Under § 1904.6, a case is new if the employee has not previously experienced a recorded injury or illness of the same type affecting the same body part, or if the employee fully recovered from a previous case and a new event or exposure caused the signs and symptoms to reappear.
Step 4: Does the case meet one or more general recording criteria under § 1904.7? Record the case if it resulted in any of the following:
- Death — fatality
- Days away from work — calendar days the employee could not work
- Restricted work or transfer to another job — light duty, modified duty, or temporary reassignment
- Medical treatment beyond first aid — see the first-aid list below
- Loss of consciousness
- Significant injury or illness diagnosed by a physician or other licensed health care professional — broken bones, cancer, chronic irreversible disease, punctured eardrum, even without lost time or medical treatment
The first-aid line is where most cases turn. OSHA's exhaustive first-aid list in § 1904.7(b)(5)(ii) includes nonprescription medication at nonprescription strength, tetanus immunizations, cleaning and bandaging surface wounds, hot or cold therapy, non-rigid means of support like elastic bandages, drilling of fingernails or toenails to relieve pressure, eye patches, removing foreign bodies from the eye with irrigation or a cotton swab, removing splinters by simple means, finger guards, massages, and drinking fluids for heat stress. Anything beyond this list — including prescription medication, sutures, rigid splints, physical therapy beyond a single visit, or chiropractic treatment — qualifies as medical treatment and triggers recordability.
DART, TRIR, and Case Classification
Once a case is recordable, you classify it on the Form 300 in one of four mutually-exclusive columns: death (G), days away (H), job transfer or restriction (I), or other recordable (J). The classification drives two of the most-watched safety metrics in American business.
Days Away, Restricted, or Transferred (DART) Rate is calculated as (Column H + Column I) × 200,000 ÷ Total Hours Worked. The 200,000 multiplier represents the equivalent of 100 full-time employees working 40 hours per week for 50 weeks. A DART rate of 3.0 means three DART cases per 100 full-time-equivalent workers per year.
Total Recordable Incident Rate (TRIR) uses the same formula but includes all recordable cases (G + H + I + J). TRIR is the headline metric most general contractors, project owners, and ISN/Avetta-style supplier qualification platforms benchmark against industry NAICS averages.
Three classification rules trip up new recordkeepers:
- Day counts. Count calendar days, not workdays. Cap the day count at 180 calendar days per case — if the employee remains off or restricted longer than that, enter 180 and stop counting.
- Job transfer vs. restricted work. Restricted work means the employee cannot perform one or more routine functions or works fewer than full duty hours; job transfer means the employee is assigned to a different job for at least one day. Both go in Column I.
- Day of injury. The day of injury is never counted as the first day away or restricted, even if the employee left work and never returned.
Privacy Cases
Under § 1904.29(b)(6)–(10), certain cases must be entered on the Form 300 without the employee's name. Substitute "privacy case" or "PC" in the name column and keep a separate confidential list of case numbers linked to names, accessible only to those with a need to know.
Privacy cases include:
- Injuries or illnesses to an intimate body part or the reproductive system
- Injuries or illnesses resulting from a sexual assault
- Mental illnesses
- HIV infection, hepatitis, or tuberculosis
- Needlestick injuries and cuts from sharp objects contaminated with another person's blood or other potentially infectious material
- Other illnesses, if the employee independently and voluntarily requests that the name not be entered
When you make the Form 300 available to employees, former employees, or their representatives, you must also redact descriptions that could identify the employee in privacy cases.
Annual Posting and Five-Year Retention
The Form 300A annual summary must be reviewed, certified by a company executive (owner, officer of the corporation, highest-ranking establishment official, or immediate supervisor of the highest-ranking official), and posted from February 1 through April 30 each year in each establishment where employees ordinarily report to work. If employees do not report to a fixed establishment — think traveling sales reps or remote field crews — post it where employees receive their assignments.
You must retain the Form 300, 300A, and 301 records for five years following the end of the calendar year they cover, and you must update the Form 300 to reflect any changes that occur during that retention period (newly discovered cases, changes in classification, day-count adjustments).
Electronic Submission Through the ITA
The Injury Tracking Application (ITA) at www.osha.gov/injuryreporting is OSHA's secure electronic submission portal. Submissions are due annually between January 2 and March 2 for the prior calendar year's data. OSHA does not accept paper forms by mail or email — electronic submission through the ITA is the only compliant method.
Form 300A submission is required if your establishment had either:
- 250 or more employees at any time during the previous calendar year and is not on the Appendix A partial-exemption list, or
- 20 to 249 employees at any time during the previous calendar year and is in an industry listed in Appendix A to Subpart E of 29 CFR Part 1904
Form 300 and Form 301 submission is additionally required under the 2024 expanded rule for establishments with 100 or more employees in industries listed in Appendix B to Subpart E — the high-hazard NAICS list. Appendix B captures industries including general medical and surgical hospitals, nursing care facilities, residential care, warehousing and storage, couriers, agriculture, certain manufacturing sectors, beverage manufacturing, animal slaughtering and processing, and many construction trades. If your establishment is in Appendix B and crosses the 100-employee threshold, you must submit detailed case-level data for every recordable injury and illness from the prior year.
The ITA accepts three submission methods: manual entry via a web form, CSV batch upload for multiple establishments, and API integration for EHS software users. OSHA publishes establishment-level submission data in a public searchable database — your DART and TRIR will be visible to project owners, prime contractors, supplier qualification platforms, and competitors.
If you miss the March 2 deadline, you can still submit through the ITA through December 31 of the same year, and OSHA strongly encourages late submission. Failing to submit at all exposes you to citation under § 1904.41.
Severe Injury Reporting Under § 1904.39
Recordkeeping and reporting are separate obligations. Even partially exempt employers must report severe events directly to OSHA:
- Fatalities — within 8 hours of the death, if the fatality occurs within 30 days of the work-related incident
- In-patient hospitalizations of one or more employees — within 24 hours of the hospitalization, if it occurs within 24 hours of the work-related incident
- Amputations — within 24 hours, even if reattached or only a partial amputation
- Loss of an eye — within 24 hours
Report by calling the OSHA Area Office, calling the 24-hour hotline at 1-800-321-OSHA, or using the online reporting application at www.osha.gov/report. In-patient hospitalization means a formal admission to the in-patient service for care or treatment — observation or diagnostic testing alone does not trigger reporting.
Severe-injury reports are public information and frequently trigger programmed inspections under OSHA's Severe Injury Reporting program.
Anti-Retaliation and Employee Access Rules
Section 1904.35 gives employees, former employees, their personal representatives, and authorized employee representatives broad rights of access to recordkeeping data. Employees and their representatives must be allowed to access the Form 300 log (with privacy-case names redacted) by the end of the next business day after the request. Form 301 incident reports must be provided to the affected employee by the end of the next business day, and to others within seven calendar days with personal identifiers redacted.
OSHA's anti-retaliation rule under § 1904.35(b)(1)(iv) prohibits any policy or procedure that would discourage employees from reporting work-related injuries and illnesses. The agency has used this section to challenge:
- Blanket post-accident drug testing programs that are not tied to a reasonable possibility that drug use contributed to the incident
- Safety incentive programs that reward zero-injury periods in ways that pressure employees not to report
- Mandatory immediate reporting policies that punish employees for delayed reporting when the injury did not manifest until later
Document your reporting procedures, train supervisors to encourage reporting, and audit your incentive and disciplinary practices for chilling effects.
State Plan Variations
Twenty-two states operate OSHA-approved State Plans that cover private-sector employers, and several have recordkeeping requirements that go beyond the federal rule. Two examples worth knowing:
- California (Cal/OSHA, Title 8 § 14300 series). California requires reporting of any serious injury or illness, defined to include any injury requiring in-patient hospitalization for a period in excess of 24 hours for other than medical observation. California also expanded the reporting timeline trigger and removed some of the federal exceptions.
- Michigan and Washington maintain similar but not identical recordkeeping rules, including different severe-injury reporting thresholds and additional state-specific posting requirements.
If you operate across multiple states, build a compliance matrix that tracks the state-by-state delta from the federal baseline. The ITA submission is federal-only — state-plan states may require additional or parallel submissions to the state agency.
Building an Audit-Defensible Recordkeeping Program
Recordkeeping citations under § 1904 carry a five-year look-back window — the period during which you must retain the records — and OSHA can review every Form 300 line item for accuracy during an inspection. Build a program that survives audit by following four practices.
1. Centralize recordability decisions. Train one or two designated recordkeepers (HR, safety, or workers' comp lead) to apply the § 1904.7 criteria consistently. Document every recordability determination — including the cases you decide not to record and why — in a working file tied to the case number. Inconsistent classification across cases is the single biggest finding in recordkeeping audits.
2. Reconcile against workers' comp and first-aid logs monthly. Every workers' compensation claim should be evaluated for recordability. Every first-aid log entry should be reviewed against the § 1904.7(b)(5) first-aid definition. Cases that show up in workers' comp but not on the Form 300, or that escalated from first aid into medical treatment, are how OSHA finds gaps during inspections.
3. Update day counts and classifications. Day counts often change after the initial entry. If a case starts as restricted work and the employee later goes out on lost time, update the Form 300 columns. If a case starts as days-away and the employee dies of the injury within 30 days, reclassify to a fatality. Maintain a change log.
4. Map your Appendix A and Appendix B status. Pull your NAICS code on a per-establishment basis. Confirm whether each establishment is partially exempt under Appendix A and whether it falls into Appendix B for expanded electronic submission. Re-verify when establishment headcount crosses 20, 100, or 250 — those are the trigger thresholds.
How Recordkeeping Connects to Your Books
Accurate injury and illness records do more than satisfy OSHA — they drive workers' compensation premiums, general liability rates, and the experience modification rate (EMR) your insurance carrier uses to price your policy. Every recordable case feeds into the calculation, and a single misclassified DART case can shift your EMR enough to change a project bid.
Tie your safety records into your financial books with a consistent ledger structure. Track workers' comp premiums, deductibles, and self-insured retention separately from general health and benefits expense. Build an account for OSHA-related professional fees — training, safety consulting, ITA submission software — so you can see the true cost of compliance. Reserve estimates for known but unsettled workers' comp claims belong in a contingent-liability account that ties back to the Form 300 case log. When your auditor asks why the reserve moved year over year, you should be able to point to the underlying claims.
For multi-state employers, segment safety-related expense by state of operation. State Plan filing fees, state-specific reporting platforms, and state-mandated safety committee meetings vary widely, and that variance shows up in unit-economics calculations for jobs in higher-cost compliance states.
The Most Common Citation Patterns
OSHA's enforcement priorities have been consistent for years. The most-cited recordkeeping issues during programmed inspections and post-incident audits are:
- § 1904.32 — Failure to complete or post the Form 300A summary by February 1
- § 1904.29 — Failure to record an injury or illness within seven calendar days of receiving information
- § 1904.41 — Failure to electronically submit data through the ITA
- § 1904.7 — Misclassification of a recordable case as first aid or non-recordable
- § 1904.4 — Failure to record a work-related injury or illness when the recordability criteria were met
- § 1904.35 — Retaliating against an employee for reporting an injury or maintaining policies that discourage reporting
Penalties under the inflation-adjusted schedule reach $16,131 per serious or other-than-serious violation and $161,323 per willful or repeat violation as of the 2025 adjustment, with annual upward adjustments. A single inspection that uncovers a year's worth of unrecorded cases, an unposted 300A, and a missed ITA submission can stack into a six-figure proposed penalty.
Keep Your Compliance and Financial Records Aligned
As you build out your OSHA recordkeeping program, the principles that make it audit-defensible — centralized decision-making, consistent classification, monthly reconciliation, durable retention — apply equally to your financial records. Beancount.io provides plain-text accounting that gives you complete transparency and a verifiable audit trail across workers' comp premiums, safety training expense, EHS software costs, and reserve estimates. Your books live as readable text, version-controlled in Git, and queryable in plain English — no black boxes when the auditor asks how the numbers came together. Get started for free and bring the same discipline to your financial recordkeeping that OSHA expects of your injury and illness records.