Can Employees See the OSHA 300 Log? Access Rights Under 1904.35

An employee walks into HR and asks for a copy of the OSHA 300 Log. A union steward emails the safety manager requesting the logs for the whole plant. A former employee's attorney sends a letter asking for records of an injury from two years ago. Each of these is a legal request with a clock attached, and getting the answer wrong — refusing access, stalling past the deadline, or handing over the wrong form — is its own recordkeeping violation.

The rule that governs all of this is 29 CFR 1904.35, titled "Employee involvement." Most employers know it only as "the log-access rule," but it actually does two jobs. Half of it is about access: who can see your injury and illness records, how much of each record they get, and how fast you have to produce it. The other half is about the front end of recordkeeping — the duty to give employees a reasonable way to report injuries and to never punish them for doing so. Both halves are enforceable, and both are places small employers stumble.

This post walks through the access framework first — the 300 Log, the 300A summary, and where the 301 breaks the pattern — then the reporting-and-anti-retaliation half that shares the same section number.

The right of access, and who holds it

Section 1904.35(b)(2) gives four categories of requester the right to your injury and illness records:

• Employees — anyone currently employed at the establishment the records cover.
• Former employees — the right doesn't end when employment does.
• Personal representatives — under 1904.35(b)(2)(ii), a personal representative is (A) anyone the employee or former employee designates in writing, or (B) the legal representative of a deceased or legally incapacitated employee. That's how an attorney or a family member gets access: with a written designation, or by being the legal representative of a worker who has died or can't act for themselves.
• Authorized employee representatives — under 1904.35(b)(2)(i), this means an authorized collective bargaining agent. In practice, the union.

Notice who is not on this list. A random member of the public has no right of access under 1904.35. A prospective employer, an insurer, a journalist — none of them can invoke this rule. The right belongs to the workforce and the people who formally stand in for the workforce. (Government inspectors have access too, but under a different provision — 1904.40 — on a much faster four-hour clock. That's a separate obligation, not part of the employee-access framework.)

The 300 Log: the whole log, names included, by the next business day

This is the provision employers most often underestimate. Under 1904.35(b)(2)(iii), when any of the four requesters asks for a copy of your current or stored OSHA 300 Log for an establishment the employee is or was employed in, you must give them a copy by the end of the next business day.

Two things in that sentence do the work.

"The whole log." You don't get to hand over the requester's own line and redact everyone else's. The 300 Log is disclosed in full — every case, every employee's name — to any of the four requesters. This surprises employers who assume other workers' injuries are confidential. On the Log, they generally aren't. OSHA has been explicit that the access right covers the entire Log, including the names of both union and non-union employees. The Log was designed from the start as a shared, establishment-level record; the privacy protections are built in elsewhere, not by redacting the Log on request.

"Current or stored." The right isn't limited to this year's log. Under the five-year retention and update rule, you keep each 300 Log for five years after the calendar year it covers — and a requester can ask for any log still inside that window. A former employee asking about an injury from three years ago is entitled to that year's stored log, not just the current one. If your old logs are boxed up in a back office or buried in a shared drive, "next business day" is a tight deadline. Know where they are before someone asks.

The one thing you take off the Log

There is exactly one carve-out, and it isn't something you do at the moment of the request — it's already baked into the Log. Under 1904.35(b)(2)(iv), the copy you provide keeps the names on it, except for the cases where the employee's name should never have been on the Log in the first place: privacy concern cases under 1904.29(b)(6) through (9). For those cases — sexual assaults, HIV and certain other conditions, injuries to intimate body parts, and the rest of the enumerated list — you write "Privacy Case" in the name column instead of the name, and you keep a separate confidential list linking the case to the person. Because the name was never on the Log, the copy you hand out doesn't show it either. The full list of which cases qualify is in our post on privacy concern cases.

So the redaction isn't a step in the access process. It's a step in the recording process, and if you did it right when you logged the case, the access copy takes care of itself.

The 300A annual summary: access comes from posting

The 300A annual summary isn't handled inside 1904.35's request-and-produce machinery, because it's already a public-to-the-workforce document by design. Under 1904.32, you post the certified 300A in a conspicuous place from February 1 to April 30 every year, and for employees who don't report to a fixed location, you provide the summary to them another way. That posting duty is the 300A's access mechanism — it's handed to the whole workforce proactively, not on request. If you have employees who work remotely or travel between sites, don't assume the breakroom posting reaches them; you owe them the summary too. The mechanics of completing, certifying, and posting the 300A are covered in our 300A annual summary guide.

The 301 breaks the pattern — deliberately

Here's where employers get tripped up applying "the log rule" across the board. The 301 Incident Report is not disclosed like the 300 Log. Under 1904.35(b)(2)(v), an employee (or their written-designated personal representative) gets a copy of that employee's own full 301 by the end of the next business day — but a union asking for 301s gets only the "Tell us about the case" section, with everything else stripped, within seven calendar days.

That's the opposite posture from the Log, where the union is entitled to the entire thing, names and all. The Log defaults to full disclosure; the 301 defaults to maximum redaction for anyone but the injured worker. Applying the Log's generosity to the 301 — handing a union representative full 301s with names, addresses, and medical provider details — is a privacy breach and a citable error. We break down the whole 301 access differential in the OSHA 301 incident report.

No charge for the first copy

Under 1904.35(b)(2)(vi), you may not charge for these copies the first time they're provided. If the same requester comes back for additional copies of the same records, you may assess a reasonable charge for retrieval and copying — but the first copy is always free. Building a "records request fee" into your process, or refusing to produce until someone pays, is a violation on its own.

The other half of 1904.35: a reporting procedure that doesn't chill reporting

Access is only half of "Employee involvement." The other half, 1904.35(b)(1), is about making sure injuries get reported in the first place — because a log is only as accurate as the reporting behind it. This half was substantially rewritten in OSHA's 2016 "Improve Tracking of Workplace Injuries and Illnesses" rule, whose anti-retaliation provisions took effect for enforcement on December 1, 2016, and it imposes three concrete duties.

A reasonable reporting procedure (1904.35(b)(1)(i)). You must establish a way for employees to report work-related injuries and illnesses promptly and accurately. And the rule adds a test with teeth: "A procedure is not reasonable if it would deter or discourage a reasonable employee from accurately reporting a workplace injury or illness." A rule that says "all injuries must be reported immediately or you'll be disciplined" can fail this test, because an unrealistically rigid immediacy requirement discourages reporting of injuries that aren't obvious right away.

Informing each employee (1904.35(b)(1)(ii)–(iii)). You must tell each employee your procedure for reporting, and you must inform them that they have the right to report and that the employer is prohibited from discriminating against them for doing so. There's a shortcut here: posting the current OSHA "Job Safety and Health — It's the Law" worker rights poster (OSHA 3165, the April 2015 version or later) satisfies the duty to inform employees of their right to report free from retaliation. If your poster predates 2015, replace it.

No retaliation (1904.35(b)(1)(iv)). You must not discharge or in any manner discriminate against any employee for reporting a work-related injury or illness. This is the anti-retaliation core, and it's independent of the whistleblower statute in Section 11(c) — OSHA can cite a retaliatory act as a recordkeeping violation under 1904.35 directly.

Where drug testing and incentive programs fit

The 2016 rule set off years of confusion about whether post-incident drug testing and safety-incentive programs were now illegal, because OSHA's preamble suggested both could be retaliatory. In an October 11, 2018 memorandum, OSHA clarified its enforcement position, and that clarification is still the operative guidance:

• Post-incident drug testing is permissible in most forms. Random testing, testing required by a state workers' comp law or a federal rule (like DOT), and testing to investigate the root cause of an incident that harmed or could have harmed employees are all fine. What's not fine is using a drug test to punish an employee for reporting — testing one injured worker as a reflex while ignoring the root-cause question.
• Rate-based safety incentive programs — the "no injuries this quarter, everyone gets a bonus" model — are permissible as long as the employer has adequate precautions so employees feel free to report. Withholding a bonus because an injury was reported, with nothing else in place to encourage reporting, is where it crosses into retaliation.

The line OSHA draws: an action taken under a drug-testing or incentive policy violates 1904.35(b)(1)(iv) only if the employer took it to penalize reporting rather than to promote workplace safety. Program design is what keeps you on the right side of it.

The mistakes that generate citations

A handful of failure patterns account for most 1904.35 problems:

Refusing or slow-walking a 300 Log request. "Next business day" is not "when I get around to it." Missing the deadline, or refusing outright because the requester is a former employee or a union, is citable.

Over-redacting the Log. Blacking out other employees' names before handing over the Log is wrong — the Log discloses in full except for privacy concern cases already suppressed at recording time.

Under-redacting the 301. Handing a union representative full 301 reports instead of the "Tell us about the case" section only is the mirror-image error, and a privacy breach.

Charging for the first copy. The first copy is free, full stop (1904.35(b)(2)(vi)).

A reporting policy that chills reporting. Discipline-for-late-reporting rules, or an incentive program with no reporting safeguards, can be cited under 1904.35(b)(1) even if no one was overtly fired for reporting.

Recordkeeping violations like these are typically cited as other-than-serious, currently capped at $16,550 per violation, with willful or repeated violations reaching $165,514. Those are the 2025 ceilings carried into 2026 — the Department of Labor confirmed no 2026 inflation increase, because the CPI data the statutory calculation needs wasn't produced during the fall 2025 government shutdown. The broader set of citation-generating errors is covered in 5 OSHA recordkeeping mistakes that lead to citations.

LogStead keeps every record this rule reaches in one place: current and stored 300 Logs for each establishment, the 301 case files behind them, and the certified 300A summaries — so when an employee, a former employee, or a union representative asks, you can produce the right record, correctly scoped, without digging through boxes to beat a next-business-day deadline. Privacy concern cases are flagged when you record them, so the name never lands on a Log copy it shouldn't. If you're still deciding what belongs on the Log at all, the free recordability checker walks the case through OSHA's criteria first.

This post is general compliance information, not legal advice. Verify current regulatory text against eCFR and your state plan's requirements — state-plan states such as California, Washington, and Oregon may impose additional or more stringent access, reporting, and anti-retaliation requirements.