How Long Do You Have to Keep OSHA Records? The 5-Year Retention and Update-the-Log Rule

Somewhere in most small businesses there is a folder — or a drawer, or a shared drive — full of old OSHA logs that nobody has looked at since the year they were posted. The instinct is to treat them as closed files. File them, forget them, shred them when they get old enough. That instinct is half right. The records do have a shelf life, and you can throw them out eventually. But OSHA's retention rule, 29 CFR 1904.33, has a second half that catches employers off guard: some of those "closed" records aren't closed at all. You have a continuing duty to keep one of them current.

This is one of the easiest recordkeeping rules to comply with and one of the easiest to quietly violate, because nothing prompts you. There's no annual deadline, no posting period, no submission. The duty just sits there during the five years a record is on the shelf, and an inspector can ask about it at any point in that window. Here's exactly what you have to keep, for how long, and which record you're still on the hook to update.

The Five-Year Rule (1904.33(a))

The basic requirement is a single sentence. You must save four things for five years following the end of the calendar year that those records cover:

• The OSHA 300 Log for the year
• The privacy case list, if you had one (the confidential list of names you leave off the Log for privacy concern cases)
• The 300A Annual Summary for the year
• The OSHA 301 Incident Reports (or the equivalent forms) for every recordable case that year

Two details in that sentence do most of the work. First, it's all four records, not just the Log. The 301s — the detailed case files — get retained on the same clock, even though they're the documents employers are most likely to lose track of. Second, the clock starts at the end of the calendar year the records cover, not the date you created them or the date of the last incident.

So the math is straightforward once you anchor it correctly. Your 2026 records — the 2026 Log, its 300A, and the 2026 301s — cover calendar year 2026. The five-year clock starts December 31, 2026, and runs through the end of 2031. You can dispose of them in 2032. At any given time you should have the current year plus the five prior years on hand: in mid-2026, that means 2021 through 2026.

There's no requirement to store these off-site, in a vault, or in any particular format. Paper in a drawer is fine. A spreadsheet or a recordkeeping system is fine. What matters is that you can produce them — and we'll get to how fast you have to produce them at the end.

The Part Employers Miss: You Have to Keep the Log Alive

Here is the rule almost nobody internalizes. Under 1904.33(b)(1), during the five-year storage period you must update your stored 300 Logs to include:

1. Newly discovered recordable injuries or illnesses, and
2. Changes in the classification of cases you already recorded.

The Log is not frozen when the year ends. If you learn in 2027 about a recordable case that actually belongs on the 2025 Log — say, an occupational illness with a long latency that a doctor finally connected to a 2025 exposure, or a case you simply missed — you go back and add it to the 2025 Log, the year it occurred. You don't drop it onto the current Log because that's the one in front of you.

The same goes for cases that change after you first recorded them. Suppose you logged a 2026 injury as a restricted-duty case, and weeks into 2027 the employee's condition worsens and a physician orders days away from work. The original classification is now wrong. You go back to the 2026 Log, line out or strike the original entry, and enter the corrected information — the new case type, the updated day counts. OSHA expects the change to be visible, not erased: you cross out the old entry rather than deleting it, so the history is auditable. The mechanics of striking and re-entering are the same ones we cover in the step-by-step guide to filling out the 300 Log; the only difference is that you're doing it to a Log from a prior year.

This is where the recording deadline and the update duty interact. You generally have seven calendar days from the moment you learn of a recordable case to get it on the Log (1904.29(b)(3)). That seven-day clock doesn't disappear just because the year the case belongs to is over. If new information surfaces about an old case, the obligation to act promptly — and to put it on the correct year's Log — is still live for the whole retention period.

What You DON'T Update: The 300A and the 301

If the 300 Log has to stay current for five years, you'd reasonably assume the summary built from it and the case files behind it do too. They don't — and this asymmetry is the single most useful thing to know about 1904.33.

• 1904.33(b)(2): "No, you are not required to update the annual summary, but you may do so if you wish."
• 1904.33(b)(3): "No, you are not required to update the OSHA 301 Incident Reports, but you may do so if you wish."

So the rule splits three ways:

• 300 Log — you must update it during retention.
• 300A Summary — you may, but are not required to.
• 301 Reports — you may, but are not required to.

The logic is that the 300A Annual Summary is a snapshot. It captured your totals as of when you certified and posted it (between February 1 and April 30 of the following year), and OSHA treats that snapshot as a fixed historical record — including the version you submitted electronically through the ITA. If a 2025 case is reclassified in 2027, your 2025 Log changes, but the 2025 300A that hung on the breakroom wall and went to OSHA stays as it was. You're not expected to re-post or re-submit a corrected summary, and you're not penalized for the original totals not matching the now-updated Log.

The 301 reports get the same treatment for the same reason: they're the case file as it stood, not a living document. You can update either one — and there are good reasons to, like keeping your internal trend data and your injury-rate calculations accurate — but OSHA won't cite you for leaving them as originally filed.

When the Business Changes Hands (1904.34)

Retention gets a wrinkle when an establishment is bought or sold mid-year, and 1904.34 settles who owns what. Two rules:

You record only for the part of the year you owned the establishment. If you sell on June 30, you're responsible for recording and reporting the work-related injuries and illnesses that happened on your watch — January through June. The buyer records from July forward. Neither party records the other's cases.

You transfer the Part 1904 records to the new owner, and the new owner must save them — but need not update or correct them. The successor inherits the duty to retain the prior owner's records for the balance of the five-year period under 1904.33. They do not inherit the duty to fix them. If a case the seller logged later turns out to be misclassified, the buyer who's merely holding the records isn't on the hook to go back and correct the seller's Log. They keep it; they don't maintain it.

For a small employer buying a business, the practical takeaway is to get those Part 1904 records as part of the deal — five years of Logs, summaries, and 301s — and store them. An OSHA inspector who shows up next year can ask for records covering a period before you owned the place, and "the previous owner had those" is not a complete answer if the records were supposed to be transferred to you.

Why Retention Is Really About Retrieval (1904.40)

Keeping records is only half the point. Being able to hand them over fast is the other half, and it's the part that turns a filing habit into a compliance risk.

Under 1904.40, when an authorized government representative asks for the records you keep under Part 1904, you must provide copies within four (4) business hours. Not four days. Four business hours. The authorized representatives are a Department of Labor official conducting an inspection, a representative of HHS/NIOSH conducting an investigation, or a state-plan agency. (If your records live in a different time zone, you may use the business hours of the location where the records are kept when you count.)

Four hours is not a lot of time to locate, assemble, and copy five years of Logs, summaries, and 301s if they're scattered across a drawer, an old laptop, and a former safety manager's email. The retention rule and the four-hour rule are two ends of the same obligation: keep the records, and keep them retrievable. An inspector who can't get the records on time doesn't just note a gap — missing or unproducible records are exactly the kind of finding that turns into a recordkeeping citation, with penalties currently running up to $16,550 per violation. Failure-to-keep and failure-to-produce sit right alongside the other recordkeeping mistakes OSHA cites most often.

Quick Reference: Keep It, Update It, Produce It

| Record | Retain (1904.33(a)) | Must update during retention? | Produce on request | | --- | --- | --- | --- | | 300 Log | 5 yrs after the calendar year | Yes (1904.33(b)(1)) | 4 business hours (1904.40) | | Privacy case list | 5 yrs after the calendar year | Keep current with the Log | 4 business hours | | 300A Annual Summary | 5 yrs after the calendar year | No — optional (1904.33(b)(2)) | 4 business hours | | 301 Incident Reports | 5 yrs after the calendar year | No — optional (1904.33(b)(3)) | 4 business hours |

A clean way to stay compliant without thinking about it: at the start of each year, confirm the prior six years' worth of records are accounted for, and whenever any case information changes — a late-surfacing illness, a worsened injury, a corrected classification — fix it on the Log for the year the case belongs to, not the current one.

Keeping Five Years of Records Both Current and Retrievable

The hard part of 1904.33 isn't the five-year math. It's that the duty is invisible day to day — there's no reminder telling you a 2024 case just changed classification and needs to go back onto the 2024 Log, and no alarm that goes off four business hours into an inspection. The records that get an employer cited are almost never the ones they knew about; they're the prior-year Logs that quietly fell out of date and the 301s nobody could find in time.

LogStead keeps every year's Log live for its full retention window. When a case classification changes — restricted duty becomes days away, a count climbs toward the 180-day cap — you correct it on the right year's Log and the change is captured with an audit trail, so the strike-and-re-enter history is there if an inspector asks. The 300A you certified stays preserved as the snapshot it's supposed to be, separate from the Log that keeps moving. And because every Log, summary, and 301 lives in one place rather than a drawer and three laptops, the four-business-hour request is a search, not a scramble. If you're not sure a given case is even recordable in the first place, the recordability checker walks you through the decision before it ever reaches the Log.