How to Submit Your OSHA Data Electronically via the ITA Portal

Every year by March 2, certain employers must electronically submit the previous calendar year's injury and illness data to OSHA through the Injury Tracking Application, the ITA. The window opens on January 2 and the obligation is annual: 2025 data was due March 2, 2026; 2026 data opens January 2, 2027 and is due March 2, 2027. The requirement lives at 29 CFR 1904.41, and since the 2023 expansion it comes in two layers — a Form 300A summary for a broad set of establishments, and detailed Form 300 and 301 case data for the largest establishments in the highest-hazard industries.

OSHA does not send reminders. Its own FAQ says the agency "does not generally notify establishments" that must submit, and the regulation provides for notice only in the individual data collections under 1904.41(a)(3) — routine submitters under (a)(1) and (a)(2) get none. You are expected to work out whether each of your establishments is covered and to file on time. Missing March 2 does not make the duty disappear — the portal accepts late submissions through December 31 — but the miss is a citable violation from the day after the deadline, and OSHA finds non-submitters with a database query, not an inspection.

This guide walks the whole submission act on the portal as it stands for the 2026–2027 cycle: what to gather, how the account and Login.gov setup actually works, the web-form and CSV paths for the 300A, the separate 300/301 step, the errors the ITA throws and what they mean, how to prove you filed, and what happens to employers who don't. Every portal step below is taken from OSHA's ITA User Guide (last updated December 2025) and its ITA FAQ, both re-read for this revision.

Who Must Submit — the Short Version

Coverage is decided per establishment — a single physical location — never at the company level, and the size test is peak headcount: the number of people who worked there at any point during the previous calendar year, including part-time, seasonal, and temporary workers (1904.41(b)(2)). Three groups routinely submit:

Every covered establishment must also provide its Employer Identification Number with the submission (1904.41(a)(4)). Establishments that are partially exempt from recordkeeping under 1904.1 or 1904.2 — 10 or fewer employees at all times during the year, or in a low-hazard industry on Appendix A to Subpart B — do not routinely submit (1904.41(b)(6)). State Plan states are covered too (1904.41(b)(7)); OSHA notes that Minnesota requires additional private-sector establishments to submit, so Minnesota employers should check with their state program.

This post does not re-teach the coverage determination. Run it once, properly, then come back here:

What OSHA Actually Collects

Knowing the fields before you log in is what makes the portal fast.

From the 300A, for every covered establishment: the establishment's name, physical address, NAICS code, EIN, and size category; the annual average number of employees and the total hours worked by all employees; the case counts in columns G through J (deaths, cases with days away, cases with job transfer or restriction, other recordable cases); the day counts in columns K and L; and the injury and illness types in M-1 through M-6. These are the numbers off your certified Form 300A, transcribed — so certify the summary first and submit from the certified copy, not from a draft.

From the 300 and 301, only for Appendix B establishments with 100+ employees: everything on the forms except the fields 1904.41(b)(9) carves out — employee name (300 column B; 301 field 1), employee address (301 field 2), the treating physician's name (field 6), and the treating facility's name and address (field 7). Per case, that leaves job title, date and location of the incident, the description, the outcome and type classification, day counts, date of birth, date of hire, sex, whether the employee was treated in an emergency room or admitted as an inpatient, the times work started and the incident occurred, the four narrative fields, and the date of death if any.

Privacy handling worth knowing: OSHA's FAQ states it will not collect names or addresses, that it converts every date of birth to age on submission and discards the birth date (the portal displays it back as month/1/year), and that the age, sex, hire-date, emergency-room, and inpatient fields are withheld from the public dataset. Everything else you submit is published on OSHA's ITA data site, establishment by establishment. Narrative fields are your responsibility: strip names, Social Security numbers, phone numbers, addresses, emails, and provider information before they go in, because OSHA's automated review is a backstop, not a guarantee.

Before You Log In: the Checklist

Gather these once and the submission itself takes minutes:

• A Login.gov account and an ITA account on the same email address. Both are required; the ITA cannot be accessed without an active Login.gov account, and the two must match. Use an individual address you will still control next year — OSHA recommends against shared mailboxes, and you cannot change an ITA account's email later (a new address means a new account and a transfer, covered below).
• The establishment's EIN. Required by 1904.41(a)(4). If a location somehow has none, OSHA points you to the IRS to obtain one.
• A valid six-digit NAICS code — 2012, 2017, or 2022 vintage are all accepted. Four-digit codes are rejected. If the establishment does more than one thing, choose the code for the activity that generates the most revenue or employs the most people.
• Peak employment for the year, counted as 1904.41(b)(2) counts it — every individual employed at any time, including temps you supervise day to day. This picks the size category in the profile. It is not the same number as the 300A's annual average.
• The certified 300A for the prior calendar year, with total hours worked and the average-employee figure computed by the official pay-period method. If your hours came from payroll (hours paid) rather than time records (hours worked), fix that before submitting; the portal computes and displays your rates from what you enter.
• The legal company name and a street address. The profile wants a physical address, not a PO box, and 1904.41(b)(10) allows a number or code as the establishment name only if the legal company name appears somewhere in the submission.
• For 300/301 filers: the 300 Log and 301 reports for the year, scrubbed of the identifiers above, with a unique case number per case (any format, as long as no two cases at the establishment share one).

Step 1: Accounts — the ITA Account and Login.gov

The order matters and confuses first-time filers: you create the ITA account first, then link a Login.gov account to it, then use Login.gov every time you sign in.

1. Go to the ITA login page at osha.gov/injuryreporting/ita and select "New User? Create an ITA Account." Fill in the required fields, pass the CAPTCHA, accept the terms of use, and the ITA emails you a registration confirmation.
2. If you do not already have a Login.gov account on that same email, select "Sign in with Login.gov" and then "Create an account." Login.gov emails a confirmation link, then asks for a password and at least one two-factor authentication method. Set up more than one method — losing your only factor is the most common way to lose access in February.
3. Back on the ITA login screen, select "Sign in with Login.gov" and use the Login.gov password. The ITA account's own password is never what you type at this prompt.
4. On first login, and each January after, select "Manage My Account" from the dropdown and "Update Profile" to confirm your contact details.

Returning filer? You do not create a new account each year. Sign in with the same Login.gov credentials and your establishments are still there.

Getting a "403 – Failed/Forbidden" after creating Login.gov? OSHA's FAQ answer is prosaic: clear your browser history, or open an incognito or InPrivate window and sign in from there. If that fails, use the ITA Help Request Form linked from the ITA page.

Several people need access? One email address maps to one ITA account, but an establishment can be shared. From the establishment's page select "Assign User", enter the colleague's ITA email, and pick a role: an ITA Establishment User can edit the profile and add, edit, and submit data; an ITA Establishment Admin can do all that and assign further users. Whoever creates an establishment is its admin automatically.

The person who filed last year has left? Their establishments do not come with the job. Create your own ITA and Login.gov accounts, then use the ITA's Bulk Establishment Transfer tool (documented in the User Guide) to move their establishment profiles to you — up to 500 at a time.

Step 2: The Establishment Profile

Each covered location gets its own profile, and the profile is what the portal uses to decide which forms it expects from you — get it wrong and the ITA will either demand data you do not owe or, worse, mark a covered establishment "Not Required to File."

From the home screen select "Create an Establishment" (or reach it through "View Establishment List") and enter:

1. Establishment name — unique across your account if you have more than one. Returning filers: do not create "Store 123 – 2026." Reuse "Store 123"; the same profile carries every year.
2. EIN.
3. Company name — the legal entity, if the establishment name does not already include it.
4. Physical address, city, state, ZIP.
5. NAICS code or industry description — type either and select the code from the list. When pasting a code, do not leave a leading or trailing space; the dropdown will not match it.
6. Peak number of employees — a radio button for the size category.
7. Public-sector entity — yes or no.
8. Save.

If you will upload a 300A CSV for many establishments, skip this step: the upload creates the profiles from the file. If you closed a location permanently, or sold it, OSHA's FAQ says the former owner does not submit for it — inactivate the profile (page 24 of the User Guide) so the Submission Report stops listing it.

Step 3: Submit the 300A

OSHA's advice is direct: for one or a few establishments, use the web form; the CSV batch upload exists for employers with many locations. Both are covered below because the CSV path is also where most rejections happen.

Path A — the web form

1. "View Establishment List" → select the establishment's name → "Add 300A Data."
2. At the top right of the form is the question did the establishment have any injuries or illnesses this year? Answer No and the rest of the form greys out — that is the zero-case submission, and it is still a submission. Answer Yes and every remaining field is required.
3. Enter the numbers from the certified 300A. The portal enforces the identity the form itself implies: the sum of G through J must equal the sum of M-1 through M-6. If your summary fails that check, the error is in the summary, not the portal — go back to the log.
4. Select "Submit." You are returned to the establishment view, which now shows the establishment's Total Case Incident Rate and DART rate computed from what you entered — a useful sanity check against your own TRIR and DART math.
5. Expect two confirmation emails: an initial receipt, then a second message stating success or failure. The 300A status on the establishment list flips to "Submitted" (with a link to view the submission); OSHA's guide notes you may need to refresh the page — Ctrl+F5 — before the status changes.

Nothing arrived after several minutes? Check spam, then check the status column. If it does not read "Submitted," resubmit. Editing a submitted 300A later — "Edit 300A Data" on the establishment — re-submits it, and OSHA keeps the last record submitted.

Path B — the CSV upload

From the home screen select "Upload 300A Data"; the upload page carries the instructions, the template, and the sample under "Step 1," then a file chooser, a terms checkbox, and the "Upload" button. Build the file from OSHA's own published files, not from memory — the header row must match exactly:

• osha_ita_summary_data_csv_template-revised.csv — the header row alone, in the required order.
• osha_ita_summary_data_csv_sample_data-revised.csv — the same layout with sample rows.
• osha_ita-estab-and-summary-csv-documentation_revised.pdf — the field-by-field data dictionary.

Three fields take codes rather than words, and the codes changed in 2023 when the size categories were split:

The size field is defined by OSHA's data dictionary as the maximum number of employees who worked at the establishment at any point in the year — peak, again, not the average. A returning filer whose file still says 2 in the old 20–249 sense gets rejected.

Formatting rules that reject otherwise-correct files: no decimals or commas in any numeric field (whole numbers only — Excel's habit of formatting 40000 as 40,000.00 is the classic cause); ZIP codes must keep their leading zeros (Excel strips them on every open; format the column as Special → ZIP Code and save as the last step); and the file must be a plain CSV, not the PDF forms, which the portal cannot ingest.

One trap we found by experiment rather than by reading: OSHA's data dictionary spells the EIN column ein_number, while the template and sample say ein. The portal enforces ein. A file built from the dictionary is rejected at validation with "Expected 'ein', but found 'ein_number'" and creates nothing; the byte-identical file with ein processes end to end. We confirmed both outcomes in OSHA's preview environment, which is worth knowing about on its own:

After an upload you get an on-screen receipt and an email, then a second email once the file has been processed saying whether it loaded or was rejected for formatting. Processing time depends on the queue; the 300/301 side is explicitly batched at three-hour intervals, and the 300A side "may take longer" under volume. Do not wait until March 1 to discover a formatting rejection.

Step 4: Submit 300/301 Case Data (Appendix B Establishments Only)

Two gates run before this step. The 300/301 data will not be processed until the establishment's 300A has been successfully submitted — the FAQ is explicit, and the CSV path errors out otherwise. And the portal decides whether it expects 300/301 data at all from the establishment profile plus the submitted 300A: an establishment the ITA deems out of scope shows a 300/301 status of "Not Required to File." If you believe that is wrong, the fix is the profile (size category, NAICS), not a support ticket.

Had zero recordable cases at a covered establishment? Submit the 300A showing none; there is no 300/301 submission to make.

Manual entry

1. From the establishment's page select "Add or Edit 300/301 Data," then "+Add 300/301 Data" to open a case form.
2. Complete the required fields for one case — job title, date, location, description, outcome, type, day counts, DOB, hire date, sex, ER and inpatient flags, times, the four narratives — with no identifiers in any text field. Save, then repeat per case.
3. The 300/301 case page shows a progress bar whose total is the number of cases on the submitted 300A. The count of cases you enter must reach it.
4. Return to the establishment view and select "Submit Data." If the case count does not match the 300A, a pop-up asks whether to proceed — select No and reconcile; a mismatch you push through is a mismatch OSHA now has on file. Confirm the final pop-up and submit.

Afterward the list shows the status as "n cases out of n cases submitted." Watch the wording: "n out of n added" means the cases are saved in the portal but have not been submitted to OSHA. Users who enter every case and never press "Submit Data" have not filed.

CSV upload

Select "Upload 300/301 Data" and follow the same four-part upload page. Build from OSHA's files:

• ita_template_form_300-301_csv_data.csv — the 24-column header.
• ita_sample_form_300-301_csv_data.csv — sample rows.
• ita_case_data_csv_specifications.pdf — the case-data spec (v1.5, dated January 29, 2025).

The User Guide's own submission checklist condenses to the rules that actually reject files:

• establishment_name must match the name on the 300A submission exactly, character for character. The error "Unable to locate the establishment with the specified name" means one of three things: no 300A was submitted for it, the name differs, or the establishment is not required to file 300/301 data.
• year_of_filing is the calendar year the incident occurred — 2026 for files submitted in early 2027 — and every date_of_incident must fall in it.
• case_number must be unique within the establishment.
• incident_outcome is coded 1 death, 2 days away, 3 job transfer or restriction, 4 other recordable — one code, the most serious outcome. type_of_incident is coded 1 injury through 6 other illness in the M-column order.
• Day counts must agree with the outcome: outcome 2 requires dafw_num_away greater than zero (restricted days may be zero); outcome 3 requires djtr_num_tr greater than zero and days away of zero. A restricted-work case with a blank or zero restricted-day count is rejected outright.
• Dates are MM/DD/YYYY or MM-DD-YYYY. Times are where OSHA's own documents disagree: the User Guide's checklist says H:MM AM/PM, while the case-data spec and OSHA's published sample file use 24-hour hh:mm (the sample has 13:30, not 1:30 PM). Build to the spec and the sample, strip the seconds Excel adds by default, and confirm in the preview environment. time_unknown is 1 when the time of the incident is not known.
• Text fields in job_title, incident_location, incident_description, and the four narratives carry only letters and numbers — no periods, slashes, dashes, colons, or the special characters the checklist lists — and no identifiers.
• gender is M, F, or blank; OSHA expects it when known but the portal accepts a blank.

Files are processed at regular three-hour intervals in the order received; the result email is the record of acceptance or rejection.

Step 5: Prove You Filed

The ITA has no print button on a submission. Your evidence is the confirmation emails — keep them — and the Submission Report: from the establishment list select "View Submission Report" (also on the dropdown menu) and a new tab summarizes the 300A and 300/301 status of every active establishment for the current collection year, with a print control. It covers the current cycle only; a 2025 submission does not appear on the 2027 report, which is one more reason to file the emails.

Two related limits: the ITA cannot export your prior submissions back to you, and you cannot submit or edit data for any year before the most recent one once a new collection period has started. Your own copies of the 300 Log, 300A, 301s, and privacy case list — retained five years under 1904.33 — remain the record of what you filed. If you keep the forms electronically, export and archive the year-end set alongside the ITA emails.

Errors and Rejections, Decoded

A Worked Example: One Sawmill, One Filing

Hemlock Point Lumber Co. is a fictional single-location sawmill — the Tacoma Mill, NAICS 321113 — whose peak headcount during the year was 44 (average 40), with 80,000 hours worked. The year's 300 Log holds four recordable cases: one with days away, one with job restriction, and two other recordable cases; three are injuries and one is a hearing-loss illness.

Coverage. Sawmills (NAICS 3211) are on Appendix A to Subpart E, and 44 employees is inside the 20–249 band, so the 300A is required under 1904.41(a)(1)(i). At 44 employees the establishment is well under the 100-employee floor for 1904.41(a)(2), so no 300/301 data is owed — and the portal agrees: after the 300A processes, the establishment's 300/301 status reads "Not Required to File."

Profile. Establishment name "Tacoma Mill," legal company name "Hemlock Point Lumber Co.," the mill's street address, EIN, NAICS 321113, peak-employment radio button in the 20–99 band, not a government entity.

300A entry. Injuries or illnesses this year: Yes. Annual average employees: 40. Total hours worked: 80,000. Deaths (G): 0. Cases with days away (H): 1. Cases with job transfer or restriction (I): 1. Other recordable cases (J): 2. Days away (K): 5. Days of restriction or transfer (L): 8. Injuries (M-1): 3. Hearing loss (M-5): 1. All other types: 0. The portal's check passes — G+H+I+J = 4 = M-1 through M-6 — and the establishment view displays a Total Case Incident Rate of 10.0 and a DART rate of 5.0, which is exactly what (4 × 200,000) ÷ 80,000 and (2 × 200,000) ÷ 80,000 produce by hand.

As a CSV row instead, the same filing carries size = 21, establishment_type = 1, no_injuries_illnesses = 1, the EIN under a header spelled ein, and the same fourteen numbers. This is the file we ran through OSHA's preview environment: with the dictionary's ein_number header it was rejected at validation; with ein the establishment was created, the EIN was stored and displayed on the establishment list, and the 300A status went to "Submitted."

Proof. Two confirmation emails, filed with the certified paper 300A; a printed Submission Report showing 300A "Submitted" and 300/301 "Not Required to File."

After You Submit

You still post. Electronic submission does not replace the 1904.32 posting duty. The certified 300A goes up at the establishment from February 1 through April 30 regardless of what you filed online; OSHA's FAQ answers the question directly: yes.

You can amend until December 31. If the establishment's information or a case classification changes after filing, you are required to update your own Form 300 but not obliged to update the ITA — though you may, through the end of the calendar year, by editing and re-submitting. After that the year is closed in the portal.

Your data becomes public. Most of what you submit is published on OSHA's ITA data site, searchable by establishment, with the privacy fields withheld. OSHA is candid about why it collects the data: to identify establishments with specific hazards for enforcement and outreach, and to let customers, applicants, and the public compare workplaces. An error that inflates your rates is an error the public — and the Site-Specific Targeting program — can see.

BLS may want it too. If your establishment is also selected for the Bureau of Labor Statistics' Survey of Occupational Injuries and Illnesses, the OSHA submission does not satisfy that request — but the BLS collection site can pull what you filed with OSHA if you enter your OSHA ID number, so you are not re-keying it.

What Happens If You Don't Submit

Failure to submit is cited under 1904.41(a)(1)(i), (a)(1)(ii), or (a)(2) — whichever duty applied. Like every Part 1904 violation under OSHA's current recordkeeping enforcement directive, CPL 02-00-172, it is classified other-than-serious, which puts it under the $16,550 per-violation ceiling. Repeat and willful classifications move the ceiling substantially; the recordkeeping citation guide walks the multipliers.

What makes this violation different from every other one in Part 1904 is detection. OSHA's April 16, 2024 enforcement memorandum instructs compliance officers to consult the ITA database "during all inspections" to identify employers that were required to submit and did not, and it fixes the citation window: data is due March 2, so the six-month statute-of-limitations date for a failure-to-submit citation is September 2. The same memo notes the agency "is continuing its analytic approach to identify non-responders" from the prior year's collection and allows Area Directors to order a full recordkeeping audit where systemic problems appear. A companion April 18, 2024 memorandum described the mechanics for that year — OSHA's Office of Statistical Analysis matching each week's newly opened inspections against a list of establishments that appear to have missed the 300A deadline, with valid matches referred to the compliance officer on the open inspection, who informs the employer and follows the April 16 procedures. OSHA now labels that second memo an archived document, so treat it as a description of how the program was run rather than a current directive; the April 16 procedures memo remains posted as active guidance.

The practical reading has not changed. Any inspection opened for any reason — a complaint, a referral, a programmed heat or targeting visit — can pick up a failure-to-submit citation the inspector found in a database before arriving. And because the record is establishment-level and public, the absence is visible to anyone who looks.

ITA Portal FAQ

Where is the ITA login page? osha.gov/injuryreporting/ita. The information page, User Guide, CSV templates, FAQ, and help form all sit one level up at osha.gov/injuryreporting.

Do I need a Login.gov account? Yes. The ITA cannot be accessed without one, and it must use the same email address as your ITA account. Password and two-factor problems are Login.gov's to fix; OSHA's help desk cannot reset them.

Do I create a new account or a new establishment each year? No to both. Sign in with the same credentials; the establishment profile carries over. Just update the profile and add the new year's 300A.

What is the ITA Coverage Application? OSHA's own two-question tool (peak employment and NAICS) for deciding whether an establishment must submit 300A and/or 300/301 data. It answers the same question as our ITA checker; the checker additionally cites the paragraph and handles NAICS 2022 codes that were renumbered from the 2012 vintage the appendices use.

Can a consultant or third party file for me? Yes — a third party may submit just as one may keep your records. Responsibility for accuracy and completeness stays with the employer. A consultant with multiple clients uses one ITA account and creates each client's establishments under it, identifying the company in the establishment form.

Can I submit through the web form for the 300A and a CSV for 300/301? Yes; the methods can be mixed. A CSV upload submits automatically on processing; web-form 300/301 entries are not filed until you press "Submit Data."

Can I submit a prior year I missed? No. Once a new collection period opens, the portal accepts only the most recent year. The window for 2025 data closes December 31, 2026.

Can I submit this year's data early? No. Only the previous calendar year's data is accepted, during that year's collection period (January 2 through December 31, with the March 2 deadline for timeliness).

I'm in a State Plan state. Does this apply? Yes, under 1904.41(b)(7). Most State Plans mirror the federal requirement; Minnesota requires more, and state and local government employers under a State Plan should ask their state program what it collects.

We are one campus with several buildings, each under 100 employees. Do we count the campus? Usually yes — OSHA treats a campus as one establishment unless each facility is a distinctly separate business in a different economic activity with its own routine business reporting.

Do I have to spend money to submit? No. The portal is free, and OSHA's FAQ says so pointedly. What software buys you is the part before the portal: a 300 Log whose totals tie to the 300A, a 300A whose fields already sit in the ITA's layout, and a case file that never contained a name in the first place.

The Part Before the Portal

Every step above assumes the numbers walking into the ITA are right: the peak headcount that decides coverage, the pay-period average and actual hours that set the rates OSHA publishes, classification columns that agree with type columns, day counts that agree with outcome codes, and narratives with no identifiers in them. The portal checks arithmetic and formatting; it cannot tell you the log was wrong.

LogStead is built for that earlier part. The ITA determination runs from each establishment's peak employment and NAICS code against the appendix tables, with the deciding paragraph shown. The year's 300A is derived from the same incident records as the 300 Log, so G–J always equals M-1–M-6. On /electronic-submission it generates the 300A establishment-and-summary CSV in OSHA's template layout — header spelled ein — and, for Appendix B establishments, the 24-column 300/301 case-data file built from the 301 records with the excluded identifier fields never included, both named against OSHA's published sample files so you can diff them yourself. Deadline reminders cover February 1 and March 2 per establishment, and every export is logged in the audit trail as proof of what was filed and when. You can walk the whole flow with sample data in the live demo — no account, nothing submitted anywhere.