The OSHA 301 Incident Report: The Case File Behind Every 300 Log Line

Most employers know the OSHA 300 Log and the 300A annual summary. The third form in the set — the 301 Incident Report — gets forgotten, skipped, or quietly assumed to be covered by the Log. It isn't. The 301 is a separate, required form, one per recordable case, and it carries the detail the 300 Log never asks for: what the employee was doing, what happened, what object or substance caused the harm, and which provider treated them.

If the 300 Log is the index to your year of injuries, the 301 is the case file behind each entry. And here is the part that catches employers off guard: the access rules for the 301 are completely different from the access rules for the Log. The 300 Log goes to any employee or representative who asks, in full, by the next business day. The 301 does not. Your own report goes to you quickly; a union representative gets only one section of it, stripped of nearly everything else; and the government gets the whole thing on a four-hour clock. Confusing the two forms' rules is a citation waiting to happen.

This post walks through what the 301 captures, the seven-day clock for completing it, the workers' comp shortcut that satisfies it (and the trap inside that shortcut), the retention rule, and the access framework that makes the 301 the trickiest of the three forms to hand out correctly.

What the 301 Is, and the Seven-Day Clock

The requirement is short. Under 29 CFR 1904.29(b)(2):

You must complete an OSHA 301 Incident Report form, or an equivalent form, for each recordable injury or illness entered on the OSHA 300 Log.

The obligation is therefore downstream of the recordability determination: no recordable case, no 301. That also means an over-recorded case quietly generates an unnecessary 301 alongside the unnecessary Log entry, so it is worth settling the threshold question before opening the form — the free recordability checker walks the 1904.5 and 1904.7 criteria that decide it.

One 301 per recordable case. Not one per month, not one per quarter, not a single summary form for the year — one for each line on your 300 Log. The case number links them: the number you assign in Column A of the 300 Log is the same number that appears on the 301, so the two forms can always be reconciled.

The deadline is the same one that governs the Log itself. Under 1904.29(b)(3):

You must enter each recordable injury or illness on the OSHA 300 Log and 301 Incident Report within seven (7) calendar days of receiving information that a recordable injury or illness has occurred.

Seven calendar days, not business days, and the clock runs from when you receive information that a recordable case has occurred — not necessarily from the date of injury. If a worker is hurt on the 1st but you only learn on the 5th that the doctor prescribed medication (making the case recordable), your seven-day clock for both the Log entry and the 301 starts on the 5th. The 301 is not a form you get to fill out later when you have time. It is due on the same clock as the Log entry it supports.

This is where a lot of small employers fall behind. They enter the one-line summary on the 300 Log within the window and tell themselves they will "do the 301 paperwork later." Later turns into the February scramble when the 300A is due, and by then half the 301s were never completed at all. The form is due in seven days. Build the habit of completing it at the same time you make the Log entry.

What the 301 Captures That the 300 Log Doesn't

The 300 Log gives you a single line per case — a short description, a classification, some day counts. The 301 is the detail underneath. OSHA's Form 301 is organized into three blocks of information.

Information about the employee. Full name; street, city, state, and ZIP; date of birth; date hired; and sex. (Note the contrast with the Log: the 301 carries the full name and identifying details even for cases where the 300 Log shows only "privacy case." More on that below.)

Information about the physician or health care professional. The name of the treating physician or other health care professional; the facility where treatment was given if it was away from the worksite, with its address; whether the employee was treated in an emergency room; and whether the employee was hospitalized overnight as an in-patient. Those last two fields map directly onto the severe-injury reporting analysis — the distinction between an ER visit and a formal in-patient admission is the hinge of the 24-hour reporting rule, which we cover in OSHA's 8-hour and 24-hour reporting rules.

Information about the case. This is the section titled "Tell us about the case," and it is the heart of the form: the case number from the 300 Log; the date of injury or illness; the time the employee began work that day; the time of the event; what the employee was doing just before the incident occurred; what happened; what the injury or illness was, including the part of the body affected and how; what object or substance directly harmed the employee; and, if the case resulted in death, the date of death.

That "Tell us about the case" section matters for two reasons. First, it is the narrative that makes your injury data useful — "what the employee was doing just before" plus "what object or substance directly harmed" is what lets you spot a hazard pattern instead of just counting cases. Second, as you will see in the access section, it is the only part of the 301 that a union representative is entitled to receive. OSHA designed that section to be the shareable, de-identified core of the form.

The Workers' Comp Shortcut — and the Trap Inside It

You do not have to use OSHA's actual Form 301. Under 1904.29(b)(4):

An equivalent form is one that has the same information, is as readable and understandable, and is completed using the same instructions as the OSHA form it replaces. Many employers use an insurance form instead of the OSHA 301 Incident Report, or supplement an insurance form by adding any additional information required by OSHA.

This is the shortcut most multi-state and mid-size employers actually use: the workers' compensation First Report of Injury form, or an insurance carrier's incident form, doing double duty as the 301. It is allowed — but only if the substitute genuinely contains everything the 301 requires.

That is the trap. OSHA's recordkeeping FAQ addresses it head-on:

Yes, the employer may use a workers' compensation form or other form that does not contain all the required information, provided the form is supplemented to contain the missing information and the supplemented form is as readable and understandable as the OSHA 301 form and is completed using the same instructions as the OSHA 301 form.

Most state workers' comp First Report forms do not capture every 301 field. They were designed for a different purpose — getting a claim into the comp system — and they frequently omit things like "what the employee was doing just before the incident" or the specific object or substance that caused the harm. If you are relying on a comp form as your 301 substitute, you have to supplement it to fill those gaps. A comp form that is missing 301 fields, used as-is, is not a valid 301 — and an inspector who pulls your "301s" and finds they are bare comp forms has found a recordkeeping violation.

Two further cautions. State comp forms change; re-verify each year that the current version still captures all 301 fields before you rely on it for another cycle. And while you can use a third party — a carrier, a TPA, a software system — to complete the forms, you remain responsible for their content and accuracy. The duty does not transfer with the data entry. The broader point that OSHA recordability runs on its own criteria, independent of the comp system, is one we develop in workers' comp denied but OSHA recordable.

Retention: Five Years, but the 301 Doesn't Get Updated

The 301 is part of the five-year record set. Under 29 CFR 1904.33(a), you keep the 300 Log, the privacy case list (if one exists), the annual summary, and the 301 Incident Reports for five years following the end of the calendar year they cover. Your 2026 301s, for example, are retained through the end of 2031.

But the 301 differs from the 300 Log in one important way during that retention period. The Log is a living document — under 1904.33(b)(1), you must update it during the five years as cases evolve, lining out a classification that changed or correcting a description. The 301 carries no such duty. Per 1904.33(b)(3):

Do I have to update the OSHA 301 Incident Reports? No, you are not required to update the OSHA 301 Incident Reports, but you may do so if you wish.

So the 301 is a snapshot of the case as you understood it when you completed it. You retain it for five years, you may update it if you choose, but you are not obligated to. The updating discipline applies to the Log, not the case file behind it. For the full mechanics of keeping the Log current across the retention window, see how to fill out the OSHA 300 Log.

The Access Rules — Where the 301 Diverges From the Log

This is the section that justifies the post. The 300 Log and the 301 are both employee-accessible records, but the access rules are not the same, and the differences are the kind of thing that produces a citation when an employer applies the Log's rules to the 301 or vice versa.

There are three distinct requesters, and three distinct rules.

The employee's own report — by the end of the next business day. Under 1904.35(b)(2)(v)(A):

When an employee, former employee, or personal representative asks for a copy of the OSHA 301 Incident Report describing an injury or illness to that employee or former employee, you must give the requester a copy of the OSHA 301 Incident Report containing that information by the end of the next business day.

An employee gets their own full 301 — the complete form, all three blocks — by the end of the next business day. A "personal representative" gets the same access to that employee's report. A personal representative is anyone the employee or former employee designates in writing, or the legal representative of a deceased or legally incapacitated employee. So a family member or an attorney can get the full 301, but only with that written designation establishing them as the personal representative.

The union representative — one section only, within seven days. This is the rule that surprises employers. Under 1904.35(b)(2)(v)(B):

When an authorized employee representative asks for copies of the OSHA 301 Incident Reports for an establishment where the agent represents employees under a collective bargaining agreement, you must give copies of those forms to the authorized employee representative within 7 calendar days. You are only required to give the authorized employee representative information from the OSHA 301 Incident Report section titled "Tell us about the case." You must remove all other information from the copy of the OSHA 301 Incident Report or the equivalent substitute form that you give to the authorized employee representative.

A union — an authorized collective-bargaining agent — does not get the full 301. It gets only the "Tell us about the case" section, and you must strip everything else: the employee's name, address, date of birth, the provider information, all of it. And the timeframe is seven calendar days, not the next business day. This is the opposite posture from the 300 Log, where the union is entitled to the entire Log including names. For the 301, the default is maximum redaction.

The government — four business hours, everything. When an authorized government representative asks, a separate rule governs entirely. Under 29 CFR 1904.40(a), you must provide copies of the records you keep under Part 1904 within four business hours. That is the whole 301, unredacted, on a four-hour clock — and it is a different obligation from the employee-access timeframes, not to be confused with them.

You provide the first copy at no charge in every case (1904.35(b)(2)(vi)).

How Privacy Cases Flow Through the 301

Friday's companion post covered privacy concern cases — the six categories where you enter "privacy case" instead of the name on the 300 Log. The 301 interacts with that framework in a way worth making explicit.

The 301 itself carries the full name even for a privacy case — it has to, because the 301 is the case file and the confidential link between case number and name has to live somewhere. The name suppression happens on the Log, not on the 301. But two access mechanics protect the privacy-case worker anyway. First, the description-masking discretion under 1904.29(b)(9) applies to both the 300 and the 301, so for a privacy case where the surrounding facts would identify the worker, you generalize the description on both forms. Second, when a union requests the 301, you are already stripping everything but "Tell us about the case" — which removes the name and identifying fields regardless of whether it is a privacy case. The union never sees the name on any 301, privacy case or not.

So the privacy architecture holds across both forms: suppressed on the Log, masked in the description where the facts would identify the worker, and structurally withheld from the union on the 301 by the redaction rule.

Electronic Submission of 301 Data

If your establishment is large enough and in a high-hazard industry, some of your 301 data goes to OSHA electronically. Under the 2023 final rule "Improving Tracking of Workplace Injuries and Illnesses" (88 FR 47254), effective January 1, 2024, establishments with peak employment of 100 or more employees in an industry listed in Appendix B to Subpart E of Part 1904 must electronically submit case-level data from both the 300 Log and the 301 Incident Report — not just the 300A summary. That requirement began with calendar-year 2023 data, due March 2, 2024.

The personally identifying fields do not go public. OSHA does not collect employee names through the portal, and the fields covering employee name, address, date of birth, date hired, and sex, along with the provider and facility information, are not part of what OSHA publishes. The case-level narrative gets submitted; the identity does not. If you are working through the submission process, our ITA portal guide covers it step by step, and the 300A annual summary guide covers the summary-level submission that applies to a broader set of employers.

The Mistakes That Generate Citations

A few failure patterns account for most 301 problems:

Never completing the 301 at all. Treating the 300 Log as sufficient is the most common error. The Log and the 301 are separate required forms; a clean Log with no 301s behind it is a recordkeeping violation.

Missing the seven-day clock. The 301 is due on the same timeline as the Log entry. Doing the Log in seven days and the 301 "eventually" misses the deadline on the 301.

Using a deficient substitute form. A bare workers' comp First Report used as a 301 without supplementing the missing fields is not a valid 301 (1904.29(b)(4)).

Mishandling an access request. Giving a union the full 301 instead of only "Tell us about the case," or blowing the next-business-day deadline on an employee's own report, are both citable — and both come from applying the wrong form's rules.

Discarding before five years, or failing to link to the Log. The 301 is a five-year record (1904.33), and it has to be reconcilable to its 300 Log line by case number.

Recordkeeping violations like these are typically cited as other-than-serious, currently capped at $16,550 per violation, with willful or repeated violations reaching $165,514. Those are the 2025 ceilings carried into 2026 — the Department of Labor's 2026 inflation notice (91 FR 31358, May 27, 2026) confirmed there is no 2026 increase, because the data needed for the statutory calculation was not produced during the fall 2025 government shutdown. Each unrecorded or deficient form can be its own violation. In December 2022, OSHA cited Amazon for 14 recordkeeping violations across six facilities — including not recording cases within the required time and not providing OSHA with timely records — with $29,008 in proposed penalties. And the agency has gone further where the failure was willful: in 2011, OSHA cited AK Steel $206,000, including four willful violations, for failing to record standard threshold shifts on its 300 Log over a multi-year span. (Proposed penalties shift through settlement and contest; the AK Steel matter is an older archived case but a clean illustration of how far recordkeeping enforcement can reach.)

The broader pattern of citation-generating recordkeeping errors is covered in 5 OSHA recordkeeping mistakes that lead to citations.

This post is general compliance information, not legal advice. Verify current regulatory text against eCFR and your state plan's requirements — state-plan states such as California, Washington, and Oregon may impose additional or more stringent completion, retention, and access requirements.