OSHA Recordkeeping Requirements for Small Employers: What You Must Keep, Post, Submit, and Report

OSHA's injury and illness recordkeeping rule, 29 CFR Part 1904, is short enough to read in an afternoon and detailed enough to trip up almost everyone who tries. Its purpose, in its own words, is "to require employers to record and report work-related fatalities, injuries, and illnesses" (1904.0). What makes it hard for a small employer is not any single rule. It is that the obligations are spread across a dozen sections, run on different clocks, and apply to different employers. It is easy to get the log right and miss the posting date, or to be exempt from the log and still owe OSHA a phone call.

This page is the map. It lays out every Part 1904 requirement a small employer is likely to meet, in the order you meet them: whether you have to keep records at all, what goes on the log, the three forms, the yearly calendar, electronic submission, severe-injury reporting, retention and access, and what your employees are entitled to. Each section is short and links to the full guide for that topic. Where a paraphrase could mislead, the regulation's own words are quoted.

The Requirements at a Glance

The rest of this guide takes them one at a time.

Do You Have to Keep OSHA Records at All?

Two partial exemptions decide whether routine recordkeeping applies to you. They are explained in full, with the industry list and a decision flow, in Do You Need to Keep an OSHA 300 Log?. The short version:

Size. "If your company had 10 or fewer employees at all times during the last calendar year, you do not need to keep OSHA injury and illness records unless OSHA or the Bureau of Labor Statistics informs you in writing that you must keep records under § 1904.41 or § 1904.42" (1904.1(a)(1)). Two details decide most cases. The count is company-wide: "The partial exemption for size is based on the number of employees in the entire company" (1904.1(b)(1)). And it is peak employment, not average (1904.1(b)(2)), so a company that had eleven people for two weeks last summer keeps records this year.

Industry. An establishment classified in an industry group on the partially exempt list, Appendix A to Subpart B of Part 1904, does "not need to keep OSHA injury and illness records unless the government asks you to keep the records under § 1904.41 or § 1904.42" (1904.2(a)(1)), at any size. The test runs establishment by establishment: "some of the company's establishments may be required to keep records, while others may be partially exempt" (1904.2(b)(1)). A company with an accounting office and a warehouse can owe a log for one and not the other.

If you are not exempt, everything below applies to each establishment that must keep records.

What Goes on the Log

Every employer that keeps records must record each fatality, injury, and illness that "Is work-related; and … Is a new case; and … Meets one or more of the general recording criteria of §1904.7 or the application to specific cases of §§1904.8 through 1904.12" (1904.4(a)). In practice that is three questions, asked in order:

1. Is it work-related? The starting point is yes: "Work-relatedness is presumed for injuries and illnesses resulting from events or exposures occurring in the work environment, unless an exception in §1904.5(b)(2) specifically applies" (1904.5(a)). The exceptions are specific and narrow. One covers an injury that is "solely the result of an employee eating, drinking, or preparing food or drink for personal consumption", another an illness that "is the common cold or flu".
2. Is it a new case? It is, if the employee "has not previously experienced a recorded injury or illness of the same type that affects the same part of the body", or had one but "recovered completely" before a workplace event or exposure brought the signs or symptoms back (1904.6(a)).
3. Does it meet the recording criteria? A case is recordable if it results in "death, days away from work, restricted work or transfer to another job, medical treatment beyond first aid, or loss of consciousness", or if it involves "a significant injury or illness diagnosed by a physician or other licensed health care professional" (1904.7(a)). A few kinds of case have their own rules instead: needlesticks and sharps (1904.8), medical removal (1904.9), hearing loss (1904.10), and tuberculosis (1904.11).

The line people argue about most is medical treatment versus first aid. OSHA's list of first-aid treatments is closed, so anything not on it counts as medical treatment, whoever provides it; the whole list is walked through in First Aid vs. Medical Treatment. The complete four-step decision, with the edge cases, is in Is This Injury OSHA Recordable?, and the free recordability checker runs one case through it in a couple of minutes.

The Three Forms, and What Each One Is For

"You must use OSHA 300, 300-A, and 301 forms, or equivalent forms, for recordable injuries and illnesses" (1904.29(a)). Each has a different job.

• The OSHA 300, the Log of Work-Related Injuries and Illnesses. One entry per recordable case, "a one or two line description for each recordable injury or illness" (1904.29(b)(1)), with its classification and day counts. It is a running document you keep all year. Column by column: How to Fill Out the OSHA 300 Log.
• The OSHA 301, the Injury and Illness Incident Report. The case file behind each line: "You must complete an OSHA 301 Incident Report form, or an equivalent form, for each recordable injury or illness entered on the OSHA 300 Log" (1904.29(b)(2)). Many employers use an insurance form that carries the same information (1904.29(b)(4)). See the OSHA 301 guide.
• The OSHA 300A, the Summary of Work-Related Injuries and Illnesses. The year's column totals from the log, plus the establishment's annual average number of employees and total hours worked (1904.32(b)(2)). It is the only one of the three that goes on the wall, and every establishment that files with OSHA electronically each year submits its data. See the 300A annual summary. Its cases and hours are also the inputs to your TRIR and DART rates.

Paper or electronic. An equivalent form "is one that has the same information, is as readable and understandable, and is completed using the same instructions as the OSHA form it replaces" (1904.29(b)(4)). Records can live on a computer "if the computer can produce equivalent forms when they are needed" (1904.29(b)(5)). The details, including the production clocks, are in Can You Keep Your OSHA 300 Log Electronically?

Privacy cases. Six kinds of case keep the employee's name off the log: an injury to an intimate body part or the reproductive system, an injury from a sexual assault, mental illness, HIV infection, hepatitis or tuberculosis, a contaminated needlestick or sharps cut, and other illnesses where the employee asks (1904.29(b)(7)). For these "you may not enter the employee's name on the OSHA 300 Log. Instead, enter "privacy case"", and you keep a separate confidential list of the names (1904.29(b)(6)). See Privacy Concern Cases.

One log per establishment. "You must keep a separate OSHA 300 Log for each establishment that is expected to be in operation for one year or longer" (1904.30(a)). Short-term sites can share one log (1904.30(b)(1)). Records can be kept centrally if information about each case reaches the central location within seven calendar days (1904.30(b)(2)(i)). Employees who work at several sites, or at none of yours, are linked to one establishment and recorded on its log (1904.30(b)(3)). See Multi-Establishment OSHA Recordkeeping.

The Recordkeeping Calendar

One clock runs all year, and three dates close it out.

All year: seven days. "You must enter each recordable injury or illness on the OSHA 300 Log and 301 Incident Report within seven (7) calendar days of receiving information that a recordable injury or illness has occurred" (1904.29(b)(3)). The clock starts when you learn of the case, not on the date of the injury.

After December 31: close the year. "At the end of each calendar year, you must" do four things (1904.32(a)). "Review the OSHA 300 Log to verify that the entries are complete and accurate, and correct any deficiencies identified"; create the annual summary, the 300A; certify it; and post it. A year with no recordable cases still gets a summary: "if you had no recordable cases, enter zeros for each column total" (1904.32(b)(2)(i)).

The certification is not something anyone in the office can sign. It must come from a company executive: an owner (only in a sole proprietorship or partnership), an officer of the corporation, the highest-ranking company official working at the establishment, or that person's immediate supervisor (1904.32(b)(4)). The executive certifies "that he or she has examined the OSHA 300 Log and that he or she reasonably believes, based on his or her knowledge of the process by which the information was recorded, that the annual summary is correct and complete" (1904.32(b)(3)).

February 1 through April 30: post the 300A. "You must post the summary no later than February 1 of the year following the year covered by the records and keep the posting in place until April 30" (1904.32(b)(6)). It goes "in a conspicuous place or places where notices to employees are customarily posted", and it must not be "altered, defaced or covered by other material" (1904.32(b)(5)).

March 2: electronic submission, for the establishments the rule covers (next section).

For 2026 records, the calendar works out like this:

Electronic Submission: Who Files With OSHA Each Year

Only three categories of establishment routinely submit their data to OSHA's Injury Tracking Application (ITA). Each is measured by the establishment's employees at any time during the previous calendar year:

• 20 to 249 employees in an industry on Appendix A to Subpart E: information from the Form 300A (1904.41(a)(1)(i)).
• 250 or more employees in any industry that must keep records: information from the Form 300A (1904.41(a)(1)(ii)).
• 100 or more employees in an industry on Appendix B to Subpart E: information from Forms 300 and 301, the case-by-case data, as well as the 300A (1904.41(a)(2)).

Everyone counts toward those numbers: "each individual employed in the establishment at any time during the calendar year counts as one employee, including full-time, part-time, seasonal, and temporary workers" (1904.41(b)(2)). The free ITA submission checker applies all three tests to your headcount and NAICS code.

The deadline is "March 2 of the year after the calendar year covered by the form(s) (for example, by March 2, 2024, for the forms covering 2023)" (1904.41(c)). A covered establishment submits even in a year with no cases. OSHA's ITA FAQ says such establishments "must report their Form 300A data even if they experienced no recordable injuries or illnesses". If you miss March 2, the same FAQ says "the ITA will accept your injury and illness data through the end of the calendar year (December 31)": late, but still required.

Two more rules complete the picture. The requirements "apply to employers located in State Plan States" (1904.41(b)(7)). And any employer can be asked outside the routine categories: "Upon notification, you must electronically submit the requested information from your part 1904 records" (1904.41(a)(3)). The step-by-step walkthrough of the portal itself is in How to Submit Your OSHA Data Electronically. The submitted 300A data is also what OSHA's Site-Specific Targeting program uses to choose establishments for inspection; see How OSHA Picks Who to Inspect.

Recording Is Not Reporting: The 8-Hour and 24-Hour Rules

The log is paperwork you keep. A severe-injury report is something you make to OSHA, by phone, in person, or online, on a clock measured in hours. It applies to every employer covered by the OSH Act, including employers exempt from the log.

• "Within eight (8) hours after the death of any employee as a result of a work-related incident, you must report the fatality" to OSHA (1904.39(a)(1)).
• "Within twenty-four (24) hours after the in-patient hospitalization of one or more employees or an employee's amputation or an employee's loss of an eye, as a result of a work-related incident, you must report the in-patient hospitalization, amputation, or loss of an eye to OSHA" (1904.39(a)(2)).

Which events count is narrower than the headline:

• Timing. "You must only report a fatality to OSHA if the fatality occurs within thirty (30) days of the work-related incident." A hospitalization, amputation, or loss of an eye is reported only "if it occurs within twenty-four (24) hours of the work-related incident" (1904.39(b)(6)).
• Hospitalization. An in-patient hospitalization is "a formal admission to the in-patient service of a hospital or clinic for care or treatment" (1904.39(b)(9)). One "that involves only observation or diagnostic testing" is not reported (1904.39(b)(10)).
• Transport. A motor-vehicle accident on a public street or highway outside a construction work zone, and an event on a commercial or public transportation system, are not reported. They are still recorded if you keep records (1904.39(b)(3)–(4)).

If you learn of the event, or that it was work-related, only later, the 8- or 24-hour clock runs from when you or your agent learn of it (1904.39(b)(7)–(8)). You report to the nearest OSHA Area Office by phone or in person, to 1-800-321-OSHA (1-800-321-6742), or through the online reporting application on osha.gov (1904.39(a)(3)). If the Area Office is closed, a voicemail, fax, or email does not count (1904.39(b)(1)). The full rules, with examples: OSHA's 8-Hour and 24-Hour Reporting Rules, Explained.

Keeping the Records and Handing Them Over

Five years. "You must save the OSHA 300 Log, the privacy case list (if one exists), the annual summary, and the OSHA 301 Incident Report forms for five (5) years following the end of the calendar year that these records cover" (1904.33(a)). The stored log is not frozen. You "must update your stored OSHA 300 Logs to include newly discovered recordable injuries or illnesses and to show any changes that have occurred in the classification of previously recorded injuries and illnesses" (1904.33(b)(1)). The 300A and the 301s do not have to be updated (1904.33(b)(2)–(3)). See How Long Do You Have to Keep OSHA Records?

Employees. An employee, former employee, personal representative, or authorized employee representative can ask for the 300 Log "for an establishment the employee or former employee has worked in", and you must provide a copy "by the end of the next business day" (1904.35(b)(2)(iii)). An employee, former employee, or personal representative gets the 301 for that employee's own case by the end of the next business day (1904.35(b)(2)(v)(A)). An authorized employee representative gets only the "Tell us about the case" section of the 301s, for an establishment where it represents employees under a collective bargaining agreement, within 7 calendar days (1904.35(b)(2)(v)(B)). Names stay on the log copies, apart from privacy cases (1904.35(b)(2)(iv)), and "you may not charge for these copies the first time they are provided" (1904.35(b)(2)(vi)). See Can Employees See the OSHA 300 Log?

OSHA. "When an authorized government representative asks for the records you keep under part 1904, you must provide copies of the records within four (4) business hours" (1904.40(a)). If the records are kept in another time zone, you may use the business hours of the location where they are kept (1904.40(b)(2)). When an inspector asks for the records, that four-hour clock is the one running; the Heat NEP inspection walkthrough shows how a programmed inspection unfolds.

Your Employees' Part: Reporting Procedures and Retaliation

A log is only as complete as the reports that reach it, and Part 1904 makes the reporting channel an obligation of its own. You must:

• "establish a reasonable procedure for employees to report work-related injuries and illnesses promptly and accurately", and "A procedure is not reasonable if it would deter or discourage a reasonable employee from accurately reporting a workplace injury or illness" (1904.35(b)(1)(i));
• tell each employee what that procedure is (1904.35(b)(1)(ii)), and that "Employees have the right to report work-related injuries and illnesses" and that employers "are prohibited from discharging or in any manner discriminating against employees for reporting work-related injuries or illnesses" (1904.35(b)(1)(iii));
• and follow through: "You must not discharge or in any manner discriminate against any employee for reporting a work-related injury or illness" (1904.35(b)(1)(iv)).

Section 11(c) of the OSH Act adds its own protection for an employee who reports an injury, files a safety and health complaint, or "asks for access to the part 1904 records" (1904.36).

For a small employer the practical version is short. Tell every new hire how to report an injury and to whom. Say plainly that reporting will not cost them their job. And check that nothing about how reports are handled would discourage the next one.

Temps, Contractors, Owners, and State Plans

Whose injuries go on your log. You record the cases of "all employees on your payroll, whether they are labor, executive, hourly, salary, part-time, seasonal, or migrant workers", and of workers who are not on your payroll "if you supervise these employees on a day-to-day basis" (1904.31(a)). A temp you supervise day to day goes on your log, not the staffing agency's (1904.31(b)(2)), and the two of you coordinate "to make sure that each injury and illness is recorded only once" (1904.31(b)(4)). Self-employed individuals are not covered (1904.31(b)(1)). In a sole proprietorship or partnership, "the owner or partners are not considered employees for recordkeeping purposes" (1904.31(a)). See Who Records a Temp Worker's Injury?

State Plans. States that run their own OSHA programs "must have occupational injury and illness recording and reporting requirements that are substantially identical to the requirements in this part" (1904.37(a)). What is recordable, and how, is the same everywhere (1904.37(b)(1)). For "industry exemptions, reporting of fatalities and hospitalizations, record retention, or employee involvement", a State Plan's rules "may be more stringent than or supplemental to the Federal requirements" (1904.37(b)(2)). If you operate in a State Plan state, check that state's rules on those four points.

What It Costs When the Records Are Wrong

OSHA's current maximum penalties, for violations assessed after January 15, 2026, are $16,550 per violation for serious, other-than-serious, and posting-requirement violations; $16,550 per day beyond the abatement date for failure to abate; and $165,514 per violation for willful or repeated violations (osha.gov/penalties, read September 29, 2026). Under OSHA's recordkeeping enforcement directive, CPL 02-00-172, Part 1904 violations are cited as other-than-serious, though they can be classified as repeated or willful. The amount actually assessed is often lower: the Field Operations Manual reduces penalties by 70% for employers with 25 or fewer employees, with smaller reductions up to 250 (FOM Chapter 6, Table 6-2).

The larger cost is usually the inspection itself. The errors inspectors cite most, and how to avoid each one, are in 5 OSHA Recordkeeping Mistakes That Lead to Citations.

A Small Employer's Checklist

In January, for the year ahead

• Check last year's peak employment, company-wide, against the 10-employee test.
• Check each establishment's NAICS code against the partially exempt list.
• Check each establishment against the three ITA categories.

Set up once

• One OSHA 300 Log for each establishment expected to operate a year or longer.
• A 301, or an equivalent form, for every recordable case, and a confidential privacy-case list.
• A reporting procedure every employee knows, with the right to report and the no-retaliation rule stated plainly.

For every injury or illness

• Decide recordability: work-related, new case, recording criteria.
• Enter it on the 300 and the 301 within 7 calendar days.
• For a qualifying fatality, call OSHA within 8 hours; for a qualifying in-patient hospitalization, amputation, or loss of an eye, within 24.

At year end, and in the spring

• Review and correct the log, total it on the 300A (zeros if there were no cases), and have a company executive certify it.
• Post the 300A from February 1 to April 30.
• Submit through the ITA by March 2 if the establishment is covered.

All the time

• Keep five years of 300s, 300As, 301s, and privacy lists, and update the stored 300 Logs.
• Give employees copies by the end of the next business day, and OSHA copies within four business hours.

Frequently Asked Questions

Does OSHA require small businesses to keep injury records?

Only if they had more than 10 employees at any time during the last calendar year, counted company-wide, and the establishment's industry is not on the partially exempt list. Every covered employer, exempt or not, still reports fatalities within 8 hours and in-patient hospitalizations, amputations, and losses of an eye within 24 hours. See the exemptions guide.

Do we have to do anything if nobody was hurt this year?

Yes, if you keep records. The 300A is still completed, with zeros in each column total, certified, and posted from February 1 to April 30 (1904.32(b)(2)(i)). If the establishment is in one of the ITA categories, it also submits that zero-case 300A by March 2.

Is an OSHA recordable injury the same as a workers' comp claim?

No. The two systems use different tests, and one does not decide the other. Part 1904 says recording a case does not mean "the employee is eligible for workers' compensation or other benefits" (Note to 1904.0). See Workers' Comp Denied but OSHA Recordable?

Can we keep OSHA records in software or a spreadsheet?

Yes, as long as the system can produce equivalent forms when they are needed (1904.29(b)(5)): the same information, as readable, completed with the same instructions as OSHA's forms. If a spreadsheet is enough for you, the free OSHA 300 Log workbook totals the log and the 300A for you. What recordkeeping software actually has to do covers when it isn't.

Who has to sign the 300A?

A company executive: an owner of a sole proprietorship or partnership, an officer of the corporation, the highest-ranking company official working at the establishment, or that person's immediate supervisor (1904.32(b)(4)). A safety coordinator can prepare it, but can only sign it if they hold one of those roles.

Does OSHA ever ask exempt employers for records?

Yes. OSHA or the BLS can require records from an otherwise exempt employer in writing (1904.1(a)(1), 1904.2(a)(1)). OSHA can require any employer to submit Part 1904 records electronically "Upon notification" (1904.41(a)(3)).

Build the Routine Once

None of these requirements is hard on its own. What catches small employers is the number of separate clocks: seven days for each case, eight or twenty-four hours for a severe event, a February-to-April posting, a March 2 submission, a next-business-day request, and five years of storage. Set up a log for each establishment, a reporting procedure your people trust, and a year-end routine, and the requirements mostly take care of themselves.

LogStead is built around this map. The recordability wizard runs each new case through the Part 1904 tests, and every case lands on the right establishment's 300 Log with its 301. Privacy cases keep their confidential list separately. The 300A totals, the year-end certification, and the ITA exports all come from the same log lines. The deadline calendar tracks the dates above, and employee record requests carry their own due dates. You can start with a single case in the free recordability checker.

This post is general compliance information, not legal advice. Verify current regulatory text against eCFR and your state plan's requirements.