OSHA 300 Log requirements are mostly about routine discipline, not one complicated form. Keep a separate log for each covered establishment. Enter each recordable work-related injury or illness within seven calendar days after learning it is recordable. Keep the log, privacy list, annual summary and incident reports for five years after the calendar year ends. The detail matters because a tidy spreadsheet that misses one of those duties is not a compliant record.
Who must keep an OSHA 300 Log?
Employers with more than 10 employees during the prior calendar year generally keep records unless an establishment falls into a partially exempt industry. The size exemption is based on the entire company; the industry exemption is tested establishment by establishment. Part 1904 sets both rules and makes clear that all covered employers still have duties to report specified severe events under 1904.39.
| Requirement | What good practice looks like |
|---|---|
| Establishment log | One current 300 Log for each covered physical establishment |
| Timely entry | Classification and entry within seven calendar days of knowledge |
| Supplementary record | Form 301 or an equivalent report for every recordable case |
| Annual summary | 300A totals certified, posted and retained as required |
| Five-year file | Updates made when later information changes the case |
OSHA’s recordkeeping forms show the standard 300, 300A and 301 layout.
What belongs on one log line?
The 300 Log records a case number, employee name unless it is a privacy case, job title, date, location, a brief description, classification and day counts. The description should let a reviewer understand the injury or illness and affected body part without needlessly exposing medical details. “Back injury” is not much help; “strained lower back while lifting a carton at receiving dock” is usually enough.
The classification is equally important. Mark the most serious outcome: death, days away, job transfer/restriction or other recordable case. A case can have several outcomes over time, so follow the required hierarchy and update the entry when new facts arrive. A line is not frozen simply because the year closed.
The seven-day routine
Set an internal workflow that starts the moment a supervisor learns of a possible recordable case: collect the event facts, get treatment and work-status instructions, check work-relatedness and new-case status, apply the recording criteria, enter the case and create the Form 301 record. Our decision tree explains the order.
Here is the snag: seven calendar days is not seven working days. A Friday incident that becomes clearly recordable over a weekend needs attention before the following Friday. A shared inbox with no owner is a poor substitute for a clock. Give a named coordinator authority to ask for missing documentation and amend the record.
Retention is an active obligation
Keep the 300 Log, privacy case list, 300A and 301 reports for five years following the end of the year they cover. During that period, update the log if new information changes a classification or the number of days away, restricted or transferred. Do not erase the original trail; correct it in a way that makes the current record accurate.
Consider a case recorded in December with an estimated four restricted days. The employee remains limited into January for twelve calendar days. The old year’s log still needs the final count updated. The annual 300A may need correcting too. That follow-through is rarely glamorous, but it is the difference between a record and a snapshot.
Privacy is a separate control
Do not simply blank every sensitive employee name. Part 1904 identifies six privacy-case categories and requires “privacy case” on the public-facing log, with a separate confidential list of names. The event description must still avoid identifying detail. Read the privacy-case guide before sending screenshots of a log around a large team.
The same principle applies to contractors, temporary staff and travelling employees: establish who is responsible for the record and which establishment owns the case. A combined corporate dashboard can be useful, but it does not remove the establishment-level duty.
A simple monthly audit
Once a month, compare incident reports, clinic restrictions, workers’ compensation notifications and absence records against the log. Look for workers on modified duties who never received a classification, cases with day counts that never closed, and reports sitting in a manager’s email. Reconcile the totals before the 300A season turns a small omission into a scramble.
This is also the point to calculate TRIR accurately. The rate is only as trustworthy as the cases entered into the log. The arithmetic is easy; the original determination is the hard part.
What to have ready if OSHA asks
The practical retrieval test is useful: could the person covering the safety lead produce the establishment’s current 300 Log, current 300A, associated incident reports and privacy-case list without searching personal drives? Keep the files organised by establishment and year, limit the confidential list to the people who need it, and know who can authorise production. A log that exists only as an attachment in a former manager’s inbox is not an accessible record. This modest filing discipline also makes year-end electronic submission much calmer.
Frequently asked questions
How long must OSHA 300 Logs be kept?
Keep the OSHA 300 Log, privacy case list, annual 300A summary and Form 301 incident reports for five years following the end of the calendar year that the records cover. Update entries during that period when new information changes the outcome.
Is an OSHA 300 Log needed at every location?
Covered employers keep a separate log for each establishment expected to operate for a year or longer. A corporate roll-up can support management reporting, but it should not replace the establishment-level record.
When does the seven-day OSHA recording period begin?
It begins when the employer learns a case is recordable, not necessarily at the moment of injury. Use calendar days and document when the information establishing recordability was received.
Can a digital OSHA 300 Log meet the requirements?
Yes. OSHA focuses on the required information, accuracy, availability and retention rather than a particular software package. A digital system still needs to keep records accessible and manage privacy cases correctly.
