A phlebotomist gets stuck with a used needle while drawing blood. The case is recordable — it always was — but someone on the safety team pauses before typing the name into the log. Won't that draw the wrong kind of attention? This is where most people get the OSHA privacy case rule backwards. An osha privacy case doesn't change whether an injury goes on the log. It changes how the entry looks. Six categories qualify, one field gets replaced with two words, and a second document holds the real name. Get that mechanic wrong and you either expose someone unnecessarily or fail an audit. Here's exactly how it works, category by category.
What is an OSHA privacy case?
A privacy case — OSHA calls it a "privacy concern case" — is a recordable injury or illness that falls into one of six sensitive categories under 1904.29(b)(7)(vi). Everything about the underlying rule still applies. The case has to meet the same test as any other entry: work-related under 1904.5, a new case, and meeting one of the 1904.7 recording criteria — death, days away from work, restricted duty, medical treatment beyond first aid, loss of consciousness, or a significant diagnosis like a needlestick.
The only thing privacy status changes is column B on the OSHA 300 Log, where the employee's name normally goes. For a privacy case, that column reads "privacy case" instead of the person's name. Nothing about the case gets dropped from the totals. If it's recordable, it counts toward your Total Recordable Incident Rate and, where applicable, your DART rate, exactly like any other entry. The rule protects identity, not visibility.
Does a privacy case still count towards TRIR and DART?
Yes, without exception. TRIR and DART are built from the same 300 Log totals that include every recordable case, privacy status or not. If the needlestick meets 1904.7, it's one more recordable case in the denominator math regardless of whose name is or isn't written on the row. We see this misconception often enough that it deserves saying plainly: there is no separate, smaller bucket of "cases that don't count because they're private." Privacy affects the name field. It does not affect the arithmetic.
The six privacy concern categories
OSHA didn't leave this to judgement. The list in 1904.29(b)(7)(vi) is closed — six categories, nothing else qualifies unless an employee specifically asks.
| Category | What it covers |
|---|---|
| Intimate body part or reproductive system injury | An injury or illness to a part of the body an employee would reasonably expect to keep private, or to the reproductive system |
| Sexual assault | Any injury or illness resulting from a sexual assault |
| Mental illness | A diagnosed mental illness, such as work-related depression or anxiety that meets the recording criteria |
| HIV, hepatitis, or tuberculosis | A case where the employee has contracted one of these three specific infections |
| Contaminated needlestick or sharp-object injury | A needlestick injury or cut from an object contaminated with another person's blood or other potentially infectious material |
| Employee-requested privacy | Any other illness, only if the employee independently and voluntarily asks that their name be left off the log |
Table: the six categories that qualify a case for privacy treatment under 1904.29(b)(7)(vi).
Five of the six are automatic — if the facts fit, the case gets privacy treatment whether or not the employee asks for it. The sixth, employee-requested privacy, only applies when the request is genuinely voluntary and comes from the employee, not suggested or prompted by the employer. You can't offer privacy status to a broken wrist just because someone would prefer it discreet; that category exists narrowly for illnesses, and the request has to originate with the worker.
What counts as an "intimate body part" injury under OSHA?
OSHA doesn't publish an exhaustive body map, and this is one of the places the rule leaves room for judgement. The clearest examples — groin, genitals, breast — are uncontroversial. Less clear cases, like an injury near but not on an intimate area, or a description that could be read either way, are exactly where a tool that returns "needs review" instead of guessing earns its keep, because forcing a determination on ambiguous anatomy is how employers end up either over-redacting ordinary injuries or under-protecting sensitive ones.
A worked example: the needlestick during a bloodwork draw
Take a real scenario. A phlebotomist at an occupational health clinic is drawing blood for a routine workplace physical. The patient moves, the needle slips, and the phlebotomist gets stuck through a glove. It's a contaminated sharp — the needle had just been in the patient's vein — so this falls squarely into category five.
Work-relatedness is straightforward: the injury happened while performing an assigned job duty, on the employer's premises, during the shift. That satisfies 1904.5. Recordability is also straightforward: OSHA treats needlesticks and cuts from objects contaminated with blood or other potentially infectious material as recordable on their own, without needing to wait and see whether medical treatment follows, because of the seroconversion risk. That's a "significant diagnosis" case under 1904.7.
So the case goes on the log. Column B reads "privacy case," not the phlebotomist's name. The description in the log stays clinical and generic — something like "needlestick injury during patient blood draw" — with no job title detail specific enough to identify one person if the clinic only employs one phlebotomist on that shift. Separately, in a confidential document kept apart from the log itself, someone writes down the case number and the phlebotomist's actual name, so the business can match the two later if OSHA asks. We walk through a related version of this exact fact pattern in our worked needlestick scenario, which covers a contaminated sharp found in general waste rather than during a clinical draw — same category, different setting.
How the confidential list actually works
This is the part people skip past, and it's the part that actually protects anyone.
Employers must keep a separate, confidential list linking each privacy case's number to the employee's real name. It cannot live inside the 300 Log or be attached to it. In practice that means a distinct file — a locked spreadsheet, a restricted folder, a paper record in a locked drawer — accessible to a narrow set of people with a legitimate need to know: usually the recordkeeping owner, HR, and maybe a safety manager, not the whole leadership team and not anyone with general log access.
If OSHA asks for the list during an inspection, the employer has to produce it, though the standard permits removing employee names before releasing certain records to some outside parties in limited circumstances. That detail is genuinely fiddly, which is why we won't oversimplify it here — if you're facing an actual disclosure request, OSHA's Letters of Interpretation are the right place to check how the agency has answered specific versions of that question, and this isn't legal advice for your situation.
One EHS manager we spoke with put it this way: "The log is the easy part. Everyone remembers to write 'privacy case' instead of a name. What gets forgotten is that the confidential list needs its own access controls — otherwise you've built a spreadsheet that undoes the whole point of the redaction."
Where teams get this wrong
Thinking a privacy case doesn't count toward totals. As covered above, it does. Treating privacy cases as somehow "off the books" for TRIR or DART purposes will make your safety metrics wrong, and it's the single most common misunderstanding of this rule.
Naming the employee elsewhere on the log. Column B might correctly say "privacy case," but a description field like "night-shift stocker Dana R. cut on box cutter, groin area" defeats the whole purpose. The description must not include information that would identify the employee, even indirectly — job title plus shift plus department can be enough to identify someone in a small workplace, even with no name attached.
Keeping the confidential list somewhere it isn't actually confidential. A shared drive folder that half the company can browse, or a spreadsheet tab hidden two clicks from the public 300 Log, doesn't meet the separation and access-control expectation the rule assumes.
Applying privacy status to categories that don't qualify. Only the six listed categories get this treatment, and the sixth only on a genuine, voluntary employee request. A broken arm doesn't become a privacy case because the employee is embarrassed about it, however reasonable that feeling is.
Skipping the case number link entirely. Some employers redact the name on the log and then lose track of which case number belongs to which employee, which becomes a real problem if the case needs updating later — a change in days away, for example — and nobody can trace the row back to the right file.
Recordkeeping software is getting more scrutiny, not less
OSHA's recordkeeping enforcement has been trending toward closer inspection of 300 Log accuracy generally, and privacy case handling is a specific, checkable detail an inspector can catch quickly — either the six categories are being applied correctly or they're not, and either the confidential list exists and is genuinely separate or it doesn't. Our piece on rising recordkeeping citations covers that trend in more depth. The mechanical nature of privacy case handling is exactly the kind of detail that's easy to get right once you know the rule, and easy to miss entirely if you're improvising column by column.
Get it right the first time
Running a case through Job13's free recordability check tells you plainly whether an injury belongs on the log — and flags privacy category status where the facts point that way, rather than guessing on genuinely ambiguous anatomy or intent. If you need the case saved into a running OSHA 300 Log, the 300A summary, and an ITA export ready for electronic submission, that's part of Job13's paid plan — see pricing for what's included.
Frequently asked questions
Does a privacy case still get reported to OSHA if it's serious enough?
Yes. Privacy status affects the 300 Log entry only. Separate reporting obligations under 1904.39 — fatalities, in-patient hospitalisations, amputations, and loss of an eye — still apply to a privacy case exactly as they would to any other case, on the same timelines.
Can an employee ask for privacy status on any injury they want kept quiet?
Only for illnesses, and only as the sixth category — the employee has to independently and voluntarily make the request. It isn't available for ordinary injuries just because someone would prefer discretion, and it isn't something an employer can offer or suggest to steer a case that way.
Who is allowed to see the confidential list linking case numbers to names?
The rule doesn't hand down a fixed staffing list, but the expectation is a small group with a genuine need to know — typically whoever owns recordkeeping, plus HR or a safety manager — kept separate from general access to the 300 Log itself, and produced to OSHA on request.
Is a mental health case always a privacy case?
If it meets the recording criteria in the first place — for example, a diagnosed, work-related mental illness involving days away or restricted work — then yes, it automatically qualifies for privacy treatment under the fourth category. The harder question is usually whether the underlying case is recordable and work-related at all, which is a separate judgement call from privacy status.
Where can I check the exact wording of the privacy case rule?
The full text sits in 29 CFR Part 1904, and the current federal version is also published on eCFR. OSHA's own recordkeeping page at osha.gov/recordkeeping and its Letters of Interpretation are the right places to check how the agency has applied it to specific facts.
