OSHA Privacy Cases: Names and Access on the 300 Log
Picture a quiet moment in your office or shop floor. An employee reports an incident that carries a personal weight, one that demands discretion alongside compliance. How do you balance both on the OSHA 300 Log?
For an OSHA privacy case 300 log entry, you do not write the employee's name. Instead, enter "privacy case" in the name field. Maintain a separate confidential list linking case numbers to names. Complete a Form 301 incident report with details on cause and severity, but omit intimate specifics. This approach protects privacy while meeting recordkeeping rules.
Distinguishing Ordinary Cases from Privacy Cases
The OSHA 300 Log serves as the cornerstone of injury and illness recordkeeping for covered employers. Most recordable cases require straightforward entries: employee name, job title, date of injury, and a description of what happened. These ordinary cases form the bulk of your log, providing a clear picture of workplace safety trends.
Privacy cases stand apart. They arise when recording full details risks exposing sensitive personal information. The official term, straight from OSHA regulations, is "privacy case." These entries replace the employee's name with the phrase "privacy case." The shift protects individuals while the log retains utility for analysis.
Not every sensitive incident qualifies. Qualification hinges on specific criteria outlined in federal regulation 29 CFR 1904.29. Employers make this determination, guided by the rules, ensuring consistency across the log.
The Six Exhaustive Privacy Categories
OSHA defines privacy cases precisely in 29 CFR 1904.29(b)(7). There are exactly six categories, no more, no less. Regulation 1904.29(b)(8) confirms this is a complete list. Employers may not expand it with additional types.
You must consider the following types of injuries or illnesses to be privacy concern cases: [followed by the list]. These six types of cases are the only types of cases that are considered privacy concern cases under this section.
Use this checklist to evaluate cases:
- Injury or illness to an intimate body part or the reproductive system, such as a lower abdominal injury.
- Injury or illness resulting from a sexual assault, described as injury from assault.
- Mental illnesses.
- HIV infection, hepatitis, or tuberculosis.
- Needlestick injuries and cuts from sharp objects contaminated with another person's blood or other potentially infectious material, as defined in 1904.8.
- Other illnesses, if the employee voluntarily requests that his or her name not be entered on the log.
This list leaves no room for interpretation beyond its terms. A sprain, laceration, or musculoskeletal disorder does not qualify as a privacy case unless it fits one of these categories exactly. The voluntary request option applies solely to "other illnesses," not injuries.
Recording a Privacy Case on the OSHA 300 Log
Once you determine a case meets the criteria, handle it methodically. In the employee name column of the OSHA 300 Log, write "privacy case." This simple entry signals the sensitivity without erasing the record.
Behind the scenes, create and maintain a separate confidential list. Match each privacy case number to the employee's name. This list allows you to track updates, like days away or restrictions, and respond if government representatives request full details under 1904.29(b)(6) and 1904.40.
Store this list apart from the main log. Secure it to prevent unauthorized access. Think of it as the log's shadow archive, visible only when required.
For reference, review the OSHA 300 Log template to see the name column layout clearly.
Describing Events Discreetly
Balancing Detail and Discretion
Descriptions on the 300 Log must identify the cause and general severity without intimate details, per 1904.29(b)(9). If you have reason to believe other fields could identify the employee, use discretion. OSHA guidance in FAQ 29-3 allows omitting job title, date, or location in unusual circumstances.
For instance, an injury to a reproductive organ becomes "lower abdominal injury." A sexual assault case logs as "injury from assault." These generic terms preserve anonymity while informing safety efforts.
The goal mirrors walking a tightrope: enough for compliance and analysis, not enough for identification. Always prioritize the employee's privacy within regulatory bounds.
Access Rights to the Log and Privacy Data
Access rules protect the system. Current and former employees, plus their authorized representatives, can view the full 300 Log under 1904.35. They see "privacy case" entries but not the confidential name list.
Government representatives receive the log and, upon request, the confidential list. This ensures oversight without routine exposure.
For voluntary disclosures beyond these groups, remove all identifying information from Forms 300 and 301. Exceptions include sharing with auditors evaluating your safety program, for insurance claims, or with public health authorities under specific rules in 1904.29(b)(10) and 45 CFR 164.512.
These boundaries keep your records functional yet confidential, much like a vault with keyed access.
The Role of the OSHA 301 Incident Report
Privacy cases demand a completed Form 301, or equivalent, just like any recordable incident. Capture details here to support the log entry. Use non-identifying language consistent with the 300 Log.
The 301 provides depth: what happened, how it occurred, and outcomes. Link it to the privacy case number for seamless tracking. Learn more in our guide to the OSHA 301 Incident Report Form.
Practical Steps for Managing Privacy Cases
- Assess the incident against the six categories in 1904.29(b)(7). Confirm it fits exactly.
- Enter "privacy case" in the name field on the 300 Log.
- Add the case number and employee name to your confidential list.
- Craft a discreet description focusing on cause and severity.
- Complete the Form 301 with matching discretion.
- Store the confidential list separately and securely.
- Remember: software tools organize data but do not determine privacy status. That decision rests with you per the regulation.
Follow these steps methodically. They turn potential complexity into routine compliance.
Key Considerations for Accuracy
This guidance draws from 29 CFR 1904.29 and OSHA FAQs 29-2 and 29-3. FAQ 29-2 affirms the employer decides using the listed categories. FAQ 29-3 addresses description discretion.
It is not legal advice. Always verify the current regulation text at osha.gov. This article does not determine whether any specific case qualifies as a privacy case.
In the rhythm of daily operations, privacy cases remind us that recordkeeping blends precision with humanity. Master these rules, and your OSHA logs stand strong.
FORM 300 LOGBOOK offers a recordkeeping workspace to help organize cases securely. It does not decide privacy-case status and is not affiliated with OSHA. Open the recordkeeping workspace.