If your business has more than ten employees on payroll for any part of the year, federal recordkeeping rules expect a complete file every January 1. The osha 300 log sits at the center of that file. So does the 300A summary you'll post on the breakroom wall by February 1. Skip either form and you're looking at a citation that nobody wants on a clean compliance record.
Here's the part most safety managers learn the hard way. The 300 and 300A aren't interchangeable. One tracks individual cases. The other rolls them up into a single, signed annual summary that hangs visibly through April 30. Both fall under 29 CFR Part 1904, the recordkeeping standard. Both can trigger a knock at the door from an OSHA compliance officer if your numbers look off compared to your industry.
This guide walks through what each form is, who fills them out, when they're due, and how to file electronically through the Injury Tracking Application. We'll also cover privacy cases, exempted industries, and the fillable PDF versions you can grab today. Bookmark this — you'll come back to it every January.
People say "the 300 log" casually, but recordkeeping under 29 CFR 1904 actually uses three separate documents. They work together. Mess up one, and the others go sideways.
The Form 300 — Log of Work-Related Injuries and Illnesses is your running tally for the calendar year. Every recordable case lands here within seven days. A recordable case generally means medical treatment beyond first aid, days away from work, restricted duty, job transfer, loss of consciousness, or a significant diagnosis from a physician. Cuts treated with a bandage don't qualify. Lacerations needing stitches do.
The Form 300A — Annual Summary is what most workers actually see. You take your final 300 numbers from the prior year, total them by case type and outcome, and post the summary. It includes total hours worked and average annual employment so OSHA can calculate your incidence rate against industry benchmarks. A senior company official signs it. That signature isn't ceremonial — it's a legal certification.
The Form 301 — Injury and Illness Incident Report backs up every entry on the 300. Detailed write-up. Time, place, what the employee was doing, what happened, what got hurt, treatment. Many employers use their workers' comp first report of injury instead — that's allowed if it captures the same data. Keep these together with the 300 log. OSHA can ask for them within four business hours during an inspection.
A case is recordable when it's work-related and results in one of the following: death, days away from work, restricted work or job transfer, medical treatment beyond first aid, loss of consciousness, or a significant injury or illness diagnosed by a licensed health care professional. Apply the General Recording Criteria at 29 CFR 1904.7 — when uncertain, default to recording.
Two tests decide whether you're on the hook. First, employee count. If you had ten or fewer employees at all times during the previous calendar year, you're partially exempt — no need for 300, 300A, or 301 forms unless OSHA or the Bureau of Labor Statistics specifically requests them. That ten-employee threshold counts every worker on payroll at any point in the year, not just full-timers. Part-time, seasonal, and temporary workers all count. Independent contractors paid on a 1099 do not.
Second, industry. OSHA maintains a list of partially exempt industries under Appendix A to Subpart B of 1904. Most retail, finance, insurance, real estate, and certain service-sector NAICS codes don't have to keep the logs even with hundreds of employees. The exemption tracks the establishment, not the parent company. A corporate office might be exempt while the manufacturing plant down the road isn't. Look up your NAICS at the four-digit level — same NAICS prefix doesn't always mean same exemption status.
Here's the kicker — even exempt employers must still report any fatality within eight hours and any inpatient hospitalization, amputation, or loss of an eye within 24 hours. Recordkeeping exemption doesn't equal reporting exemption. Confused yet? You're not alone. The action plan for any covered employer should start with a quick check against the exemption list as part of any osha compliance review, then a confirmation of which establishments meet the employee count threshold.
Running list of all recordable injuries and illnesses for the calendar year.
Annual rollup of the 300 totals, signed and posted publicly Feb 1 – Apr 30.
Detailed write-up backing each recordable case on the 300 log.
An injury or illness goes on the log if it's work-related and meets at least one of the general recording criteria. Work-relatedness is broader than people think. If an event or exposure in the work environment caused or contributed to the condition, or significantly aggravated a pre-existing condition, you record it. Exceptions exist — eating lunch in the breakroom, the common cold, personal grooming — but the default is "record it" when in doubt.
The 300 has columns for case classification: days away from work, job transfer or restriction, other recordable. Pick one. The most serious outcome wins if a case progresses. A sprain that started as restricted duty but turned into three days off home becomes a days-away case.
You'll list the employee's name, job title, date, where the event happened, what the employee was doing, what happened, what part of the body was affected, and what the injury or illness was. Body part and event description matter for trend analysis. Vague entries like "back pain" or "fall" don't help your safety committee spot patterns. Specifics do — "lower back strain lifting 50 lb box from floor" tells the story.
When an injury or illness is reported, ask three questions. Did it happen in the work environment, or was it caused or aggravated by work? Does it meet General Recording Criteria — death, days away, restriction, medical treatment beyond first aid, loss of consciousness, significant diagnosis? Are any exceptions in 1904.5 applicable (eating in breakroom, common cold, personal task on premises)?
If the case clears the work-related test and meets at least one recording criterion, log it. Document your classification reasoning in case an inspector asks months later.
Record on Form 300 within seven calendar days of learning of the case. Assign a unique case number. Fill in employee name (or 'privacy case' if applicable), job title, date of injury, where it happened, what the employee was doing, what happened, the injury or illness, the body part affected.
Check the correct outcome column — death, days away, job transfer/restriction, or other recordable. Count days carefully. Day of injury doesn't count as day away; days off start the next calendar day.
Within seven days of recording, complete Form 301 or an equivalent incident report. Capture full details — time of event, what the employee was doing right before, treatment provided, name of treating physician or clinic, any equipment or substance involved.
Workers' comp first report of injury usually satisfies this requirement. Keep 301 forms with the 300 log for the same five-year period.
Cases change. A restricted-duty case can become days-away. A diagnosis can change months later. When new information arrives, cross out the old data on the 300 with a single line, write in the corrected information, and initial it. Don't delete or whitebar — the original entry must remain visible.
1904.33(b) requires updates as long as the original record is in your five-year retention window.
After December 31, review the entire year's 300 for accuracy. Total cases by outcome column. Add total hours worked from payroll and average annual employment. Transfer to the 300A summary form. A company executive examines and signs the summary.
Post the signed 300A by February 1 in a place where employee notices are normally posted. Leave it up through April 30 minimum.
Some injuries shouldn't show the employee's name on the public-facing log. The privacy concern case list is short but important: injuries to intimate body parts or reproductive systems, sexual assaults, HIV infection, hepatitis or tuberculosis, needlestick injuries with contaminated sharps, and any case where the employee requests anonymity for an illness involving mental health. The standard at 1904.29(b)(7) spells out the exact list — no employer discretion to expand or shrink it.
For these cases, write "privacy case" on the 300 log in place of the employee's name. Keep a separate confidential list linking the case number to the employee's identity. Lock it up. Don't email it. Only share with people who genuinely need access — usually HR, the safety manager, and counsel. Even if a workers' comp claim is filed publicly with the state, your 300 log entry stays anonymous.
Get this wrong and you've created a HIPAA-adjacent problem on top of an OSHA one. A union grievance has been filed over less. Train whoever maintains the log on which conditions trigger the privacy rule before they have to use it. Many companies add a refresher to existing training programs to keep this current. Reactive learning is expensive learning. Some employers add a calendar reminder each year to re-train the recordkeeper, especially after turnover.
By February 1 each year, the 300A summary covering the prior calendar year must be posted in a conspicuous spot where employee notices normally appear. Breakroom bulletin board. Time clock area. Wherever your workforce actually looks. It stays up through April 30 — three full months minimum.
A company executive signs the 300A. Per the standard, that's an owner, an officer of the corporation, the highest-ranking company official at the establishment, or the immediate supervisor of that highest-ranking official. The signature certifies that the person has examined the 300 log and believes the summary is correct and complete. That's a lot of weight on a single line.
If you have multiple establishments, each gets its own 300A based on its own 300 log. Don't roll up corporate totals onto a single posted summary unless the facility is one establishment. OSHA defines establishment by physical location and economic activity, not by tax ID or org chart.
Most establishments with 250 or more employees, and certain high-hazard establishments with 20–249 employees, must also submit their 300A data electronically through the Injury Tracking Application (ITA) every year. The deadline is March 2. Miss it and citations start at Other-Than-Serious but climb fast if the lapse is willful or repeated.
Recent rule changes expanded the requirement. Starting with 2024 data submitted in 2025, employers in designated high-hazard industries with 100 or more employees at an establishment must also submit detailed Form 300 and 301 data — not just the 300A summary. That's case-level detail uploaded to OSHA's servers. The agency is publishing some of this data publicly under the new transparency rule.
To submit, create an account at osha.gov/ita. You'll need your establishment's NAICS code, address, and EIN. Upload a CSV file or enter data manually. The system validates against employee count ranges and flags obvious errors. Print or download a confirmation when you finish — that's your proof of filing if questions come up later.
OSHA hosts the official forms as free fillable PDFs at osha.gov/recordkeeping/forms. Form 300, Form 300A, and Form 301 are all available there. The fillable versions let you type directly into the PDF, save your progress, and print when ready. Spanish-language versions exist for both 300 and 300A — Form 300 en español and Form 300A en español — useful for bilingual workplaces.
Some employers prefer an Excel-based template instead. Several insurance carriers, trade associations, and EHS software vendors distribute editable spreadsheet versions that auto-calculate totals for the 300A. These are fine as equivalent records under 1904.29(b)(4) as long as the data captured is identical to the OSHA form. Don't skip required columns to save space.
Electronic recordkeeping systems work too. For employers who want their recordkeepers credentialed on the underlying rules, osha certification resources and free resources cover the recording criteria in detail. Most enterprise EHS platforms — Intelex, Cority, EHS Insight, VelocityEHS — have built-in 300/300A modules that handle case classification, post-injury workflows, and CSV export for ITA submission. Smaller shops often run on the OSHA PDF plus a shared spreadsheet. Both approaches are compliant. Pick what your team will actually maintain.
The most cited recordkeeping violations follow a depressing pattern year after year. Not maintaining the 300 log for the current year. Failing to post the 300A by February 1. Classifying recordable cases as first aid to keep the numbers down. Missing 301 incident reports. Not training employees on how to report injuries without fear of retaliation.
Retaliation matters more than most folks realize. Section 1904.35 protects an employee's right to report injuries. Drug-testing every reporting employee regardless of suspicion can be interpreted as retaliation. So can post-injury safety bonus programs that punish entire crews when one person reports. OSHA has cited employers under 11(c) anti-retaliation provisions for exactly these practices. Review your post-injury program before the next 300 entry.
A good osha compliance calendar helps. Quarterly review of recordable case classifications. December audit of the running 300 before year-end. January 1 reset and start of the new log. February 1 posting of the 300A. March 2 ITA submission. April 30 takedown of the posted summary, but five-year retention of the actual records.
Keep the 300, 300A, and 301 forms — plus any equivalent records — for five years following the calendar year they cover. Logs from 2021 are still on file through end of 2026. Don't shred early. Inspectors and BLS surveys can request prior years during this window.
When an injury becomes worse, gets reclassified, or turns out to be unrelated to work, update the original log entry. Cross out incorrect data with a single line so the original remains legible. Initial the change. Required by 1904.33.
After five years, dispose of the paper or electronic records. Most employers archive digitally anyway. Workers' comp claims, civil litigation, and union grievances sometimes reach back further than OSHA's window. Cheap storage. Easy call.
Twenty-two states plus Puerto Rico operate their own state plan OSHAs that cover private-sector employers. Six more cover state and local government only. State-plan rules must be at least as effective as federal, but several go further. California's Cal/OSHA, Washington's L&I, Michigan, Oregon — they all have additional reporting requirements, different posting rules, or expanded recordkeeping coverage.
California requires reporting any serious injury, illness, or death within eight hours, including remote work injuries that occur at a teleworking employee's home. Washington requires electronic submission from a broader range of industries than federal OSHA. Michigan has its own electronic system entirely separate from ITA.
If your business operates in a state-plan state, check the state agency's recordkeeping page before assuming federal rules apply uniformly. The 300 and 300A forms are the same, but the deadlines, submission methods, and additional reporting triggers can differ. A multi-state employer should keep a one-page cheat sheet of differences per state.
A compliance officer reviewing your records wants three things, fast. The current year's 300 log up to date through the last seven days. The signed prior-year 300A, still posted between February 1 and April 30. The supporting 301 reports for every case on the log.
They'll ask about classification on borderline cases. Why did this go on the log as "other recordable" rather than "days away"? Why is this one off the log entirely? Document classification calls in real time, with reference to General Recording Criteria at 1904.7 and the specific exceptions in 1904.5.
They'll also pull random employee names and ask whether all their work-related medical visits hit the log. That's where employers get caught. An ER visit treated as "first aid" shows up in workers' comp records but not on the 300. Mismatch. Citation. Train supervisors and your clinic to flag every work-related medical event.
Treat recordkeeping like payroll — predictable, scheduled, never improvised. Calendar reminders for the four critical dates: January 1 (new log opens), February 1 (300A posted), March 2 (ITA submission due), April 30 (300A comes down).
The 300 and 300A aren't compliance theater. The data they generate — incidence rates, body-part patterns, time-of-day clusters — is raw material for a serious safety program. Need to test your team's knowledge? Try a quick osha test.
The OSHA 300 log is the official record employers use to track work-related injuries and illnesses for the calendar year. Employers with more than ten employees at any point during the prior year must keep one — unless they fall under a partially exempt industry listed in Appendix A to Subpart B of 29 CFR 1904. Every recordable case goes on the log within seven days of when the employer learns about it.
The 300 is the running log of individual recordable cases — one row per case with employee details, classification, and outcome. The 300A is the annual summary that totals everything from the 300 and gets posted publicly each February. Both forms together cover the year, but they serve different purposes. The 300 stays confidential; the 300A is public.
Post the signed 300A summary by February 1 each year, covering the prior calendar year's injury data. Leave it posted through April 30 — three full months minimum, in a conspicuous spot where employee notices normally appear. Take it down on May 1 if you wish, but keep the actual records on file for five years total.
Establishments with 250 or more employees in industries covered by recordkeeping must submit 300A data electronically each year by March 2. Establishments with 20–249 employees in designated high-hazard industries are also covered. As of the 2024 data year (submitted in 2025), establishments with 100+ employees in certain high-hazard industries must also submit detailed Form 300 and 301 data, not just the 300A summary.
Check Appendix A to Subpart B of 29 CFR 1904 for the partially exempt industry list. It uses NAICS codes — most retail, finance, insurance, and certain service-sector codes are listed. The exemption applies to the establishment, not the parent company. Even exempt employers still have to report fatalities within 8 hours and inpatient hospitalizations, amputations, or eye losses within 24 hours.
Privacy concern cases include injuries to intimate body parts, sexual assaults, HIV or hepatitis or tuberculosis, contaminated needlestick injuries, and mental illness when the employee requests anonymity. Write 'privacy case' on the 300 log instead of the employee's name. Keep a separate confidential list linking case numbers to employee identities, accessible only to those who genuinely need it.
Five years following the end of the calendar year the records cover. So 2024 records stay on file through December 31, 2029. During the retention period, you must update old logs if new information emerges about recorded cases. Inspectors and BLS surveys can request prior years anytime within the window.
OSHA hosts free fillable PDF versions at osha.gov/recordkeeping/forms — Form 300, 300A, and 301, plus Spanish-language versions of the 300 and 300A. Excel-based templates from EHS vendors or trade associations are also acceptable as equivalent records under 1904.29(b)(4), as long as they capture every data element required by the OSHA forms.