OSHA Recordkeeping Requirements: What HR Needs to Know to Stay Compliant

For HR professionals, navigating OSHA recordkeeping requirements is essential to maintaining workplace safety and legal compliance. The Occupational Safety and Health Administration (OSHA) mandates that employers in the United States keep detailed records of workplace injuries, illnesses, and other safety-related incidents. These requirements help identify patterns, reduce risks, and ensure accountability. Failure to comply exposes employers not only to monetary penalties but also to heightened scrutiny during future inspections, potential reputational harm, and personal liability for managers who willfully disregard the rules. In this guide, we break down every aspect of what HR teams need to know to remain compliant in 2026 and beyond.

What Are OSHA Recordkeeping Requirements?

The OSHA recordkeeping framework is built on three interrelated forms, each serving a distinct administrative purpose. The OSHA 300 Log (Log of Work-Related Injuries and Illnesses) is the master record where every recordable event is entered, capturing the employee’s name, job title, date of injury, description of the injury or illness, and the number of days away from work or on restricted duty. The OSHA 301 Incident Report (or an equivalent workers’ compensation First Report of Injury form) must be completed within seven calendar days of learning that a recordable incident occurred; it captures more granular information about the event, including what the employee was doing, what object or substance caused the harm, and how the incident happened. The OSHA 300A Annual Summary is a certified aggregate of the prior year’s 300 Log entries that must be posted in a conspicuous location accessible to all employees.

All three forms must be retained for a minimum of five years following the end of the calendar year they cover. During that five-year retention period, the 300 Log and 301 Incident Reports must be made available to current and former employees, their personal representatives, and authorized employee representatives (such as union officials) upon request—typically within the next business day.

Who Must Comply?

Coverage under 29 CFR Part 1904 depends on two variables: establishment size and industry classification. As of 2026, employers with 11 or more employees in most industries are required to maintain the full suite of OSHA records. Employers with ten or fewer employees across all their worksites are partially exempt and do not need to keep routine injury and illness records, though they must still report severe incidents (discussed below).

The second variable is industry classification. OSHA publishes a list of "partially exempt" low-hazard industries—primarily retail trade, finance, insurance, real estate, and services—based on NAICS codes. Even if such an employer has 11 or more employees, they are exempt from routine recordkeeping. High-hazard industries, by contrast, must maintain records regardless of employee count. High-hazard sectors include construction, manufacturing, agriculture, mining, utilities, transportation, and warehousing.

State Plan states (approximately 22 states and territories that operate their own OSHA programs) may impose requirements that are at least as stringent as federal OSHA, and sometimes stricter. California (Cal/OSHA), Washington (L&I), and Michigan (MIOSHA) each have nuanced differences in injury reporting thresholds, supplemental forms, and posting obligations. HR teams operating across state lines should audit each state’s requirements separately.

What Constitutes a Recordable Incident?

A recordable incident must first be work-related (the work environment caused or contributed to the injury or illness, or significantly aggravated a pre-existing condition) and must result in one or more of the following outcomes:

• Death — any fatality resulting from a work-related injury or illness
• Days away from work — any case where the employee cannot come to work on any day after the incident day
• Restricted work or job transfer — cases where the employee can work but cannot perform routine job functions, or is temporarily transferred to a different job
• Medical treatment beyond first aid — prescription medications, suturing, physical therapy ordered by a physician, x-rays read by a physician (not just ordered), and similar interventions that go beyond the enumerated first-aid list
• Loss of consciousness — any incident where the employee loses consciousness, regardless of the duration
• Diagnosis of a significant injury or illness — occupational cancer, chronic irreversible disease, fractured or cracked bone, punctured eardrum, or any condition diagnosed by a licensed health care professional, even if it does not result in days away from work

Critically, first-aid-only cases are not recordable. OSHA defines first aid narrowly as: non-prescription medication at non-prescription strength, tetanus immunizations, cleaning wounds, using non-rigid bandages, hot or cold therapy, non-prescription eye patches, drilling fingernails for pressure relief, and a handful of other minor interventions. Any treatment not on this list—including a single prescription painkiller or a follow-up physician visit to ensure a wound is healing—converts the case to recordable.

How to Maintain OSHA Records

Effective recordkeeping is both a legal obligation and a safety management tool. A structured process ensures nothing falls through the cracks:

1. Incident intake. Within 24 hours of learning about an injury or illness, HR or the designated safety coordinator should gather initial information: employee name, date, location, nature of injury, and immediate medical treatment rendered. The OSHA 300 Log entry should reflect this information, even if full details are still being gathered.
2. Complete the OSHA 301. Within seven calendar days, complete the full incident report. Attach any supporting documentation such as the first report of injury, supervisor’s incident investigation form, witness statements, and medical evaluations. For multi-day absences, update the 300 Log entry as soon as you have final counts.
3. Track days away and restricted days accurately. The number of days entered on the 300 Log must reflect calendar days—not just workdays—away from work or on restriction. Count from the day after the incident through the day before the employee returns to unrestricted duty. Cap the entry at 180 days if the case continues beyond that point.
4. Prepare the 300A Annual Summary. At the close of each calendar year, compile totals for each column of the 300 Log. A company executive (owner, officer, highest-ranking manager, or supervisor at the establishment) must certify the accuracy of the summary with a signature. Post the 300A by February 1st and keep it posted through March 31st each year.
5. Electronic submission via OSHA’s ITA. Establishments in designated high-hazard industries with 20–249 employees must submit 300A summary data electronically. Establishments in high-hazard industries with 250 or more employees must submit 300 Log, 300A, and 301 data. Submission is made through OSHA’s Injury Tracking Application (ITA) at the ita.osha.gov portal. The annual deadline is March 2nd for the prior calendar year’s data.

Compliance Timelines and Reporting Deadlines

In addition to routine recordkeeping, OSHA imposes separate, more urgent reporting obligations for severe incidents. These are distinct from the 300 Log process and carry their own deadlines:

• Fatalities: Report to OSHA within 8 hours of learning about a work-related fatality (including heart attacks if triggered by a work event). Call the OSHA free-and-confidential reporting line (1-800-321-OSHA) or the nearest area office.
• Amputations, loss of an eye, or inpatient hospitalizations: Report within 24 hours via the same channels. Note: all inpatient hospitalizations of one or more employees trigger this obligation, not just overnight stays.
• 300 Log entry: Complete within 7 calendar days of learning the incident is recordable (though best practice is within 24 hours while details are fresh).
• 300A posting: Post by February 1st; remove no earlier than April 1st (March 31st is the last required posting day).
• Electronic ITA submission: Due by March 2nd each year for the prior calendar year’s data.

How to Avoid Fines and Penalties

OSHA classifies recordkeeping violations under the same penalty structure as safety violations. As of 2026, penalty amounts adjusted for inflation are:

• Other-than-serious violations: Up to $16,550 per violation — typically assessed for technical errors on forms that do not reflect systemic failures
• Serious violations: Up to $16,550 per violation — assessed when the employer knew or should have known about the recordkeeping failure
• Willful or repeated violations: Up to $165,514 per violation — applied when an employer is cited for the same type of violation within three years, or when it is shown the employer intentionally disregarded the requirements

Each unrecorded incident, each missing 301, each year without a posted 300A, and each failure to submit electronically counts as a separate violation. A single inspection of a multi-site employer that uncovers systemic failures can produce citations running into the millions of dollars. OSHA’s National Emphasis Program on recordkeeping accuracy periodically targets industries with anomalously low injury rates to verify whether underreporting is occurring—audits that are triggered by data analysis, not by complaints.

To reduce exposure: train supervisors to report all incidents to HR immediately; create an unambiguous internal flowchart for the first-aid-vs.-recordable determination; assign a named owner for each step of the 300, 301, and 300A process; and conduct an annual internal audit of all log entries before the February 1st posting deadline.

OSHA Inspections and Employee Access Rights

Employees and their representatives have substantive rights regarding OSHA records that HR must be prepared to honor. Any current or former employee, or their authorized representative, may request a copy of the OSHA 300 Log for any establishment where the employee currently works or has worked. The employer must provide the records by the end of the next business day.

Before providing records, the employer must remove the names of employees involved in privacy cases—defined by OSHA as cases involving sexual assaults, mental illness, HIV infection, needlestick injuries, tuberculosis, or other similar sensitive conditions. In such cases, a privacy case number is substituted for the employee name on the 300 Log itself, while the full name appears only on the corresponding 301 Incident Report, which is subject to more limited access rights.

During an OSHA inspection, compliance officers will typically request the last five years of 300 Logs, all corresponding 301 Incident Reports, payroll records (to verify employee counts), and evidence of 300A posting and electronic submission. Employers have the right to request the officer’s credentials and to accompany the officer throughout the inspection. However, deliberately withholding records or providing false information to an OSHA inspector carries criminal penalties in addition to civil fines.

OSHA Recordkeeping and the HR Role

HR is uniquely positioned to be the linchpin of an effective OSHA recordkeeping program. Unlike safety officers whose attention is often drawn to hazard abatement and training, HR has the longitudinal visibility across the workforce—onboarding, medical leaves, workers’ compensation claims, and terminations—that is essential for accurate recordkeeping. Specifically, HR should:

• Establish a written OSHA recordkeeping procedure that assigns responsibilities by role and sets internal deadlines tighter than OSHA’s statutory deadlines
• Train supervisors at least annually on the first-aid-vs.-recordable distinction, the 8/24-hour severe incident reporting obligations, and the protocol for notifying HR immediately
• Cross-reference workers’ compensation claims monthly against the 300 Log to identify any cases that qualify as recordable but have not been entered
• Audit the 300 Log quarterly, looking for late entries, missing day-count updates, and blank required fields
• Maintain access controls so that privacy-case employee names are accessible only to those with a need to know
• Build the 300A preparation and signing into the Q4 HR calendar, with the company executive review and signature completed before January 15th each year

By integrating recordkeeping compliance into standard HR workflows rather than treating it as a year-end scramble, organizations materially reduce both violation risk and the time burden on staff. HR platforms that centralize employee data—tracking leave patterns, medical restrictions, and incident history—make this integration far more sustainable at scale.

Frequently Asked Questions

What is the OSHA 300 Log?

The OSHA 300 Log is a form used to record all work-related injuries and illnesses at a business. It must be kept available for inspection and updated within 24 hours of any recordable incident.

Who is required to keep OSHA records?

Most employers with 10 or more employees are required to maintain OSHA records. Employers in high-hazard industries must do so regardless of employee count.

What constitutes a recordable injury?

A recordable injury includes incidents resulting in death, loss of consciousness, job transfer, or restricted work activity.

When must the OSHA 300A Summary be posted?

The OSHA 300A Summary must be posted in the workplace by February 1st each year and remain on display until March 31st.

What are the consequences of OSHA non-compliance?

Failure to comply with OSHA recordkeeping requirements can result in fines ranging from $1,388 to $13,884 per violation, depending on the severity.