By: Allison E. Moore
Employers subject to the Occupational Safety and Health Administration (“OSHA”) reporting requirements may soon see their injury and illness data publicly available on the internet. On March 30, 2022, the Federal Register published OSHA’s proposed rule to amend its occupational injury and illness recordkeeping regulations. Comments are requested before May 31, 2022.
Current Requirements
29 C.F.R. Part 1904 requires employers of at least ten (10) employees maintain a Log of Work-Related Injuries and Illnesses (OSHA Form 300), supplement this log with an Injury and Illness Incident Report (OSHA Form 301) for each entry and prepare a Summary of Work-Related Injuries and Illnesses (OSHA Form 300A). Each year covered employers must post this information in a visible place in the workplace. Most employers in industries that are required to routinely keep OSHA injury and illness records with at least twenty (20) employees are required to electronically submit Form 300A to OSHA yearly.
Proposed Requirements
The proposed rule requires employers of at least twenty (20) employees (classified in an industry listed in appendix A to subpart E) to continue to electronically submit Form 300A yearly, while newly requiring employers of at least one hundred (100) employees (classified in an industry listed in appendix B to subpart E) to also annually submit information from Forms 300 and 301 yearly, representing at least an estimated 46,911 employers with additional electronic reporting requirements. The deadline for yearly electronic submissions remains unchanged—March 2 of the year after the calendar year covered by the form(s)—with an estimated cost of implementation of $81, per employer, annualized over ten (10) years.
Issues to Consider
On its face, the proposed regulation appears to merely shift the timing and method of delivery of information already available to OSHA, employees and their representatives. However, employers are wise to consider the administrative burden of these shifting requirements and broader impacts related to OSHA’s proposal to make the information collected available in a searchable online database.
All establishments that would be required to electronically submit Form 300A information to OSHA under the proposed rule are already subject to this requirement under the current regulation, although a small number of employers not classified in an industry listed in appendix A to subpart E would be relieved of the duty to make electronic submissions. OSHA did not modify the list of industries in appendix A to subpart E except to update the NAICS codes to 2017 standards.
New administrative burden stems from the proposed requirement of employers with at least one hundred (100) employees in an industry (classified in an industry listed in appendix B to subpart E) to additionally submit Forms 300 and 301 electronically on an annual basis. Newly drafted appendix B to subpart E is a subset of appendix A, representing industries that have demonstrated a 3-year average rate of total recordable cases (Total Case Rate or “TCR”) for 2017, 2018 and 2019, of at least 3.5 cases per 100 full-time-equivalent employees. Using TCR for determining reporting requirements is a new approach to targeting industries with safety and health concerns.
At a minimum, covered employers choosing to record Forms 300 and 301 information in an alternative format will be required to translate records into an electronic format accepted by OSHA and navigate historically routine electronic portal issues. However, of broader concern is the anticipated searchable public access to Forms 300 and 301 data.
While OSHA expects to complete a Privacy Impact Assessment before issuing the final rule, the proposed rule charges employers with primary responsibility for removing or hiding the employees’ names and other personally identifying information—increasing the risk of employer liability from human error. OSHA Forms 300 and 301 contain information that reasonably identifies individuals directly, such as: name, contact information, date of birth, and physician name for workers who experienced a recordable injury or illness. The proposed rule addresses employee privacy concerns with “multiple layers of protection including limiting the data fields collected, reminding employers not to submit information that reasonably identifies employees directly; withholding certain fields from disclosure; and using automated information technology to detect and remove information that reasonably identifies individuals directly.” 87 Fed. Reg. 18538 (Mar. 30, 2022). Except for OSHA’s anticipated use of automated information technology (“AI”), employers hold the majority of the responsibility for protecting employees’ privacy. AI (still in its infancy) to detect information that reasonably identifies individuals directly can be used to preclude human review and redaction of information, but most jurisdictions still rely on human legal review of computer-redacted data before public release for most applications where individual rights are considered. Thus, AI may not relieve the administrative burden to publicly releasing injury and illness data that OSHA expects, driving up costs of implementation.
OSHA maintains that the inherent risks of electronic submission and public availability of additional injury and illness data are outweighed by the benefits of timely access to employers, employees, representatives, potential employees, customers, potential customers and members of the general public. Regardless, OSHA continues to claim that access to the same scope of employer data, and current safeguards to review and control of employees’ personally identifiable information is enough to balance OSHA’s goals of efficient enforcement and compliance with the potential burden on covered employers.
Comments and data from the public on any aspect of the proposed rules can be submitted through May 31, 2022 at https://www.regulations.gov.