OSHA’s 2023 Electronic Reporting Final Rule: Your FAQs Answered

By Phil Molé, MPH

Ever since OSHA’s 2023 electronic reporting final rule updating the injury and illness reporting requirements in its Recordkeeping Standard was published earlier this year, we’ve been getting questions from EHS professionals like you. That’s to be expected, since many stakeholders had been carefully following OSHA’s actions on this rulemaking because of its wide-reaching impacts, including expansion of electronic reporting obligations for many establishments. Since the final rule goes into effect on January 1, 2024, and the first reports under revised requirements are due March 2, 2024, now is the time to make sure you understand and are prepared for the revised reporting requirements.

In what follows, we’ll list some of the most frequently asked questions we’ve received about OSHA’s electronic reporting requirements and give you the answers you need.

Background of OSHA’s 2023 Electronic Reporting Final Rule

How are OSHA electronic reporting requirements changing?

At a very high level, OSHA’s 2023 electronic reporting final rule creates 4 different categories of electronic reporting obligations, depending on establishment size and industry sector, as shown in the chart below.

Establishment size (# of employees)	Industry sector	Electronic injury and illness reporting requirements
<20	All industries	No electronic reporting requirements
20-249	Listed in Appendix A of 29 CFR 1904	Electronic 300A reporting
100+	Listed in Appendix B of 29 CFR 1904	Electronic 300, 300A and 301 reporting
250+	All industries covered by the Recordkeeping Standard	Electronic 300A reporting

How does OSHA’s 2023 electronic reporting final rule differ from the 2022 Notice of Proposed Rulemaking (NPRM)?

All establishments with 250+ employees that are required to keep records under OSHA’s Recordkeeping Standard will also continue to be required to electronically submit information from their Form 300A to OSHA on an annual basis, as they do today. It should be noted that this is a difference between the final rule and the 2022 proposed rule, because the proposed rule would have removed the requirements for establishments with 250+ employees to submit electronic injury and illness reports unless they maintained requirements by virtue of being within a designated industry.

Why did OSHA reverse course here? In the Federal Register notice for the final rule, OSHA notes that they received no comments specifically supporting the proposal to remove the reporting requirements for these establishments but did receive some comments opposing the proposal. Some stakeholders believed there was a need for continued oversight over large employers in low-hazard industries, and that because of the numbers of employees associated with these establishments, employer occupational injury and illness data from these workplaces could have an important role to play in protecting employee safety.

Applicability and Reporting

What is the difference between an establishment and a company, for purposes of electronic reporting?

This is an important question, because it’s central to determining the applicability of electronic reporting to your workplace.

In 29 CFR 1904.46, OSHA defines an establishment as: “a single physical location where business is conducted or where services or industrial operations are performed.” One company can have, and often does have, multiple establishments.

A key distinction is that the applicability of the Recordkeeping Standard itself is based in part on company size, i.e., how many employees the company had at any one time during the reporting year, while applicability of electronic reporting is based on the number of employees at the establishment during the reporting year.

Which workplaces need to prepare and submit electronic injury and illness data?

Remember that OSHA established its applicability based on establishment size, not company size, and that applicability is based on both the employee threshold and the primary NAICS code. So, for example, if an establishment had 100+ employees at any one time during 2023 and has a primary NAICS code listed in the new Appendix B to Subpart E, the employer for that establishment would then need to electronically submit data from their 2023 Forms 300, 300A and 301 to OSHA via the ITA by March 2, 2024.

Here’s more detail about how requirements in OSHA’s 2023 electronic reporting final rule break down for each of the four categories of establishments listed in the table above.

Establishments with < 20 employees
If you have fewer than 20 employees at your establishment at any one time, you don’t need to do electronic injury and illness reporting, whether under current requirements or revised requirements. Just document your employee headcount, making sure it includes all eligible employees.

Certain establishments with 20-249 employees

Establishments with 20–249 employees in certain designated industries (listed in appendix A to subpart E) will continue to be required to electronically submit information from their Form 300A annual summary to OSHA once a year (final § 1904.41(a)(1)(i)).

Establishments with 100+ employees listed in the new Appendix B

Establishments with 100+ employees in certain designated industries (listed in new appendix B to subpart E) will be newly required to electronically submit information from their OSHA Forms 300 and 301 to OSHA once a year (final § 1904.41(a)(2)). The industries listed in new appendix B were chosen based on three measures of industry hazardousness.

Establishments with 250+ employees subject to Recordkeeping Standard

Establishments with 250+ employees in industries that are required to routinely keep OSHA injury and illness records will continue to be required to electronically submit information from the Form 300A to OSHA once a year.

How do I determine my NAICS code?

A good place to start is by visiting the US government’s NAICS website. From there you can use the search engine by entering a keyword that describes your kind of business, then reviewing the list of primary business activities containing that keyword and the corresponding NAICS codes. Choose the one that most closely corresponds to your primary business activity or refine your search terms and try again to obtain other choices. Another option is to browse through the NAICS codes and titles to find your code, starting with more general categories and then drilling down through the more specific subcategories until you find the 6-digit code associated with the description that best matches your business.

What if you have more than one business activity occurring at your location? This is a common occurrence. In this case, per guidance from OSHA, you’ll choose the code that represents the activity that generates the most revenue for your establishment and/or has the most employees, whichever is more applicable to your business.

How does the number of NAICS codes included in the new Appendix B compare to the number of NAICS codes included in Appendix A?

NAICS codes listed in the new Appendix B established in OSHA’s 2023 electronic reporting final rule are a subset of those listed in Appendix A. In other words, every NAICS code in Appendix B is also in Appendix A.

How did OSHA decide which NAICS codes to include in the new Appendix B?

OSHA included NAICS codes in Appendix B based on three measures of industry hazardousness:

• A three-year average rate of Total Case Rate (TCR) in the BLS SOII for 2017, 2018, and 2019, of at least 3.5 cases per 100 full-time-employees.
• A higher Days Away, Restricted and Transferred (DART) Rate
• Higher fatality rate

In the Federal Register notice for the final rule, OSHA estimates that this focus on establishments with 100+ employees in higher hazard industries results in fewer than one percent of establishments in the country needing to submit additional data, but the injury and illness data submitted by those establishments will comprise nearly 30% of all reportable occupational injuries and illnesses.

This estimate shows the logic behind OSHA’s additional requirements for establishments with 100+ employees in Appendix B. The expanded requirements apply only to a small percentage of establishments that have disproportionately large numbers of injuries and illnesses.

What reporting period should I cover in the electronic reports?

The reporting period you’ll need to cover is the same as the reporting period reflected in the physical forms 300, 300A and 301 you need to maintain, specifically, the calendar year. For both the physical Form 300A (which you need to complete, sign and post by February 1st) and your electronic submission of 300A data, if applicable, the reporting period is the calendar year. So, for example, if you’re required to make electronic submissions by the March 2, 2024 deadline, the data submitted would cover the 2023 calendar year, from January 1 through December 31, 2023.

The Injury Tracking Application (ITA)

How do I create an ITA account?

If you’ve never set up an ITA account, don’t worry much about it – you’ll probably find the process to be similar to and not more difficult than setting up an online banking account. You’ll set up a user identification and an associated password, and you’ll get a confirmation email that will take you back to the login screen. From there you can start inputting establishment data.

The process is even easier if you already have a login.gov account for other federal government sites, because you can use the same login details for the ITA.

How can I set up multiple people in my company with ITA access?

Luckily, it’s easy to set up multiple employees with ITA access.

First, you’ll need to make sure that any employees you’ll want to have ITA access create an account with ITA, following the steps described above.

Then, you (or someone else at your company already authorized to submit data for your establishment) will need to add the employees as authorized submitters for your establishment. You do that by following these steps:

1. Login to the ITA and choose “View Establishment List”
2. Select on the establishment name link
3. Then select “Assign User”
4. Enter the e-mail address of the other ITA account holder
5. Select “User Role”
6. Then, select “Save”

Of course, make sure that any employees you’re setting up with access are aware you’ll be doing so and that they understand and accept their designated responsibilities.

Is there an easy way to submit data for multiple establishments?

Yes! You have the option to prepare and submit a batch file in CSV format containing electronic injury and illness data for multiple reporting establishments. You just submit the file once, and the ITA will receive the data for all included facilities at the same time.

One caveat: Each establishment name must be unique, because the ITA system won’t allow you to use the same establishment name more than once. There are some simple workarounds. For example, you can make each unique by adding a number or a city/town name to the end of the establishment name. For example, if your establishment name is ABC, you can give locations unique names by calling them ABC-1, ABC-2, ABC—3, etc., or you can make the location part of the name, by calling them (e.g.) ABC Atlanta, ABC Chicago, ABC Milwaukee, and so on.

Finally, you should note that if you submit your data by CSV file, you will generate two confirmation e-mails. The first e-mail will indicate the ITA received your file. If you submitted a properly formatted file, the second e-mail will indicate which establishments successfully loaded and which establishments contained data errors. If your file contains invalid data and could not be loaded, the email will contain an error message.

OSHA’s Publication of Employer Injury and Illness Data

Why is OSHA going to be publishing employer data?

OSHA maintains that the publication of data from Recordkeeping forms will enhance the effectiveness of the Recordkeeping Standard by improving access to key data about workplace injuries and illnesses. “Congress intended for the Occupational Safety and Health Act to include reporting procedures that would provide the agency and the public with an understanding of the safety and health problems workers face, and this rule is a big step in finally realizing that objective,” Assistant Secretary for Occupational Safety and Health Doug Parker states in a . “OSHA will use this data to intervene through strategic outreach and enforcement to reduce worker injuries and illnesses in high-hazard industries. The safety and health community will benefit from the insights this information will provide at the industry level, while workers and employers will be able to make more informed decisions about their workplace’s safety and health.”

How will OSHA protect confidential employee information when publishing data?

Many stakeholders have expressed concern about this issue, going back to the time OSHA first proposed publication of employer injury and illness data during the rulemaking process that resulted in the 2016 final rule establishing electronic reporting requirements. OSHA has already published 300A data for reporting years from 2016 through 2022 on its site, but because 300A data contains only summary-level info about numbers and rates of injuries and illnesses with no identifying details about individual incidents, there is no potential for disclosure of confidential employee information.

Things have changed now that OSHA has revisited its original intention to require submission of information from Forms 300 and 301; affected establishments with 100+ employees and NAICS codes listed in Appendix B will need to submit their 2023 data from all three OSHA forms by March 2, 2024. Forms 300 and especially 301 contain more details about specific incidents, including identifying information about the employees involved, whether hospitalizations were involved, diagnosis of specific injuries and illnesses, and description of medical treatments administered. In the absence of safeguards, there is a possibility that protected personal and confidential information could be publicly shared when OSHA publishes this information.

How will OSHA avoid disclosing personal information? In the Federal Register notice for the final rule, OSHA states that they will not collect employee names or addresses, names of health care professionals, or names and addresses of facilities where treatment was provided if treatment was provided away from the worksite from Forms 300 and 301.

But what will OSHA do if employer-submitted forms contain this information? The Federal Register notice states that OSHA “plans to use automated de-identification technology, supplemented with some manual review of the data, to identify and remove information that could reasonably be expected to identify individuals directly from the fields the agency intends to publish,” and that “the agency will not publish text-based data until such information, if any, has been identified and removed.” The Federal Register notice also states that for coded data, OSHA plans to use an automated coding system to code the collected data, and that until the autocoding system has been tested and is in place, OSHA intends to only use and publish uncoded data.

It remains to be seen how OSHA will sort out the details on how to strip out protected information, or how long it will take them to put what they consider to be effective enough systems in place to move forward with publishing employer injury and illness data.

Consequences of Non-Reporting

How is OSHA targeting establishments that haven’t reported?

This is important to understand because the evidence suggests that many employers have failed to submit electronic injury and illness reports, despite being required to do so.

One of the primary enforcement tools OSHA uses for electronic injury and illness reporting is the Site-Specific Targeting (SST) Program. The current version of the SST, which went into effect on February 7, 2023, targets establishments for inspection if they have significantly lower or higher than industry average injury rates based on reporting year 2021 data, or upward-trending injury rates based on 2019 through 2021 data. Additionally, the SST states that OSHA will target apparent non-responders that (based on OSHA’s information) had obligations to prepare and submit electronic 300A data but failed to do so for reporting year 2021.

Inspections conducted under the SST will be “comprehensive in scope,” and during facility visits, Compliance, Safety and Health Officers (CSHOs) will review the OSHA 300 logs, 300A summaries, and 301 incident reports for three prior calendar years, which will include CY 2019, 2020, and 2021. This shows that employers need to think about not only the accuracy, but also the accessibility of their records, to keep recordkeeping mistakes from snowballing. Failure to complete and submit electronic injury and illness records when required to do so places your establishment on a prioritized list for inspection, and failure to produce other required forms during the inspection increases the likelihood of violations and fines.

This point about sharpening injury and illness recordkeeping practices is especially important because OSHA is also incorporating review of Recordkeeping forms and electronic reporting into other enforcement initiatives. For example, OSHA’s recent National Emphasis Program (NEP) for the warehousing and distribution sector states that when OSHA Compliance Safety and Health Officers (CSHOs) are inspecting an establishment under the NEP and identify that the establishment should have electronically submitted 300A data via the Injury Tracking Application (ITA) but didn’t, CSHOs will follow OSHA’s Interim Enforcement Procedures for Failure to Submit Electronic Illness and Injury Records under 29 CFR 1904.41(a)(1).

What should I do if I should have reported, but haven’t?

Here’s a bit of perspective on this question. Establishments subject to electronic injury and illness reporting requirements first needed to submit data for reporting year 2016 by the end of 2017. Starting in early 2018, we started meeting EHS professionals at conferences who had just recently learned that they should have prepared and submitted electronic 300A data, but did not, and wanted to know what they should do.

The advice we’ll give now is the same we gave to those conference talk attendees in 2018, which is namely, prepare and submit the reports as quickly as possible, and include an explanation of how you identified the failure to report, and how you’ll be ensuring that you’ll be meeting your requirements going forward. OSHA has been showing some willingness to work with employers who may not have understood their reporting obligations (e.g., they told GAO in 2021 that they’d sent “reminders” to about 27,000 establishments who had already passed their reporting deadline. The agency likely already knows that you should’ve reported but didn’t, and it’s better to be proactive and get the data to them (along with a mea culpa and resolution to do better) than it is to wait for OSHA to come to you.

OSHA has periodically released data indicating that they have had a significant percentage of non-responders, based on their own data regarding the number of establishments that needed to report. For instance, in 2021, OSHA told the Government Accountability Office (GAO) that they identified nearly 220,000 employers in 2019 who may not have reported their data. During the period from mid-December 2017 through September 2019, OSHA also cited 255 employers for failure to electronically report because of information that OSHA CSHOs obtained during on-site inspections. This data shows that the problem of non-reporting is widespread, and creates some urgency about understanding the applicability of electronic reporting requirements to your business.

Meeting Updated Requirements Under OSHA’s 2023 Electronic Reporting Final Rule

The best way EHS professionals and company leadership can prepare is to start reassessing and improving their incident management practices right now. You’ll need reliable methods to ensure that you’re capturing and documenting all OSHA recordable injuries and illnesses and maintaining accurate injury and illness records. Complete and accurate injury and illness recordkeeping is important for proactive EHS management even aside from regulatory requirements, but it becomes even more urgent given the possibility that OSHA is preparing to make records for some establishments publicly available.

Modern safety management software can help by making it easy for you and your workers to report incidents, document follow-up, and generate accurate OSHA forms. Even better, you’ll be able to access forms for multiple establishments from anywhere, at any time, and electronically submit forms to OSHA via the ITA.

If your current recordkeeping methods cause you to feel anxious about meeting OSHA’s revised electronic reporting requirements, now’s the time to start looking for better alternatives.

Let VelocityEHS Help!

Preparation for OSHA’s 2023 electronic reporting final rule will be easier if you have the right tools.

Our Safety Solution, part of our VelocityEHS Accelerate ® Platform, has incident management capabilities that can help you meet your Recordkeeping requirements, with mobile incident reporting and the ability to quickly attach photographs and other documentation to the inspection record. We also help you easily complete Forms 300, 300A and 301. Best of all, we make it easy to generate electronic versions of all three OSHA forms for easy transmission to OSHA via the Injury Tracking Application (ITA). And if you have reporting obligations for multiple establishments, you can cut down on reporting time by putting information for multiple establishments on a single .csv file.

Visit our solution landing page for more information, or just contact us anytime.