Recording Privacy Cases | Recordkeeping Guidelines

If you have a privacy concern case, you cannot enter the employee's name on the 300 Log. Instead, enter "privacy case" in the space normally used for the employee's name. This will protect the privacy of the injured or ill employee when an authorized person requests access to the Log. Keep a separate, confidential list of the case numbers and employee names for your privacy concern cases so you can update the cases and provide the information to the government if asked to do so. The following privacy concern cases are the only types of occupational injuries and illnesses that fall under this category:

• An injury or illness to an intimate body part or the reproductive system;

• An injury or illness resulting from a sexual assault;

• Mental illnesses;

• HIV infection, hepatitis, or tuberculosis;

• Needlestick injuries and cuts from sharp objects that are contaminated with another person's blood or other potentially infectious material; and

• Other illnesses, if the employee independently and voluntarily requests that his or her name not be entered on the Log.

Identifiable Information

In certain injury or illness cases, coworkers who are allowed to access the Log may be able to deduce the identity of the injured or ill worker and obtain inappropriate knowledge of a privacy-sensitive injury or illness. For instance, knowing the department in which the employee works could inadvertently divulge the person's identity.

If you have a reasonable basis to believe that information describing the privacy concern case may be personally identifiable even though the employee's name has been omitted, use discretion in describing the injury or illness on both the OSHA 300 and 301 forms. Enter enough information to identify the cause of the incident and the general severity of the injury or illness, but do not include details of an intimate or private nature. For example, a sexual assault case could be described as "injury from assault," or an injury to a reproductive organ could be described as "lower abdominal injury."

If you decide to voluntarily disclose the recordkeeping forms to persons other than government representatives, employees, former employees or authorized representatives, remove or hide the employees' names and other personally identifying information, except for the following cases. You may disclose the forms with personally identifying information only:

• To an auditor or consultant hired by the employer to evaluate the safety and health program;

• To the extent necessary for processing a claim for workers' compensation or other insurance benefits; or

• To a public health authority or law enforcement agency for uses and disclosures for which consent, an authorization, or opportunity to agree or object is not required.