380 Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 

DEPARTMENT OF LABOR 

Occupational Safety and Health 

Administration 

29 CFR Part 1904 

[Docket No. OSHA–2013–0023] 

RIN 1218–AD17 

Tracking of Workplace Injuries and 

Illnesses 

AGENCY: Occupational Safety and Health 

Administration (OSHA), Labor. 

ACTION: Final rule. 

SUMMARY: To protect worker privacy, the 

Occupational Safety and Health 

Administration (OSHA) is amending the 

recordkeeping regulation by rescinding 

the requirement for establishments with 

250 or more employees to electronically 

submit information from OSHA Forms 

300 and 301. These establishments will 

continue to be required to maintain 

those records on-site, and OSHA will 

continue to obtain them as needed 

through inspections and enforcement 

actions. In addition to reporting 

required after severe injuries, 

establishments will continue to submit 

information from their Form 300A. Such 

submissions provide OSHA with ample 

data that it will continue seeking to 

fully utilize. In addition, OSHA is 

amending the recordkeeping regulation 

to require covered employers to submit 

their Employer Identification Number 

(EIN) electronically along with their 

injury and illness data submission, 

which will facilitate use of the data and 

may help reduce duplicative employer 

reporting. Nothing in the final rule 

revokes an employer’s duty to maintain 

OSHA Forms 300 and 301 for OSHA 

inspection. These actions together will 

allow OSHA to improve enforcement 

targeting and compliance assistance, 

decrease burden on employers, and 

protect worker privacy and safety. 

DATES: This final rule becomes effective 

on February 25, 2019. 

Collections of information: There are 

collections of information contained in 

this final rule. (See Section XI, 

Paperwork Reduction Act). 

Notwithstanding the general date of 

applicability that applies to all other 

requirements contained in the final rule, 

affected parties do not have to comply 

with the collections of information until 

the Department of Labor publishes a 

separate document in the Federal 

Register announcing that the Office of 

Management and Budget has approved 

them under the Paperwork Reduction 

Act. 

ADDRESSES: In accordance with 28 

U.S.C. 2112(a)(2), OSHA designates 

Edmund Baird, Acting Associate 

Solicitor of Labor for Occupational 

Safety and Health, Office of the 

Solicitor, Room S–4004, U.S. 

Department of Labor, 200 Constitution 

Avenue NW, Washington, DC 20210, to 

receive petitions for review of the final 

rule. 

FOR FURTHER INFORMATION CONTACT:

For press inquiries: Frank Meilinger, 

OSHA Office of Communications, 

telephone: (202) 693–1999; email: 

meilinger.francis2@dol.gov. 

For general and technical 

information: Amanda Edens, Director, 

Directorate of Technical Support and 

Emergency Management, telephone: 

(202) 693–2300; email: edens.mandy@

dol.gov. 

SUPPLEMENTARY INFORMATION: 

Table of Contents 

I. Background 

A. Introduction 

B. Regulatory History 

II. Legal Authority 

III. Summary and Explanation of the Final 

Rule 

A. Rescission of Requirement for Certain 

Establishments To Submit Data From 

OSHA Forms 300 and 301 to OSHA 

Electronically 

B. New Requirement To Include Employer 

Identification Number With Injury and 

Illness Data Submitted to OSHA 

Electronically Under 29 CFR 1904.41 

IV. Final Economic Analysis and Regulatory 

Flexibility Analysis 

A. Introduction 

B. Cost Savings 

C. New Costs (From the EIN Collection) 

D. Net Cost Savings 

E. Benefits 

F. Economic Feasibility 

G. Regulatory Flexibility Certification 

H. Executive Order 13771: Reducing 

Regulation and Controlling Regulatory 

Costs 

V. Unfunded Mandates 

VI. Federalism 

VII. State-Plan States 

VIII. Environmental Impact Assessment 

IX. Paperwork Reduction Act 

X. Consultation and Coordination With 

Indian Tribal Governments 

Citation Method 

In the docket for this rulemaking 

found at http://www.regulations.gov, 

every submission was assigned a 

document identification (ID) number 

that consists of the docket number 

(OSHA–2013–0023) followed by an 

additional four-digit number. For 

example, the document ID number for 

the proposed rule is OSHA–2013–0023– 

1922. Some document ID numbers 

include one or more attachments, such 

as one of the submissions by the 

National Institute for Occupational 

Safety and Health (NIOSH). (See 

Document ID OSHA–2013–0023–2003). 

When citing exhibits in the docket in 

this preamble, OSHA includes the term 

‘‘Document ID’’ followed by the last four 

digits of the document number; the 

attachment number or other attachment 

identifier, if applicable (designated as 

‘‘A,’’ followed by the number of the 

attachment); page numbers, if 

applicable; and, in a limited number of 

cases, a footnote number (designated as 

‘‘Fn’’). In a citation that contains two or 

more document ID numbers, the 

document ID numbers are separated by 

semi-colons. For example, a citation 

referring to an attachment to the 

National Association of Home Builders’ 

comments and the second attachment to 

the United Steelworkers’ comments 

would be indicated as follows: 

(Document ID 2044–A1, pp. X–X; 2086– 

A2, p. X). 

The exhibits in the docket, including 

public comments, supporting materials, 

meeting transcripts, and other 

documents, are listed on http://

www.regulations.gov. All exhibits are 

listed in the docket index on http://

www.regulations.gov, but some exhibits 

(e.g., copyrighted material) are not 

available to read or download from that 

website. All materials in the docket are 

available for inspection at the OSHA 

Docket Office, Room N–3508, U.S. 

Department of Labor, 200 Constitution 

Avenue NW, Washington, DC 20210; 

telephone (202) 693–2350. 

I. Background 

A. Introduction 

OSHA’s regulation at 29 CFR part 

1904 requires employers with more than 

10 employees in most industries to keep 

records of occupational injuries and 

illnesses at their establishments. 

Employers covered by these rules must 

record each recordable employee injury 

and illness on an OSHA Form 300, 

which is the ‘‘Log of Work-Related 

Injuries and Illnesses,’’ or equivalent. 

Employers must also prepare a 

supplementary OSHA Form 301 ‘‘Injury 

and Illness Incident Report’’ or 

equivalent that provides additional 

details about each case recorded on the 

OSHA Form 300. At the end of each 

year, employers are required to prepare 

a summary report of all injuries and 

illnesses on the OSHA Form 300A, 

which is the ‘‘Summary of Work-Related 

Injuries and Illnesses,’’ and post the 

form in a visible location in the 

workplace. 

The recordkeeping regulation also 

requires establishments with 250 or 

more employees that are currently 


khammond on DSKBBV9HB2PROD with RULES2
Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 381 

1Although the initial deadline for electronic 

submission of information from OSHA Forms 300 

and 301 by covered establishments with 250 or 

more employees was July 1, 2018, OSHA indicated 

in the proposed rule that it would not enforce that 

deadline without further notice while this 

rulemaking was underway. (83 FR at 36496). 

Furthermore, no secure Web portal for collecting 

data from Forms 300 and 301 was built while the 

2016 rule was being developed or after it was 

finalized. As a result, while OSHA already has 

extensive 300A data from 214,574 establishments 

that have proven useful and which it is seeking to 

fully utilize, OSHA has never received the data 

submissions from Forms 300 and 301 that the 2016 

rule anticipated. 

required to keep OSHA injury and 

illness records to electronically submit 

information from the OSHA Forms 300, 

300A, and 301 to OSHA annually.1

Establishments with 20–249 employees 

in certain designated industries are 

required to electronically submit 

information only from the OSHA Form 

300A—the summary form. To protect 

worker privacy, this final rule 

eliminates the requirement that 

establishments with 250 or more 

employees that are currently required to 

keep OSHA injury and illness records 

submit information electronically from 

their OSHA Forms 300 and 301. These 

establishments, as well as 

establishments with 20 or more 

employees, but fewer than 250 

employees, in certain designated 

industries, must continue to submit 

information electronically from their 

part 1904 annual summary (Form 300A) 

to OSHA or OSHA’s designee on an 

annual basis. The final rule also requires 

all establishments that must submit 

information electronically from their 

part 1904 annual summary (Form 300A) 

to submit their Employer Identification 

Number (EIN). 

Elimination of the requirement that 

establishments with 250 or more 

employees submit information 

electronically from their OSHA Forms 

300 and 301—a requirement that has not 

yet been enforced—does not change any 

employer’s obligation to complete and 

retain injury and illness records under 

OSHA’s regulations for recording and 

reporting occupational injuries and 

illnesses. The final rule also does not 

add to or change the recording criteria 

or definitions for these records. 

OSHA’s collection and use of the 

summary data from form 300A, and 

information concerning severe injuries 

it also receives, give OSHA the 

information it needs to identify and 

target for potential enforcement actions 

those establishments with high rates of 

work-related injuries and illnesses. For 

example, OSHA has collected summary 

300A data for 2016 from 214,574 

establishments, and expects to collect a 

greater volume of 2017 summary data. 

With the data, OSHA has already 

designed a targeted enforcement 

mechanism for industries experiencing 

higher rates of injuries and illnesses. 

OSHA plans to further refine its 

approach as it seeks to fully utilize these 

data from form 300A, and it will 

likewise continue to use information 

received from severe injury reports. 

In light of this backdrop, OSHA has 

determined that the rule will benefit 

worker privacy by preventing routine 

government collection of information 

that may be quite sensitive, including 

descriptions of workers’ injuries and the 

body parts affected, and thereby 

avoiding the risk that such information 

might be publicly disclosed under the 

Freedom of Information Act (FOIA) or 

through the Injury Tracking 

Application. OSHA has also concluded 

that the extent of any incremental 

benefits of collecting the data from 

Forms 300 and 301 for OSHA 

enforcement and compliance assistance 

activities is uncertain. OSHA has 

determined that avoiding this risk to 

worker privacy outweighs the data’s 

uncertain incremental benefits to 

enforcement. The rule will allow OSHA 

to focus agency resources on the 

collection and use of 300A data 

described above, and severe injury 

reports, as well as data from other 

initiatives that its past experience has 

proven useful—instead of diverting 

those resources toward developing a 

Web portal for, and then collecting, 

manually reviewing, and analyzing data 

from Forms 300 and 301. 

This rule is a deregulatory action 

under Executive Order 13771 (82 FR 

9339 (January 30, 2017)). It has 

annualized net cost savings estimated at 

$16 million. The savings from 

elimination of the requirement that 

establishments with 250 or more 

employees submit information 

electronically from their OSHA Forms 

300 and 301 will be $8.9 million per 

year. New costs not included in the 

2016 final rule are estimates of cost 

savings to the government from 

avoiding a manual review of all data 

from Forms 300 and 301 to identify and 

remove PII and other information that 

could be re-identified with individuals. 

This cost will be $7.5 million per year. 

The total cost of providing EINs will be 

$2.2 million the first year these data are 

submitted, and will be $223,000 per 

year every year after that. A detailed 

discussion of OSHA’s estimates of the 

rule’s benefits, costs, and cost savings is 

included in section IV, Final Economic 

Analysis and Regulatory Flexibility 

Certification. 

B. Regulatory History 

OSHA’s regulations on recording and 

reporting occupational injuries and 

illnesses (29 CFR part 1904) were first 

issued in 1971 (36 FR 12612 (July 2, 

1971)). These regulations require the 

recording of work-related injuries and 

illnesses that involve death, loss of 

consciousness, days away from work, 

restriction of work, transfer to another 

job, medical treatment other than first 

aid, or diagnosis of a significant injury 

or illness by a physician or other 

licensed health care professional. (29 

CFR 1904.7). 

On July 29, 1977, OSHA amended 

these regulations to partially exempt 

businesses having ten or fewer 

employees during the previous calendar 

year from the requirement to record 

occupational injuries and illnesses. (42 

FR 38568). Then, on December 28, 1982, 

OSHA amended the regulations again to 

partially exempt establishments in 

certain lower-hazard industries from the 

requirement to record occupational 

injuries and illnesses. (47 FR 57699). 

OSHA also amended the recordkeeping 

regulations in 1994 (Reporting of 

Fatality or Multiple Hospitalization 

Incidents, 59 FR 15594) and 1997 

(Reporting Occupational Injury and 

Illness Data to OSHA, 62 FR 6434). 

Under the version of § 1904.41 added by 

the 1997 final rule, OSHA began 

requiring certain employers to submit 

their 300A data to OSHA annually 

through the OSHA Data Initiative (ODI). 

Through the ODI, OSHA collected data 

on injuries and acute illnesses 

attributable to work-related activities in 

the private sector from approximately 

80,000 establishments in selected highhazard industries. The agency used 

these data to calculate establishmentspecific injury and illness rates, and in 

combination with other data sources, to 

target enforcement and compliance 

assistance activities. 

On January 19, 2001, OSHA issued a 

final rule amending its requirements for 

the recording and reporting of 

occupational injuries and illnesses (29 

CFR parts 1904 and 1952), along with 

the forms employers use to record those 

injuries and illnesses. (66 FR 5916). The 

final rule also updated the list of 

industries that are partially exempt from 

recording occupational injuries and 

illnesses. 

On September 18, 2014, OSHA again 

amended the regulations to require 

employers to report work-related 

fatalities and severe injuries—in-patient 

hospitalizations, amputations, and 

losses of an eye—to OSHA and to allow 

electronic reporting of these events. (79 

FR 56130). The final rule also revised 


khammond on DSKBBV9HB2PROD with RULES2
382 Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 

2 In the NPRM and in the final rule, OSHA has 

offered reasoned analysis for its preliminary and 

now final determination to rescind the requirement 

for covered employees to submit their 300 and 301 

data to OSHA electronically. OSHA has likewise 

considered and discussed the comments raised by 

those who also argue that OSHA’s decision runs 

afoul of the APA, (e.g., Document ID 2012–A1, pp. 

9, 15; 2028–A1, pp. 1–3, 6, 8), as well as other 

comments in the record. In short, this rule is a 

product of reasoned decision-making, has the 

support of substantial evidence in the record as a 

whole, and is appropriate based on policy concerns 

and OSHA’s obligations under the Act. 

the list of industries that are partially 

exempt from recording occupational 

injuries and illnesses. 

On May 12, 2016, OSHA amended the 

regulations on recording and reporting 

occupational injuries and illnesses to 

require employers, on an annual basis, 

to submit electronically to OSHA injury 

and illness information that employers 

are already required to keep under part 

1904. (81 FR 29624). Under the 2016 

revisions, establishments with 250 or 

more employees that are routinely 

required to keep records are also 

required to electronically submit 

information from their OSHA Forms 

300, 300A, and 301 to OSHA or OSHA’s 

designee once a year, and 

establishments with 20 to 249 

employees in certain designated 

industries are required to electronically 

submit information from their OSHA 

annual summary (Form 300A) to OSHA 

or OSHA’s designee once a year. In 

addition, that final rule required 

employers, upon notification, to 

electronically submit information from 

part 1904 recordkeeping forms to OSHA 

or OSHA’s designee. These provisions 

became effective on January 1, 2017, 

with an initial submission deadline of 

July 1, 2017, for 2016 Form 300A data 

described in 29 CFR 1904.41(c)(1). That 

submission deadline was subsequently 

extended to December 15, 2017. (82 FR 

55761). The deadline for electronic 

submission of information from OSHA 

Forms 300 and 301 was July 1, 2018. 

OSHA announced that it would not 

enforce this requirement without notice 

during this rulemaking, (83 FR at 

36496), and OSHA has never received 

the data submissions from Forms 300 

and 301 that the 2016 rule anticipated. 

On July 30, 2018, OSHA issued a 

notice of proposed rulemaking (NPRM 

or proposed rule) proposing to amend 

its recordkeeping regulations to remove 

the requirement for establishments with 

250 or more employees that are 

routinely required to keep records to 

electronically submit information from 

their OSHA Forms 300 and 301 to 

OSHA or OSHA’s designee once a year 

and to add a requirement for electronic 

submission of the EIN. (83 FR 36494). 

OSHA received 1,880 comments on the 

proposed rule. The issues raised in 

those comments are addressed herein. 

II. Legal Authority 

OSHA is issuing this final rule 

pursuant to authority expressly granted 

by sections 8 and 24 of the Occupational 

Safety and Health Act (the ‘‘OSH Act’’ 

or ‘‘Act’’). (29 U.S.C. 657, 673). Section 

8(c)(1) of the Act requires each 

employer to ‘‘make, keep and preserve, 

and make available to the Secretary [of 

Labor] or the Secretary of Health and 

Human Services, such records regarding 

his activities relating to this chapter as 

the Secretary [of Labor] . . . may 

prescribe by regulation as necessary or 

appropriate for the enforcement of this 

chapter or for developing information 

regarding the causes and prevention of 

occupational accidents and illnesses.’’ 

(29 U.S.C. 657(c)(1)). Section 8(c)(2) 

directs the Secretary to prescribe 

regulations ‘‘requiring employers to 

maintain accurate records of, and to 

make periodic reports on, work-related 

deaths, injuries and illnesses other than 

minor injuries requiring only first aid 

treatment and which do not involve 

medical treatment, loss of 

consciousness, restriction of work or 

motion, or transfer to another job.’’ (29 

U.S.C. 657(c)(2)). Finally, section 8(g)(2) 

of the OSH Act broadly empowers the 

Secretary to ‘‘prescribe such rules and 

regulations as he may deem necessary to 

carry out [his] responsibilities under 

this chapter.’’ (29 U.S.C. 657(g)(2)). 

Section 24 of the OSH Act (29 U.S.C. 

673) contains a similar grant of 

authority. This section requires the 

Secretary to ‘‘develop and maintain an 

effective program of collection, 

compilation, and analysis of 

occupational safety and health 

statistics’’ and ‘‘compile accurate 

statistics on work injuries and illnesses 

which shall include all disabling, 

serious, or significant injuries and 

illnesses.’’ (29 U.S.C. 673(a)). Section 24 

also requires employers to ‘‘file such 

reports with the Secretary as he shall 

prescribe by regulation.’’ (29 U.S.C. 

673(e)). These reports are to be based on 

‘‘the records made and kept pursuant 

to’’ section 8(c) of the OSH Act. (29 

U.S.C. 673(e)). 

The OSH Act requires cooperation 

with the Secretary of Health and Human 

Services concerning regulations that 

address reporting and recordkeeping, 

and consultation concerning the 

development and maintenance of a 

program for occupational safety and 

health statistics. OSHA has a lengthy 

history of cooperation and consultation 

with the Department of Health and 

Human Services in this regard, 

particularly with its sub-agency, the 

National Institute for Occupational 

Safety and Health. With respect to this 

rule, OSHA informally received 

feedback from NIOSH on its proposal, 

including reviewing a draft of NIOSH’s 

comment, and provided NIOSH, and 

HHS more generally, with opportunities 

to provide comment on both the 

proposed and this final rule before 

publication. 

Further support for the Secretary’s 

authority to require employers to keep 

and submit records of work-related 

illnesses and injuries is in the 

Congressional Findings and Purpose at 

the beginning of the OSH Act. (See 29 

U.S.C. 651). In that section, Congress 

declares the overarching purpose of the 

Act is ‘‘to assure so far as possible every 

working man and woman in the Nation 

safe and healthful working conditions.’’ 

(29 U.S.C. 651(b)). One of the ways in 

which the Act is meant to achieve this 

goal is ‘‘by providing for appropriate 

reporting procedures . . . [that] will 

help achieve the objectives of this 

chapter and accurately describe the 

nature of the occupational safety and 

health problem.’’ (29 U.S.C. 651(b)(12)). 

Notably, the statute does not require this 

information to be transmitted to OSHA. 

And, section 8(d) of the Act provides 

that any information the Secretary 

collects under the Act ‘‘shall be 

obtained with a minimum burden upon 

employers.’’ (29 U.S.C. 657(d)). 

The OSH Act authorizes the Secretary 

of Labor to issue two types of 

occupational safety and health rules: 

Standards and regulations. Standards 

aim to correct particular identified 

workplace hazards, while regulations 

further the general enforcement and 

detection purposes of the OSH Act. (See 

Workplace Health & Safety Council v. 

Reich, 56 F.3d 1465, 1468 (D.C. Cir. 

1995) (citing La. Chem. Ass’n v. 

Bingham, 657 F.2d 777, 781–82 (5th Cir. 

1981)); United Steelworkers of Am. v. 

Auchter, 763 F.2d 728, 735 (3d Cir. 

1985)). Recordkeeping requirements 

promulgated under the Act are 

characterized as regulations. (See 29 

U.S.C. 657 (using the term ‘‘regulations’’ 

to describe recordkeeping 

requirements)). An agency may revise a 

prior rule if it provides a reasoned 

explanation for the change. (See Motor 

Vehicle Mfrs. Ass’n v. State Farm Mut. 

Auto. Ins. Co., 463 U.S. 29, 42 (1983)).2

When promulgating regulations 

pursuant to sections 8 and 24 of the 

OSH Act, OSHA must comply with the 

Administrative Procedure Act (APA) (5 

U.S.C. 553), which requires the agency 

to publish notice of a proposed rule in 

the Federal Register and to provide an 

opportunity for interested persons to 


khammond on DSKBBV9HB2PROD with RULES2
Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 383 

3Of these, 1,641 were nearly identical form 

letters. 

comment on the rulemaking. In the 

NPRM, OSHA invited comment on ‘‘all 

aspects of the proposed rule’’ (83 FR at 

36505), and specifically encouraged 

comment on four questions regarding: 

(1) The risks and benefits of 

electronically collecting the 

information; (2) other agencies or 

organizations that use automated coding 

systems for text data in data collections; 

(3) other agencies or organizations that 

use automated de-identification systems 

to remove personal identifying 

information (PII) from text data before 

making the data available to the public; 

and (4) privacy issues regarding the 

submission of EINs. (83 FR at 36500). 

OSHA received 1,880 comments on 

the proposed rule.3 Pursuant to the 

APA, 5 U.S.C. 553, OSHA has reviewed 

these comments and responded to the 

material issues commenters raised. (See 

Genuine Parts Co. v. Envtl. Prot. 

Agency, 890 F.3d 304, 313 (D.C. Cir. 

2018) (although an agency ‘‘is not 

required to discuss every item of fact or 

opinion included in the submissions it 

receives in response to a Notice of 

Proposed Rulemaking, it must respond 

to those comments which, if true, would 

require a change in the proposed rule.’’) 

(quoting La. Fed. Land Bank Ass’n v. 

Farm Credit Admin., 336 F.3d 1075, 

1080 (D.C. Cir. 2003))). 

Some commenters raised issues such 

as the requirement for certain employers 

to submit their 300A data to OSHA (e.g., 

Document ID 2057–A1, pp. 2–3; 2053, p. 

3) and the employee protection 

provisions added by the 2016 final rule 

(e.g., Document ID 2006–A1, p. 4; 2009– 

A1, p. 4; 2023–A1). These comments 

were beyond the scope of this 

rulemaking, and this final rule does not 

make any changes to the relevant 

provisions. Nevertheless, OSHA 

acknowledges and shares some of the 

concerns these comments suggest. First, 

in relation to concerns raised about 

possible publication of data submitted 

electronically to OSHA from Form 

300A—and as identified in the NPRM 

and later in this final rule—the agency 

takes the position that these data are 

exempt from public disclosure under 

FOIA. It should likewise be noted that 

OSHA uses and will continue to use 

300A data to prioritize its inspections 

and enforcement actions. Among other 

considerations, disclosure of 300A data 

through FOIA may jeopardize OSHA’s 

enforcement efforts by enabling 

employers to identify industry trends 

and anticipate the inspection of their 

particular workplaces. As OSHA has 

explained elsewhere, OSHA is strongly 

opposed to disclosure of 300A data, has 

not made such data public, and does not 

intend to make any such data public for 

at least the approximately four years 

after its receipt that OSHA intends to 

use the data for enforcement purposes. 

In response to concerns about the 

application of the 2016 final rule to 

employee drug testing and incidentbased incentive programs, OSHA notes 

that the employee protection provisions 

promulgated by that final rule and 

codified at 29 CFR 1904.35 neither ban 

drug testing employees involved in 

workplace injury or illnesses, nor 

prohibit incident-based incentive 

programs. Rather, § 1904.35(b)(1)(iv) 

merely prohibits employers from 

implementing these programs to 

penalize workers ‘‘for reporting a workrelated injury or illness.’’ Id. (emphasis 

added). On October 11, 2018, OSHA 

issued a memorandum that explained 

this regulatory text and OSHA’s position 

on workplace incentive programs and 

post-incident drug testing. See U.S. 

Dep’t of Labor, Clarification of OSHA’s 

Position on Workplace Safety Incentive 

Programs and Post-Incident Drug 

Testing Under 29 CFR 

§ 1904.35(b)(1)(iv) (Oct. 11, 2018). That 

memorandum—which referred to the 

2016 final rule and its preamble— 

reiterated the rule’s limited scope and 

expressed how it ‘‘does not prohibit 

workplace safety incentive programs or 

post-incident drug testing.’’ Id. To the 

extent the 2016 preamble suggested 

otherwise, it has been superseded. 

While not the focus of this particular 

rulemaking, that memorandum 

accurately reflects OSHA’s position and 

addresses the commenters’ concerns. 

III. Summary and Explanation of Final 

Rule 

A. Rescission of Requirement for Certain 

Establishments To Submit Data From 

OSHA Forms 300 and 301 to OSHA 

Electronically 

As discussed in detail below, OSHA 

has determined that collecting the data 

from Forms 300 and 301, as was 

recently required under the 2016 final 

rule, would subject sensitive worker 

information to a meaningful risk of 

public disclosure. OSHA has also 

concluded that the extent of the 

incremental benefits of collecting the 

data for OSHA’s enforcement targeting 

and compliance assistance activities 

remains uncertain. Finally, OSHA has 

found that collecting the data and 

analyzing them for use would require 

OSHA to divert significant resources 

from agency priorities such as fully 

utilizing the 300A data and severe 

injury reports OSHA already collects 

electronically and that have proven 

useful in its experience for targeting 

areas of concern. 

After considering all of the comments 

in the record and balancing the risk to 

worker privacy against the uncertain 

extent of the benefits of collecting the 

data and OSHA’s resource priorities, 

OSHA has determined that the final rule 

is necessary to preserve sensitive worker 

information and conserve agency 

resources for initiatives with more 

concrete benefits to OSHA’s mission of 

assuring safe and healthful workplaces. 

Concerns About the Potential Release of 

Sensitive Worker Information 

A central reason OSHA proposed 

rescinding the requirement for certain 

employers to electronically submit 

information from Forms 300 and 301 to 

OSHA was ‘‘to protect sensitive worker 

information from potential disclosure 

under the Freedom of Information Act 

(FOIA).’’ (83 FR at 36494). As explained 

in greater detail below, although OSHA 

believes data from Forms 300 and 301 

would be exempt from disclosure under 

FOIA exemptions, OSHA is concerned 

that it still could be required by a court 

to release the data. Many commenters 

echoed this concern. 

OSHA’s position in this final rule is 

consistent with the principles 

articulated in the Privacy Act, OMB 

Circular A–130, and the Department’s 

position on the sensitive nature of 

worker injury and illness records before 

2016. (See Document ID 1930–A1, pp. 

2–3; 66 FR 5916, 6055–57 (Jan. 19, 

2001)). In 2001, for example, OSHA 

noted that it ‘‘historically has 

recognized that the Log and Incident 

Report (Forms 300 and 301, 

respectively) may contain information 

of a sufficiently intimate and personal 

nature that a reasonable person would 

wish it to remain confidential.’’ (66 FR 

at 6055). OSHA further explained that 

access to Forms 300 and 301 should be 

limited to workers and their 

representatives—in other words, those 

with a ‘‘need to know.’’ (66 FR at 6057). 

OSHA explained in 2001: 

OSHA agrees that confidentiality of injury 

and illness records should be maintained 

except for those persons with a legitimate 

need to know the information. This is a 

logical extension of the agency’s position that 

a balancing test is appropriate in determining 

the scope of access to be granted employees 

and their representatives. Under this test, 

‘‘the fact that protected information must be 

disclosed to a party who has [a particular] 

need for it . . . does not strip the information 

of its protection against disclosure to those 

who have no similar need.’’ 

(66 FR at 6057 (quoting Fraternal Order 

of Police Lodge No. 5. v. City of 


khammond on DSKBBV9HB2PROD with RULES2
384 Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 

Philadelphia, 812 F.2d 105, 118 (10th 

Cir. 1987))). Commenters agreed with 

OSHA that access to 300 and 301 data 

should be limited to those with a ‘‘need 

to know’’ (i.e., workers, their 

representatives, and OSHA upon 

request) (Document ID 2070–A1, p. 8; 

2084–A2). Thus, OSHA has always 

applied a balancing test to weigh the 

value of worker privacy against the 

usefulness of releasing the data. The 

2016 final rule represented a departure 

from the balance OSHA has historically 

struck in favor of achieving uncertain 

incremental benefits for OSHA 

enforcement and outreach. This final 

rule restores OSHA’s historical 

emphasis on protecting the privacy of 

workers and its longstanding practice of 

releasing sensitive data on a case-bycase basis only to those with a ‘‘need to 

know.’’ 

Multiple commenters commented that 

the proposed rule is consistent with the 

privacy protections in the Privacy Act of 

1974 (Pub. L. 93–579) and Section 4(g) 

of OMB Circular A–130. (E.g., Document 

ID 1930–A1, p. 2; 1981–A1, p. 3; 2041– 

A1, p. 2; see also Document ID 2036– 

A1, p. 4) (‘‘[C]ompelled disclosure of the 

incredibly private, personally 

identifiable information required by 

OSHA Forms 300 and 301 is contrary to 

the well-established principle that an 

individual’s right to privacy regarding 

medical conditions and treatment is of 

paramount importance.’’). Although the 

Privacy Act does not apply to Forms 300 

and 301, the statute’s articulation that 

privacy is ‘‘a personal and fundamental 

right’’ highlights the importance of this 

issue. (Document ID 1981–A1, p. 3 

(quoting Pub. L. 93–579, Section 

2(a)(4))). Furthermore, Section 4(g) of 

OMB Circular A–130 stresses that 

‘‘[p]rotecting an individual’s privacy is 

of utmost importance.’’ (Document ID 

1981–A1, p. 3 (quoting OMB Circular 

A–130 (2016), available at: https://

www.whitehouse.gov/sites/ 

whitehouse.gov/files/omb/circulars/ 

A130/a130revised.pdf)). To that end, 

Section 4(g) also states that ‘‘[t]he 

Federal Government shall consider and 

protect an individual’s privacy 

throughout the information life cycle.’’ 

(OMB Circular A–130). This final rule 

complies with this instruction by 

limiting the potential disclosure of PII 

and other sensitive worker information. 

Many commenters agreed with 

OSHA’s privacy concerns, pointing to 

the Department’s ‘‘special responsibility 

to protect PII from loss and misuse,’’ 

and arguing that OSHA should not 

collect the data from Forms 300 and 301 

because it cannot guarantee the 

protection of PII that may be submitted 

with the data. (Document ID 2045–A1, 

p. 3) (quoting Department of Labor, 

Guidance on the Protection of Personal 

Identifiable Information, available at: 

https://www.dol.gov/general/ppii). 

Commenters agreed with OSHA that the 

information reported on Forms 300 and 

301 is sensitive, and that the risk of 

disclosing this sensitive worker 

information is not worth the uncertain 

incremental benefits of collecting the 

data. (E.g., Document ID 1985–A1, pp. 

1–2; 2045–A1, pp. 2–3). Other 

comments agreed with OSHA that 

collecting Form 300A provides concrete 

enforcement benefits without putting 

private worker information at risk of 

disclosure. (E.g., Document ID 2008, pp. 

2–3). 

Some commenters cautioned that the 

300 and 301 data could include PII, 

which the Department defines as ‘‘any 

representation of information that 

permits the identity of an individual to 

whom the information applies to be 

reasonably inferred by either direct or 

indirect means[,]’’ such as ‘‘name, 

address, social security number or other 

identifying number or code, telephone 

number, email address, etc.’’ (E.g., 

Document ID 2045, pp. 2–3) (quoting 

Department of Labor, Guidance on the 

Protection of Personal Identifiable 

Information, available at: https://

www.dol.gov/general/ppii)). Although 

some of these commenters are under the 

mistaken impression that employers 

would be required to submit PII such as 

name, address, or the name of the 

treating physician under the prior final 

rule (compare e.g., Document ID 2041– 

A1, pp. 1–2 with 81 FR at 29660–61), 

OSHA shares these commenters’ 

concern that collection of data from 

Forms 300 and 301 poses a risk of the 

release of PII. 

It is foreseeable that, despite 

instructions not to include such 

information, some employers would 

submit PII inadvertently in Forms 300 

and 301, for example in the narrative 

description of the incident in Column F 

of the 300 Log. (See 81 FR at 29662; 

Document ID 2019–A1, pp. 2–3). 

Although one commenter’s experience 

demonstrated employers’ capability of 

fully redacting PII from a small dataset 

(Document ID 2077–A1, pp. 1, 2), ‘‘[i]t 

has been OSHA’s experience that 

information entered in Column F of the 

300 Log may contain personallyidentifiable information. For example, 

when describing an injury or illness, 

employers sometimes include names of 

employees.’’ (81 FR at 29662). 

Whereas in the past, OSHA has 

manually screened smaller datasets for 

PII, the dataset at issue in this 

rulemaking would be far too large to 

screen manually for employer 

compliance with an instruction not to 

include PII, and OSHA is concerned 

that alternative approaches would not 

sufficiently alleviate the risk of 

disclosure. For example, OSHA stated 

in the 2016 final rule that it would 

‘‘review’’ the data for PII using 

software—and some commenters urged 

a similar review (e.g., Document ID 

1989–A1, p. 1; 2004–A1, p. 1)—but this 

software is imperfect. As discussed in 

the NPRM, ‘‘it is not possible to 

guarantee the non-release of PII.’’ (83 FR 

at 36498 (citing ‘‘De-Identification of 

Personal Information,’’ p. 5, Simson L. 

Garfinkel, NISTIR 8053, October 2015, 

Document ID 2060)). No commenters 

provided evidence to the contrary. 

Therefore, OSHA finds that it would not 

be able to guarantee that all PII 

inadvertently submitted to OSHA would 

be protected from disclosure. (83 FR at 

36498). 

Moreover, even if PII could be 

completely removed from the data, 

concerns about re-identification would 

remain. As many commenters noted, 

several data points on Forms 300 and 

301 could be combined to reveal the 

identity of workers who reported workrelated injuries or illnesses, particularly 

in a small town. (E.g., Document ID 

2032–A1; 2044–A1, p. 5 (quoting prior 

comment); 2045–A1, pp. 2–3, 5; 2070– 

A1, pp. 3, 11, 15–16). As the Phylmar 

Regulatory Roundtable (PRR) explained: 

For example, even with the employee’s 

name removed, PRR members believe it 

would be easy to determine a worker’s 

identity when reviewing the information in 

the remaining fields on Form 300: Job title 

(field C), where the event occurred (E), and 

details on the injury and body parts affected 

(F). On the 301 Report, combining multiple 

data points, for example, the date of the 

injury or illness (11), what time the employee 

began work (12), time of event (13), what was 

the employee doing just before the incident 

occurred (14), what happened (15), and what 

was the injury or illness (16), could also 

result in identifying the worker. While 

individual fields, standing alone, would not 

be considered traditional ‘‘PII,’’ (e.g., name, 

address), once linked, there is a substantial 

risk that employees may be identified, thus 

violating their privacy. 

(Document ID 2070–A1, p. 3). Thus, 

even with PII removed from the data, in 

many circumstances it may be possible 

to combine data points to identify 

specific workers who reported injuries 

or illnesses along with personal details 

about their conditions. 

These privacy concerns are real and 

important. As OSHA stated in the 

NPRM, some of the information 

collected on Forms 300 and 301 may be 

sensitive for workers. (E.g., 83 FR at 

36495). For example, many of the 

questions on Form 301 seek answers 


khammond on DSKBBV9HB2PROD with RULES2
Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 385 

that could contain sensitive information 

about workers, including: 

• Was the employee treated in an 

emergency room? 

• Was the employee hospitalized 

overnight or as an in-patient? 

• Date of birth. 

• Date of injury. 

• What was the employee doing just 

before the incident occurred? Describe 

the activity, as well as the tools, 

equipment, or material the employee 

was using. Be specific. Examples: 

‘‘climbing a ladder while carrying 

roofing materials’’; ‘‘spraying chlorine 

from hand sprayer’’; ‘‘daily computer 

key-entry.’’ 

• What happened? Tell us how the 

injury occurred. Examples: ‘‘When 

ladder slipped on wet floor, worker fell 

20 feet’’; ‘‘Worker was sprayed with 

chlorine when gasket broke during 

replacement’’; ‘‘Worker developed 

soreness in wrist over time.’’ 

• What was the injury or illness? Tell 

us the part of the body that was affected 

and how it was affected; be more 

specific than ‘‘hurt,’’ ‘‘pain,’’ or ‘‘sore.’’ 

Examples: ‘‘strained back’’; ‘‘chemical 

burn, hand’’; ‘‘carpal tunnel syndrome.’’ 

• What object or substance directly 

harmed the employee? Examples: 

‘‘concrete floor’’; ‘‘chlorine’’; ‘‘radial 

arm saw.’’ 

(83 FR at 36495–96). Some commenters 

disagreed that injury descriptions like 

those above are sensitive (e.g., 

Document ID 2048–A1, p. 2; 1978–A1, 

p. 2; 2048–A1, p. 2), but other 

commenters provided additional 

examples of sensitive information that 

could appear on Form 300 or 301, such 

as contracting an infectious disease from 

a patient, being assaulted in the 

workplace, or being diagnosed with 

depression or post-traumatic stress 

disorder. (E.g., Document ID 2044–A1, 

pp. 5–6 (quoting prior comment); 2070– 

A1, pp. 15–16). A commenter also noted 

that some records could implicate the 

privacy of non-employees, such as 

patients involved in the occurrence of a 

workplace injury or illness. (Document 

ID 1960–A1). 

Other commenters disagreed with 

OSHA’s preliminary determination that 

the data from Forms 300 and 301 are 

sensitive. (E.g., Document ID 1961–A1, 

p. 2; 2081–A2, p. 1; 1984–A1, p. 2; 

1978–A1, p. 2; 2017–A1, p. 3). For 

example, one commenter maintained 

that information such as a description of 

an injury is integral to OSHA’s 

investigation and is not private or 

privileged, like medical advice or other 

communication between a patient and 

doctor. (Document ID 2017–A1, p. 3). 

OSHA agrees that not all of the 300 and 

301 data are always sensitive, but 

maintains that some of the data are 

sensitive and remain sensitive even if 

not legally privileged and even though 

OSHA intends to continue to use these 

data during onsite inspections. 

Commenters asserting that OSHA’s 

privacy concerns are disingenuous (e.g., 

Document ID 1976–A1, pp. 2–3; 1984– 

A1, pp. 1–2; 2022–A1, p. 3; 2038–A1, p. 

2; Document ID 1978–A1, p. 2; 2088– 

A1, p. 3) fail to appreciate the real 

possibility of the disclosure of sensitive 

worker information. The comment (and 

others like it) that ‘‘[t]he risk to worker 

privacy is very minimal and unlikely to 

materialize’’ (Document ID 2011–A1, p. 

5) discounts the risk to worker privacy 

that OSHA’s experience—of having to 

remove PII and other information that 

could re-identify the ill or injured 

worker during manual screening of 

forms prior to release—has shown. 

Although many advocacy groups 

submitted similarly-worded comments 

stating that the data from Forms 300 and 

301 are not sensitive (e.g., Document ID 

1976–A1, p. 3; 2058–A1, p. 2; 2059–A1, 

p .2; 1976–A1, p. 3), private citizens and 

health advocacy organizations 

expressed concern about the sensitive 

nature of the data and emphasized the 

importance of keeping sensitive worker 

information out of the public eye. (E.g., 

Document ID 1938; 1975; 1979; 2006– 

A1, p. 2). OSHA agrees with the latter 

commenters that sensitive information 

can be included in the data on these 

Forms and should be protected against 

public disclosure. 

Moreover, many of those taking the 

view that privacy concerns about the 

data were overstated expressed their 

confidence that OSHA could guarantee 

the protection of any PII contained in 

the data, a confidence that OSHA does 

not share. (E.g., Document ID 2031 

(‘‘The 2016 provisions clearly stated 

that no information that would identify 

individual workers was to be reported. 

If such information was accidentally 

submitted, OSHA made it clear it would 

never be released to the public.’’); 2038– 

A1, p. 2 (‘‘The 2016 provisions clearly 

state that no information tied to any 

individual worker(s) was to be reported. 

If such information was inadvertently 

submitted, OSHA ensured [sic] us it 

would never be released to the 

public.’’)). 

It is true, as some commenters noted, 

that OSHA considered the issue of 

worker privacy in the 2016 final rule 

and included protections to reduce the 

likelihood of sensitive information 

being made public, (Document ID 2028– 

A1, p. 6), but OSHA no longer views 

such protections as sufficient. OSHA 

noted in 2016, for example, that 

‘‘consistent with FOIA, the agency does 

not intend to post personally 

identifiable information on the 

website.’’ (81 FR at 29659 (emphasis 

added)). Yet OSHA did not—and 

cannot—guarantee non-release of PII. In 

fact, OSHA acknowledged in 2016 that 

Forms 300 and 301 could contain PII in 

the fields that employers were required 

to submit. (See 81 FR at 29662 (‘‘It has 

been OSHA’s experience that 

information entered in Column F of the 

300 Log may contain personallyidentifiable information. For example, 

when describing an injury or illness, 

employers sometimes include names of 

employees.’’)). Although OSHA 

previously thought to address this issue 

with software, de-identification software 

is not 100% effective, and OSHA 

believes that some PII could be released 

even after being processed through the 

software. (83 FR at 36498). 

Moreover, even if software could 

guarantee full scrubbing of PII, the 

possibility still remains that the data 

could be re-identified with the worker 

who reported the injury or illness. (83 

FR at 36498). When discussing the 

agency’s past experience of withholding 

private worker information from 

disclosure under FOIA, OSHA referred 

to the practice of manually redacting 

Forms 300 and 301 on a case by case 

basis. (81 FR at 29658). For example, 

OSHA noted that it ‘‘would not disclose 

the information in Column C [of Form 

300] (Job Title), if such information 

could be used to identify the injured or 

ill employee.’’ (81 FR at 29658). OSHA 

thus acknowledged even in the 2016 

final rule that the worker’s job title 

could be used to identify the injured or 

ill worker in some situations and that 

OSHA had protected that information in 

the past through manual review of the 

file and invocation of FOIA Exemption 

7(c). (81 FR at 29658). The 2016 rule’s 

proposed use of de-identification 

software would not address this issue. 

Commenters argued that data similar 

to those on Forms 300 and 301 have 

been available to workers and their 

representatives since the passage of the 

Act (i.e., those with a ‘‘need to know’’) 

(E.g., Document ID 1984–A1, p. 2; 2088– 

A3, p. 5 (comments dated March 10, 

2014)), but those data have always been 

screened manually for PII. Such 

screening may have been possible before 

the 2016 final rule for individual files 

requested on a case by case basis, but 

OSHA could not possibly review each 

individual form that would be 

submitted electronically under the 2016 

final rule to determine whether a 

worker’s job title could be used to 

identify the worker. 


khammond on DSKBBV9HB2PROD with RULES2
386 Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 

The same principle distinguishes 

OSHA’s practice of posting information 

about severe injuries and fatalities on its 

website, which some commenters cited 

as proof that the information on Forms 

300 and 301 is not too sensitive to 

publish. (E.g., Document ID 1961–A1, p. 

2; 1976–A1, p. 3; 2038–A1, p. 2; 2054– 

A1, p. 4). Although OSHA has not 

identified specific worker complaints 

about OSHA’s posting of severe injury 

data in the past, as asserted by one 

commenter (Document ID 2054–A1, p. 

4; see also Document ID 2015–A1, p. 1), 

OSHA receives only approximately 800 

severe injury reports per month, and 

manually screens each severe injury 

report for PII or other sensitive worker 

information before posting. OSHA’s past 

practice of manually redacting these 

data before releasing them has no 

application to the mass collection of 

Forms 300 and 301 data from 36,903 

establishments—data drawn from what 

OSHA estimates would be more than 

775,000 forms—which could only be 

screened using software with limitations 

delineated elsewhere in this preamble 

and in the 2018 NPRM. 

Although OSHA believes the 300 and 

301 data would be exempt from 

disclosure under FOIA Exemptions 6 

and 7(c), OSHA still could be required 

by a court to release the data, as 

discussed in the NPRM and echoed by 

many commenters. (83 FR at 36498; see 

also Document ID 1930–A1, pp. 3–4; 

1979; 1981–A1, pp. 2–3; 2075–A1, p. 5; 

2084–A1, p. 3). The risk of disclosure of 

sensitive information is not speculative, 

as some commenters claimed (e.g., 

Document ID 2056–A1, pp. 1–2). One 

FOIA requester has already sued the 

Department in multiple lawsuits seeking 

injury and illness data: One lawsuit 

seeks the 300A data collected through 

the Injury Tracking Application, and 

one lawsuit seeks to force OSHA to 

collect the 2017 data from Forms 300 

and 301 for the requestor’s use in 

research. See Public Citizen v. U.S. 

Dep’t of Labor, Civ. No. 18–cv–117 

(D.D.C. filed Jan. 19, 2018); Public 

Citizen Health Research Group v. 

Acosta, Civ. No. 18–cv–1729 (D.D.C. 

filed July 25, 2018). In a decision 

denying the government’s motion to 

dismiss in Public Citizen Health 

Research Group v. Acosta, the court 

concluded that the plaintiffs would 

likely be entitled to a significant portion 

of the 300 and 301 data if collected by 

OSHA, despite OSHA’s conclusion that 

the data would be exempt from 

disclosure under FOIA. Public Citizen 

Health Research Group v. Acosta, Civ. 

No. 18–cv–1729 (D.D.C. December 12, 

2018) (order denying motion to dismiss 

and preliminary injunction). In 

addition, in New York Times Co. v. U.S. 

Dep’t of Labor, 340 F. Supp. 2d 394 

(S.D.N.Y 2004) and Finkel v. U.S. Dep’t 

of Labor, No. 05–5525, 2007 WL 

1963163 (D.N.J. June 29, 2007), two 

separate courts ordered OSHA to release 

injury and illness data that OSHA 

argued were exempt from disclosure 

under FOIA Exemption 4. (See 

Document ID 2019–A1, p. 7; 2070–A1, 

p. 4). 

OSHA disagrees with comments 

arguing that OSHA mischaracterized the 

Finkel and Public Citizen lawsuits and 

the risk of the disclosure of sensitive 

information under FOIA. (See 

Document ID 2048–A1, pp. 2–3; 2012– 

A1, p. 11; 2022–A1, p. 2). OSHA agrees 

with Mr. Finkel and other commenters 

that the Finkel lawsuit did not result in 

a court ordering disclosure of PII (see, 

e.g., Document ID 2048–A1, p. 1; Finkel 

v. U.S. Dep’t of Labor, No. 05–5525, 

2007 WL 1963163 (D.N.J. June 29, 

2007)). The Public Citizen Health 

Research Group, Finkel and New York 

Times lawsuits do, however, 

demonstrate the power of courts to 

order OSHA to release injury and illness 

data that OSHA considers sensitive 

information exempt from disclosure, 

over OSHA’s objections. In another case, 

the Sixth Circuit Court of Appeals 

ordered the release of data the Federal 

Aviation Administration tried to protect 

from disclosure, despite the possibility 

that multiple data points could be 

combined to re-identify particular 

individuals who had participated in a 

strike. (Norwood v. FAA, 993 F.2d 570, 

574–75 (6th Cir. 1993)). OSHA is 

concerned a similar outcome could 

result if it collects the data from Forms 

300 and 301 and then attempts to 

withhold the data in response to FOIA 

requests on the ground that the data 

could well contain sensitive information 

that OSHA cannot guarantee would be 

removed. ‘‘[O]nce the information is 

disclosed [under FOIA], it can never be 

made private.’’ (See Document ID 2075– 

A1, p. 5). 

Some commenters asserted that 

OSHA should collect the 300 and 301 

data but limit its release in various ways 

(Document ID 2006–A1, pp. 2–3), or that 

OSHA could never be required to 

disclose sensitive worker information 

under FOIA (e.g., Document ID 2006– 

A1, p. 3; 2012–A1, p. 11; 2022–A1, p. 

2; 2028–A1, pp. 2, 7). These comments 

ignore the reality reflected in these 

lawsuits that the Department would not 

retain complete control over the data 

once they are collected. And, given that 

OSHA cannot guarantee complete 

removal of PII or data that could be reidentified with a particular worker from 

such a large dataset, court-ordered 

publication of the data from Forms 300 

and 301 could well result in the 

disclosure of sensitive worker 

information. Other commenters 

presented alternatives to fully 

rescinding the requirement to collect the 

data from Forms 300 and 301, such as 

excluding job title and precise date of 

injury to reduce the likelihood of reidentification. (Document ID 1993–A1, 

p. 2; 2028–A1, p. 7). OSHA notes that 

even without the job title and precise 

date fields, however, employers could 

include sensitive information, such as 

worker and patient names, in the 

narrative description of the injury and 

how it occurred. (Document ID 1960– 

A1; 81 FR at 39662). OSHA has had to 

redact this kind of information during 

manual screening in the past prior to 

release. (81 FR at 39662). 

The American Nurses Association 

(ANA) expressed concern about 

potential disclosure of sensitive worker 

information under FOIA but believes 

that the case-level data are important for 

performing root-cause analyses to 

prevent incidents of workplace injuries 

and illnesses. (Document ID 2000–A1, 

pp. 1–2). The ANA notes that 29 CFR 

1904.8 requires employers to record on 

the OSHA Form 300 all work-related 

needlestick injuries and cuts from sharp 

objects that are contaminated with 

another person’s blood or other 

potentially-infectious material, but that 

employers are prohibited from recording 

an injured worker’s name. (Document ID 

2000–A1, pp. 2–3). Given the 

protections afforded these cases under 

§ 1904.29(b)(6) through (9), the ANA 

asks whether it would be viable for 

OSHA to continue to require electronic 

submission of OSHA 300 Log for 

needlestick and sharps injuries to help 

inform the future prevention of 

needlestick and sharps injuries. 

(Document ID 2000–A1, p. 3). 

OSHA notes the importance of the 

OSHA 300 Log for needlestick injuries 

and cuts from sharp objects for 

identifying hazards in healthcare 

settings, and encourages employers to 

use their own data from Forms 300 and 

301 to identify workplace hazards, as 

OSHA does during onsite inspections. 

Like any other OSHA 300 Log, however, 

the possibility of personal information 

being reported to OSHA inadvertently 

remains despite the prohibition against 

recording names, as does the risk of reidentification through job title or 

another reported field. These data might 

then be subject to release under FOIA. 

Therefore, OSHA declines the invitation 

to retain the reporting requirements for 

case-characteristic data for the OSHA 


khammond on DSKBBV9HB2PROD with RULES2
Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 387 

4MSHA has been subject to cyber attack in the 

past, however. See Ted Hesson, ‘‘Morning Shift: 

DOL Takes Stock After Hack,’’ POLITICO (Apr. 25, 

2018) (detailing successful hack), https://

www.politico.com/newsletters/morning-shift/2018/ 

04/25/travel-ban-at-scotus-182935. 

5See the Final Economic Analysis for details on 

this calculation. 

300 Log for needlestick injuries and cuts 

from sharp objects. 

After reviewing all of the comments 

on this issue, OSHA has determined 

collecting the data would expose 

sensitive worker information to a 

meaningful risk of disclosure. OSHA 

cannot justify that risk given its resource 

allocation concerns and the uncertain 

incremental benefits to OSHA of 

collecting the data, as discussed 

elsewhere in this preamble. OSHA has 

determined that the best use of its 

resources is to focus on data it already 

receives—including a large set of data 

from Form 300A, as well as discrete 

data about urgent issues from severe 

injury reports—and has found useful in 

its past experience. 

Experience of the Mine Safety and 

Health Administration (MSHA) and 

Other Federal and State Agencies 

The experience of MSHA and other 

federal and state agencies with 

collecting and publishing similar data, 

as many commenters noted (e.g., 

Document ID 2007, p. 8; 2011–A1, p. 6; 

2012–A1, p. 6; 2028–A1, p. 2), does not 

mean OSHA is required to collect the 

data from Forms 300 and 301. As 

explained below, other federal and state 

agencies may weigh worker privacy 

concerns differently based on their 

missions, priorities, and budgets. 

OSHA acknowledges, for example, 

comments that MSHA has been 

collecting similar data—albeit from a 

much small number of establishments— 

for many years (e.g., Document ID 2011– 

A1, p. 7) and has posted data on the web 

for more than fifteen years (Document 

ID 2012–A1, pp. 6, 10). MSHA 

maintains the data in a comprehensive 

database that it makes available to the 

public. (E.g., Document ID 1965–A1, p. 

52). Commenters noted that MSHA has 

not experienced any security breaches 

or complaints or controversy about 

employee privacy, despite the fact that 

MSHA’s database includes small 

employers.4 (E.g., Document ID 2012– 

A1, p. 10). Commenters further noted 

that ‘‘MSHA has a robust system in 

place to protect [PII] from inappropriate 

disclosure.’’ (E.g., Document ID 2011– 

A1, pp. 7–8). 

There are security controls in place to 

prevent database contamination should 

nefarious acts be taken against the front-end 

website. The information has to be reviewed 

by at least three approving authorities prior 

to it being introduced and or uploaded into 

the appropriate database for further analysis 

and data manipulation. Data extracts are 

redacted of the PII prior to being released for 

public consumption. 

(Document ID 2088–A1, p. 12) (quoting 

MSHA, Privacy Impact Assessment 

Questionnaire, MSHA Standardized 

Information System (MSIS)—FY2017, 

available at: https://www.dol.gov/ 

oasam/ocio/programs/pia/msha/MSHAMSIS.htm). 

Although three layers of review might 

make sense given MSHA’s budget and 

the much smaller number of employers 

under the agency’s jurisdiction, it would 

require OSHA to commit an 

unwarranted level of resources to 

provide three layers of review for the 

volume of records it would receive. 

Under the 2016 final rule, OSHA would 

collect between 38 and 77 times more 

injury reports than MSHA—that is, 

approximately 775,000 reports, versus 

MSHA’s 10,000–20,000. OSHA 

estimates, based on the time it has taken 

OSHA staff to review and remove 

personal information from other OSHA 

data, that it would take two levels of 

review and 7 minutes per record, on 

average, to assess the record and remove 

personal information. Such review 

would cost OSHA approximately $7.5 

million each year.5

Other commenters pointed out that 

‘‘[t]he Federal Railroad Administration 

(FRA) posts accident investigation 

reports filed by railroad carriers or made 

by the Secretary of Transportation, and 

the Federal Aviation Administration 

(FAA) posts National Transportation 

Safety Board reports about aviation 

accidents.’’ (Document ID 2012–A1, p. 

10; see also 2028–A1, p. 7). Some of 

these commenters noted that the 

information posted by these agencies 

includes personally identifiable 

information, such as age, gender, job 

history, medical information, or 

information about the accident. 

(Document ID 2028–A1, p. 7). In 

addition, some state workers’ 

compensation systems have online 

search capacity for data including the 

claimant’s name and the description of 

the injury. (Document ID 1993–A1, p. 

2). 

Again, OSHA acknowledges that other 

federal and state agencies have collected 

somewhat similar data for a number of 

years, but notes that each of these 

agencies has a unique mission, varying 

priorities, and different resource 

constraints. In this final rule, OSHA is 

balancing the issues of worker privacy 

and OSHA’s resource priorities against 

the uncertain incremental benefits of 

collecting the data from Forms 300 and 

301. Because OSHA has determined that 

the extent of the incremental benefits to 

OSHA of collecting the data is 

uncertain—and because OSHA can still 

obtain the data from employers if 

needed for specific enforcement 

actions—the agency is choosing to 

protect worker privacy and commit the 

agency’s resources to fully utilizing 

300A and severe injury report data that 

its experience has already demonstrated 

are useful. Other federal and state 

agencies may weigh worker privacy 

concerns differently based on their 

missions, priorities, and budgets. 

The Health Information Portability and 

Accountability Act (HIPAA) and 

Americans With Disabilities Act (ADA) 

One commenter indicated that PII 

should never be included in published 

data because such action would conflict 

with HIPAA and could require 

employees in healthcare settings to 

violate patients’ privacy rights, 

subjecting those employees to legal and 

licensing problems. (Document ID 

1936). Another commenter noted that— 

like HIPAA—the ADA protects medical 

information from unnecessary 

disclosure and limits who can access an 

employee’s medical records (including 

only providing them to government 

personnel investigating compliance 

upon request). (Document ID 2036–A1, 

p. 5). OSHA disagrees that HIPAA and 

the ADA would apply to its electronic 

collection of Forms 300 and 301 for the 

reasons set forth in the 2016 final rule, 

(see 81 FR at 29665–66), but agrees that 

privacy-related policy concerns 

reflected in these laws buttress its 

determination that these data should not 

be collected in this way. 

Technological Limitations of DeIdentification Software 

In the NPRM, OSHA proposed to 

amend the recordkeeping regulations to 

protect worker privacy by no longer 

requiring employers to submit 

electronically detailed injury and 

accident information. (E.g., 83 FR at 

36494). Specifically, OSHA explained 

the concern about potential disclosure 

of sensitive worker information under 

the Freedom of Information Act (FOIA). 

(E.g., 83 FR at 36494). Although 

software is available to scrub identifying 

information from electronic data, the 

software cannot eliminate the risk of 

disclosure of PII. (83 FR at 36498). Even 

if all PII were removed from the data, a 

risk remains that some data could still 

be re-identified with a particular 

individual. (83 FR at 36498). 

Many commenters echoed OSHA’s 

concerns that, under the prior final rule, 


khammond on DSKBBV9HB2PROD with RULES2
388 Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 

PII or data that could be re-identified 

with a particular individual could be 

released under FOIA. (Document ID 

2070–A1, pp. 3, 4–5; 2055–A1, p. 2). 

These commenters stated that OSHA’s 

plan to de-identify PII through software 

is insufficient to protect worker privacy. 

(Document ID 2070–A1, p. 5; 2055–A1, 

p. 2). For example, one commenter 

stated that in the case of a unique injury 

occurring in a small town, the sensitive 

details of an injury might easily be 

associated with a specific individual 

even without naming that individual. 

(Document ID 2032–A1). 

Although OSHA stated in the 2016 

final rule that ‘‘the [a]gency will use 

software that will search for, and deidentify, personally identifiable 

information before the submitted data 

are posted’’ (81 FR at 29662), OSHA did 

not guarantee complete removal of PII 

through de-identification software as 

some commenters claimed. (See 

Document ID 2031 (‘‘OSHA made it 

clear [information that would identify 

individual workers] would never be 

released to the public.’’); 2038–A1, p. 2 

(‘‘OSHA ensured [sic] us [information 

tied to individual workers] would never 

be released to the public.’’)). In fact, 

OSHA stated that it intended to protect 

sensitive information from release, (81 

FR at 29659), but that is not a guarantee. 

Commenters noting that OSHA has not 

cited any concrete evidence of problems 

or errors in de-identification since 

promulgating the 2016 final rule, nor 

any evidence that the information on 

Forms 300 and 301 would be 

particularly vulnerable to disclosure 

(Document ID 2020–A1, pp. 3–5; 2033– 

A1, p. 4), fail to give due weight to the 

possibility that sensitive worker 

information could be released despite 

OSHA’s best efforts. Claims that the 

concerns about disclosure after deidentification are ‘‘speculative’’ and 

raise only a ‘‘remote’’ risk of disclosure 

(Document ID 2020–A1, p. 4) likewise 

ignore OSHA’s past experience of 

needing to remove PII and other 

sensitive information from Forms 300 

and 301 on a case-by-case basis prior to 

release to prevent re-identification, as 

discussed above in more detail. 

After carefully considering 

commenters’ submissions on this issue, 

OSHA finds that there is a meaningful 

risk to worker privacy if OSHA requires 

employers to electronically file detailed 

injury and illness data on Forms 300 

and 301 because de-identification 

software cannot fully eliminate the risk 

of disclosure of PII or re-identification 

of a specific individual and manual 

review of the data would not be feasible. 

OSHA’s past experience with case-bycase release of 300 and 301 data and 

severe injury reports reveals that these 

concerns are far from speculative. These 

risks weigh in favor of the rescinding 

requirements to submit the data from 

Forms 300 and 301 to OSHA 

electronically. 

Risk of Cyber Attack 

In the NPRM, OSHA stated that 

electronically-stored data might 

incentivize cyber-attacks on the 

Department’s IT system. OSHA noted 

that there was a potential compromise 

of user information for OSHA’s Injury 

Tracking Application (ITA) in 2017, 

demonstrating that such a large data 

collection will inevitably encounter 

malware. (83 FR at 36498, Fn. 2). 

Several commenters agreed with 

OSHA that worker privacy could be 

compromised by a data breach, cyberattack, or malware, and that collecting 

such a large amount of data 

electronically could incentivize cyberattacks on the Department. (E.g., 

Document ID 2076–A1, p. 5). Some of 

these commenters noted the 2017 

potential compromise of OSHA’s ITA as 

a basis for these concerns. (Document ID 

2034–A1, p. 2; 2076–A1, p. 5). 

Commenters also included examples of 

large scale breaches of government data 

systems in other agencies. (Document ID 

2034–A1, pp. 1–2; 2042–A1, p. 2). In 

addition, commenters cited a 2016 

report by the House Oversight 

Committee finding that the federal 

government was vulnerable to cyberattacks (Document ID 2034–A1, p. 1), 

and a Federal Information Security 

Modernization Act (FISMA) Report to 

Congress for Fiscal Year 2017 finding 

that the Occupational Safety and Health 

Review Commission had an overall 

rating of ‘‘At Risk’’ (Document ID 2070– 

A1, p. 8). 

One commenter asserted that OSHA 

should be just as capable as MSHA of 

safeguarding the data since the 

Department consolidated Information 

Technology (IT) services in 2014. 

(Document ID 2082–A2, p. 5; see also 

Document ID 2088–A1, p. 12 (noting 

that MSHA has strong information 

security controls in place)). 

OSHA notes that the ITA data meet 

the security requirements for 

government data, and after 

reconsidering this issue, OSHA does not 

find that collecting the data from Forms 

300 and 301 would increase the risk of 

a successful cyber-attack. Some risk 

remains, however, that a cyber-attack 

could occur and result in the release of 

data. Moreover, OSHA shares the 

concerns of some commenters about 

how having thousands of businesses 

upload a large volume of additional data 

could generally increase risk for cybersecurity issues. (See, e.g., Document ID 

2045–A1, p. 3; 2075–A1, pp. 4–5). 

Limitations on OSHA’s Capacity To 

Collect and Use the Data From Forms 

300 and 301 

In the NPRM, OSHA expressed doubt 

about the necessity for and ability to use 

the large volume of data that would be 

generated by Forms 300 and 301, given 

its resources and competing priorities. 

As explained below, OSHA has prior 

experience with using the 300A data 

successfully and believes that it is the 

best resource for enforcement targeting 

and compliance assistance. OSHA also 

receives and effectively uses data 

concerning the most severe injuries and 

illnesses. In contrast, the agency has no 

prior experience using the case-specific 

data collected on Forms 300 and 301 for 

enforcement targeting or compliance 

assistance and is unsure how much 

benefit such data would have for these 

purposes or the level of resources 

needed to attain any benefit. (83 FR at 

36498). OSHA noted that the agency’s 

efforts to realize these uncertain benefits 

by collecting, processing, analyzing, 

distributing, and programmatically 

applying the data would be costly. (83 

FR at 36498–99). 

Several commenters agreed that 

OSHA may not be able to make 

beneficial use of the large volume of 

data it would receive under the 2016 

Rule. (Document ID 2034–A1, p. 2; 

2070–A1, p. 9). The United States Postal 

Service also expressed concern that any 

technical complications OSHA 

experienced due to the large volume of 

data being submitted could hinder 

timely reporting, leading to steep 

monetary penalties for employers. 

(Document ID 2034–A1, p. 2). 

Other commenters claimed that 

OSHA has the capacity to collect and 

code this volume of data. (Document ID 

2011–A5, p. 1 (commenting on 2013 

NPRM); 2026–A1, p. 3; 2029). The 

Attorneys General of NJ, MA, MD, NY, 

PA, RI, and WA jointly commented that 

OSHA’s lack of experience with this 

volume of data is unsurprising because 

OSHA has not tried to collect the Form 

300 and 301 data yet. (Document ID 

2028–A1, p. 3). They noted that for this 

reason it is also unsurprising that the 

benefits are uncertain at this point. 

(Document ID 2028–A1, p. 3). Another 

commenter observed that OSHA does 

have experience evaluating Form 300 

Logs and Form 301 Incident Reports 

while conducting workplace 

investigations, so OSHA should be able 

to make use of such information 

collected through electronic 

submissions. (Document ID 2063–A1, 

pp. 1–2). 


khammond on DSKBBV9HB2PROD with RULES2
Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 389 

Although OSHA is technically 

capable of collecting the 300 and 301 

data through a secure Web portal similar 

to the one used for 300A data collection, 

no such portal was built when the 2016 

rule was being developed or after it was 

finalized. Diverting resources now to 

build such a portal would take away 

from OSHA’s enforcement efforts. 

Likewise, the cost of collecting the 

additional 300 and 301 data in that 

manner would be substantial (see 

Section IV, Final Economic Analysis 

and Regulatory Flexibility Certification). 

OSHA has accordingly concluded that 

worker privacy concerns and OSHA’s 

resource priorities—including fully 

utilizing the 300A data that it already 

has collected from 214,574 

establishments—outweigh the uncertain 

benefits of seeking to collect and 

process the data from Forms 300 and 

301. 

Several commenters observed that 

other agencies, as well as other 

divisions within the Department of 

Labor, collect, track, and utilize similar 

data. (E.g., Document ID 2026, pp. 2–3). 

Some of these commenters encouraged 

consultation with other agencies who 

collect this type of data, including 

NIOSH, MSHA, Bureau of Labor 

Statistics (BLS), FRA, and FAA, to learn 

about database design and best practices 

for collecting this kind of data. 

(Document ID 1965–A1, pp. 179–80; 

2012–A1, p. 9; 2085–A1, p. 16 (quoting 

comments on 2013 NPRM)). Given 

OSHA’s successful use of summary data 

from Form 300A and severe injury 

reports to target its enforcement and 

outreach efforts, and given its privacy 

concerns and its current resources and 

priorities, OSHA has determined to 

continue to invest its time and money 

in an approach that is known to be 

effective, while continuing its use of 300 

and 301 data in onsite inspections. 

OSHA also received a comment from 

NIOSH, offering to help with data 

analysis. Specifically, NIOSH 

commented that it is well-positioned to 

play a leading role in helping OSHA use 

data collected in Forms 300 and 301 to 

prevent occupational injuries and 

illnesses. (Document ID 2003–A2, p. 3). 

NIOSH explained that it has the 

experience and capacity to analyze the 

data, as well as interest in using the data 

to provide guidance to employers for the 

prevention of occupational injury and 

illness, and to provide data analysis 

results and analytical tools that should 

enhance OSHA’s targeting. (Document 

ID 2003–A2, p. 3). NIOSH noted that it 

has already developed auto-coding 

methods for categorizing occupation 

and industry based on free text data and 

has successfully utilized similar free 

text data collected from workers’ 

compensation claims. (Document ID 

2003–A2, p. 5). While NIOSH 

acknowledged that the data collected 

from Forms 300 and 301 would pose a 

greater analysis challenge because of the 

amount of data, NIOSH stated that the 

large data set would be useful to 

identify patterns and prevent workplace 

injuries. (Document ID 2003–A2, p. 6). 

OSHA appreciates the value of interagency efforts to achieve shared goals of 

preventing occupational injuries and 

illnesses and looks forward to continued 

coordination with NIOSH and other 

agencies where appropriate. However, 

OSHA has determined that NIOSH’s 

ability to analyze data collected from 

Forms 300 and 301 does not reduce the 

burden on OSHA to collect the data. 

Even if NIOSH could make the data 

useful for OSHA’s enforcement targeting 

and outreach efforts, which NIOSH 

itself has suggested would present 

analytical challenges due to the volume 

of the data, OSHA and employers would 

be left covering the expense of 

collection, not to mention additional 

expense associated with the need to 

process and otherwise manually review 

data from the forms—costs that would 

detract from OSHA’s priorities of 

enforcement and compliance assistance 

to reduce workforce hazards. 

After reviewing commenters’ 

submissions related to OSHA’s capacity 

to use the large volume of data that 

would be generated by the submission 

of Forms 300 and 301, the agency 

remains concerned about the costs of 

collecting and processing this large 

volume of data. OSHA has considered 

the comments about the benefits of 

electronically collecting the data and, as 

explained more fully below, has 

determined that the incremental 

benefits of electronic collection of these 

data to OSHA’s enforcement targeting 

and compliance assistance activities 

remain uncertain. In OSHA’s judgment, 

those uncertain benefits are outweighed 

by the cost of developing a system to 

manage that volume of data, particularly 

when making use of the data would 

divert resources away from OSHA’s 

current priority of fully utilizing Form 

300A and severe injury data for 

targeting and outreach. 

Uncertain Extent of Benefits From 

Collecting the Data From Forms 300 and 

301 

In the proposed rule, OSHA 

preliminarily determined that the extent 

of the incremental benefits of 

electronically collecting data from 

Forms 300 and 301 is uncertain. (E.g., 

83 FR at 36498–99). OSHA explained 

that the collection of data from the 

summary Form 300A provides the 

agency with the information it needs to 

identify and target establishments with 

high rates of work-related injuries and 

illnesses. (83 FR at 36498). For example, 

OSHA noted that it had collected 

summary 300A data for 2016 from 

214,574 establishments. (83 FR at 

36498). OSHA further explained that it 

was able to use those data to design a 

targeted enforcement mechanism for 

establishments experiencing higher 

rates of injuries and illnesses. (E.g., 83 

FR at 36498). OSHA noted its plans to 

further refine this approach by using the 

greater volume of 2017 summary data. 

(83 FR at 36498). 

The proposed rule also discussed 

OSHA’s long-time use of summary data 

in enforcement. (83 FR at 36498). Before 

the 2016 rule, OSHA had collected these 

data for 17 years under its OSHA Data 

Initiative (ODI) and used those data to 

identify and target high-rate 

establishments through the Site-Specific 

Targeting (SST) Program. (83 FR at 

36498). OSHA stopped the ODI in 2013 

and the SST in 2014 while it developed 

the 2016 final rule, but the agency noted 

that those prior programs have still 

given it considerable experience with 

using 300A data for targeting. (83 FR at 

36498). 

Conversely, OSHA explained that it 

has no prior experience with using the 

case-specific data from Forms 300 and 

301 to identify and target establishments 

for enforcement or outreach purposes. 

(83 FR at 36498). For example, OSHA is 

unsure how much benefit such data 

would have for these purposes, but has 

determined that considerable effort and 

resources would be required to realize 

those uncertain benefits. (83 FR at 

36498–99). The agency estimated that 

establishments with 250 employees or 

more would report data from 

approximately 775,210 Form 301s 

annually, a total volume three times the 

number of Form 300As from which data 

were uploaded for 2016, while also 

presenting more complicated 

information than that captured by Form 

300A. (83 FR at 36498). To gain 

enforcement value from the casespecific 300 and 301 data, OSHA 

explained that it would need to divert 

resources from other priorities, such as 

the utilization of Form 300A data, 

which OSHA’s long experience has 

shown to be useful. (83 FR at 36498–99). 

OSHA asked stakeholders to submit 

comments on the benefits and 

disadvantages of the proposed removal 

of the requirement for employers with 

250 or more employees to submit the 

data from OSHA Forms 300 and 301 to 

OSHA electronically on an annual basis, 

including the usefulness of the data for 


khammond on DSKBBV9HB2PROD with RULES2
390 Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 

enforcement targeting (83 FR at 36499), 

and received a number of comments in 

response. Many of the commenters 

agreed that the enforcement benefits 

stemming from electronically collecting 

the Form 300 and 301 data are 

uncertain. (E.g., Document ID 2034–A1, 

pp. 2–3; 2036–A1, pp. 7–8). One 

commenter also suggested that OSHA 

has not shown that it is fully and 

effectively using currently-available 

data (Document ID 2019–A1, p. 3), and 

another indicated that OSHA has not 

demonstrated that there are significant 

gaps in the current data that 

compromise OSHA’s execution of its 

mission, that electronically collecting 

the Form 300 and 301 data will address 

those gaps, or that the protocols 

described by the 2016 final rule will 

efficiently and effectively compile 

necessary information to lead to 

significant improvements in achieving 

OSHA’s goals (Document ID 2003–A2, 

p. 3). Commenters further noted that 

OSHA did not explain in 2016 how it 

would effectively use the Form 300 and 

301 data to the benefit of its 

enforcement and compliance assistance 

programs. (E.g., Document ID 2019–A1, 

p. 3; 2044–A1, p. 6). Other commenters 

concluded that collecting Form 300A 

data is sufficient for OSHA’s targeting 

and enforcement purposes and 

electronically collecting the Form 300 

and 301 data has no clear benefit. (E.g., 

Document ID 1970–A1; 2034–A1, pp. 

2–3). 

Commenters also asserted that Form 

300 and 301 data do not predict current 

hazards or take into account any 

corrective actions by the employer, nor 

do they show if OSHA should have 

issued a citation in response to a 

recorded occurrence. (E.g., Document ID 

2057–A1, p. 3; 2075–A1, p. 3). Put 

another way, the fact that an employer 

records an incident does not necessarily 

correlate to workplace hazards or 

compliance inadequacy or otherwise 

indicate that the reporting employer is 

responsible for the incident. (E.g., 

Document ID 2075–A1, p. 3). For 

example, the E-Recordkeeping Coalition 

stated that, ‘‘[b]ased on a qualitative 

analysis of [its] members’ 300 and 301 

data, only a small percentage of that 

data would indicate any regulatory 

compliance insufficiency.’’ (Document 

ID 2076–A1, p. 3). Relatedly, one 

commenter posited that collecting the 

Forms 300 and 301 data does not serve 

the purpose of a ‘‘no-fault’’ 

recordkeeping system. (Document ID 

2057–A1, p. 3). 

According to some commenters, 

maintaining Form 300 and 301 data 

electronically would not aid OSHA in 

identifying, and engaging in 

enforcement, at high-risk workplaces, 

(e.g., Document ID 2042–A1, p. 2), or 

otherwise provide any real value to the 

agency’s enforcement targeting 

strategies or decisions (e.g., Document 

ID 2075–A1, p. 3; 2076–A1, p. 3). A 

comment in the record concerning 

OSHA’s 2013 NPRM, from a commenter 

that generally supported OSHA’s 

collection of Form 300 and 301 data, 

noted that use of the Form 301 

narratives can be cumbersome. 

(Document ID 2085–A8, p. 31). The 

Phylmar Regulatory Roundtable pointed 

out that OSHA can still collect the Form 

300 and 301 data after it has determined 

to inspect an establishment, using the 

data to target specific areas of the 

workplace during the inspection, and 

stated that doing so results in a fair, 

objective process, rather than injecting 

unfairness and subjectivity into OSHA’s 

targeting decisions. (Document ID 2070– 

A1, p. 8). OSHA agrees that the best use 

of the Form 300 and 301 data is for 

identifying hazards during onsite 

inspections, and OSHA will continue 

using the data in this manner. 

OSHA disagrees with commenters 

asserting that OSHA now ignores many 

key benefits it previously asserted 

would be derived from electronically 

collecting and publishing the Form 300 

and 301 data. (E.g., Document ID 2028– 

A1, p. 3; 2054–A1, p. 6). Rather, OSHA 

is now re-assessing the uncertain 

incremental benefits to OSHA 

enforcement and compliance assistance 

activities and re-balancing those 

benefits against worker privacy 

concerns and OSHA’s current resource 

priorities. That balancing takes into 

account, as is appropriate, how OSHA 

can and will continue to collect and use 

data from Forms 300 and 301 as needed, 

as well as data from severe injury 

reports, for on-site inspections and 

specific enforcement. 

OSHA’s position in this final rule on 

the uncertain benefits of collecting data 

from Forms 300 and 301 outside the 

context of an onsite inspection is not 

inconsistent with its position in the 

Mar-Jac Poultry case (see U.S. v. Mar-Jac 

Poultry, Inc., 153 Fed. Appx. 562 (11th 

Cir. Oct. 9, 2018) (unpublished)), as 

some commenters suggested. (E.g., 

Document ID 2015–A1, pp. 8–11; 2054– 

A1, pp. 8–9). In that case, OSHA took 

the position that the 300 logs had value 

for identifying potential violations 

during an onsite inspection, and OSHA 

maintains that belief. Indeed, OSHA 

intends to continue using the data from 

Forms 300 and 301 for that purpose. 

OSHA notes that case involved the use 

of 300A data from an establishment 

OSHA is inspecting to expand the scope 

of the inspection; it did not address the 

usefulness, for enforcement purposes, of 

collecting a high volume of Form 300 

and 301 data. 

One commenter disagreed with 

rescinding the requirement to submit 

data from Forms 300 and 301 to OSHA 

without taking certain steps identified 

in the 2016 final rule—including 

‘‘looking at examples of electronic data 

collection efforts by other federal 

agencies’’ and ‘‘form[ing] a working 

group with BLS to assess data quality, 

timeliness, accuracy, and public use of 

the collected data.’’ (Document ID 2012– 

A1, p. 15). OSHA did not, however, 

bind itself to take such actions in order 

to reconsider the decision whether to 

collect the data was justified in light of 

the risk to worker privacy and the 

agency’s best use of its resources. 

Furthermore, other agencies’ 

experiences are not directly relevant to 

OSHA’s resource priorities and unique 

mission. OSHA routinely consults with 

other agencies as part of its rulemaking 

process and did so for this rule. Because 

OSHA issues this final rule as a result 

of its re-balancing of the risk to worker 

privacy with the rule’s uncertain 

benefits and the agency’s resource 

priorities, OSHA has determined that 

further consultation with other agencies 

is neither necessary nor appropriate. 

OSHA agrees, as some commenters 

noted, that public health principles 

dictate data-based approaches. (E.g., 

Document ID 2006–A1, p. 2; 2014–A1, 

p. 2). OSHA disagrees, however, that 

collecting the data from Forms 300 and 

301 is therefore necessary; OSHA is 

already collecting the 300A data and 

using those data to inform its 

enforcement targeting. OSHA is 

uncertain how much additional value 

the data from Forms 300 and 301 would 

provide for enforcement and 

compliance assistance at this time and 

has therefore determined that fully 

utilizing the 300A data and severe 

injury report data is the best use of 

OSHA’s resources. OSHA will continue 

to obtain the data from Forms 300 and 

301 from employers, as needed, for onsite inspections and specific 

enforcement actions, and OSHA will 

likewise continue to assess and utilize 

data from the severe injury reports it 

receives and that have proven useful in 

identifying and addressing areas of 

need. 

According to some commenters, 

having a comprehensive batch of data 

from Forms 300 and 301 would allow 

OSHA to understand employer 

misconduct more broadly, and this 

dataset could make up for OSHA’s 

inability to visit all of the worksites 

within its jurisdiction. (E.g., Document 

ID 2015–A1, p. 7; 2056–A1, p. 2; 2082– 


khammond on DSKBBV9HB2PROD with RULES2
Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 391 

6The National Academies of Science, 

Engineering, and Medicine (NAS) report, titled A 

Smarter National Surveillance System for 

Occupational Safety and Health in the 21st Century 

(Document ID 1965–A1) was the result of a joint 

request from NIOSH, BLS, and OSHA to NAS, 

asking NAS to conduct a study in response to the 

need for a more coordinated, cost-effective set of 

approaches for occupational safety and health 

surveillance in the United States. (See Document ID 

1965–A1, p. x). Commenters submitted copies of 

the report to the record. (See Document ID 1965– 

A1; 2085–A10). Where those commenters and 

others have specifically referenced findings, 

recommendations, or other statements contained in 

the report in their comments, OSHA has responded 

to them in this preamble. However, because the 

report is not, and was not intended to be, 

commentary on this rulemaking, the agency does 

not find it is appropriate or necessary to respond 

to statements contained therein where those 

statements were not referenced by commenters in 

their submissions to the record. 

A2, p. 5). Others asserted that the data 

can serve as a guide for agency 

inspections, providing compliance 

officers with the number, type, severity, 

and distribution of injuries at a 

particular workplace. (Document ID 

2012–A1, p. 2; 1965–A1, p. 179 (NAS 

Report)).6 OSHA has determined that 

the 300A data are sufficient for 

enforcement targeting and compliance 

assistance, and notes again that it can 

still use Forms 300 and 301 to guide 

inspections by collecting the data 

onsite, without the need to divert 

resources to creating a Web portal never 

built during or after the 2016 rule’s 

development. 

Some commenters indicated that 

having electronic access to the data 

would facilitate OSHA’s effective use of 

the data (e.g., Document ID 2056–A1, p. 

2) by, for example, providing timely, 

searchable, sortable information with 

which OSHA could identify and 

understand trends, and that reducing 

the amount of information available to 

the agency would make it less effective. 

(E.g., Document ID 1974; 1994; 2020– 

A1, p. 11; 2082–A2, p. 5; 2085–A1, pp. 

5–7). Others, assuming the data would 

be published, suggested that employees 

would use publicly available 

information to analyze whether their 

employers are underreporting, to 

identify hazards and prevent injuries, 

and to determine where they may want 

to work (e.g., Document ID 2012–A1, 

pp. 5, 13; 2022–A1, pp. 1, 2; 2047–A1, 

pp. 3–4; 2050–A1, p. 1; 2083–A1, p. 2; 

2085–A1, pp. 19–20 (quoting Document 

ID 2085–A10, pp. 13, 178 (NAS report)), 

and that employers would use the data 

to benchmark effectively, and to identify 

injury trends in the industry to prevent 

incidents before they occur (e.g, 

Document ID 2007–A1, p. 5; 2011–A3, 

p. 8; 2012–A1, p. 6; 2022–A1, p. 2). One 

commenter suggested that employers 

could use the data to assess the safety 

record of contractors before hiring them. 

(Document ID 2085–A1, p. 18). 

Commenters also argued that electronic 

access to the data would eliminate 

delays and obstacles to accessing the 

data for employees and their 

representatives. (E.g., Document ID 

2020–A1, p. 11; 2086–A1, p. 3). Other 

commenters opined that requiring 

employers to report their Forms 300 and 

301 electronically could improve the 

consistency and quality of what 

employers report, providing employers 

and employees with an opportunity to 

decrease injuries and illnesses both at 

particular establishments and companywide. (E.g., Document ID 2010–A2, p. 1; 

2082–A2, pp. 2–3; 2085–A1, p. 11). 

OSHA begins by noting that many of 

the benefits discussed by commenters 

would not materialize. Because OSHA 

has determined publishing the data 

would do more harm than good for 

reasons described more fully below and 

in the privacy discussion above, OSHA 

would not make the data public even if 

collected. In addition, as noted above, 

OSHA has already taken the position 

that data from Form 300A is exempt 

from disclosure under FOIA and that 

OSHA will not make such data public 

for at least the approximately four years 

after its receipt that OSHA intends to 

use the data for enforcement purposes. 

Therefore, the benefits some 

commenters ascribed to publication of 

the data would not be realized. Without 

publication, the research benefits 

claimed by many commenters (e.g., 

Document ID 1965–A1, p. 1; 2004–A1, 

p. 1; 2011–A1, pp. 2–3 (quoting the NAS 

report), 6–11; 2012–A1, pp. 3–4, 6–7; 

2015–A1, pp. 2–6; 2082–A2, pp. 2–3; 

2088–A1, pp. 2, 7–8) also fall away. To 

the extent case-specific data are crucial 

in conducting root-cause analyses, 

which can reduce and prevent 

workplace illnesses and injuries 

(Document ID 2000–A1, p. 1), 

employers can still use their own data, 

or share it with researchers voluntarily, 

for this purpose. OSHA acknowledges 

that the 300 and 301 data would have 

benefits for occupational safety and 

health research, but notes that 

researchers already have access to BLS 

data and severe injury data. OSHA has 

determined that the best use of the 

agency’s resources at this time is full 

utilization of 300A and severe injury 

data, not providing 300 and 301 data to 

researchers despite the uncertain 

incremental benefits of the data to 

OSHA and especially when OSHA itself 

will continue to protect workers by 

accessing Forms 300 and 301 through 

on-site inspections and for specific 

enforcement actions as needed. 

With respect to the remaining 

potential benefits for enforcement 

identified by the commenters, OSHA 

simply notes that those benefits are 

uncertain, and collecting and utilizing 

these data would be costly. OSHA 

cannot justify diverting resources from 

fully utilizing 300A data and severe 

injury data, which OSHA’s experience 

has shown to be useful for enforcement 

and compliance assistance, to collect 

data with uncertain benefits to OSHA’s 

core mission. 

NIOSH and other commenters stated 

that the data from Forms 300 and 301 

could be used for future research to 

identify patterns and trends across 

workplaces that could be masked by 

aggregated, summary data from Form 

300A. (Document ID 2003–A2, pp. 6–7; 

2007–A1, p. 4). In addition, the NAS 

report echoed a number of the benefits 

of collection identified by some 

commenters, including research for 

surveillance and prevention purposes, 

employer benchmarking, employee 

assessment of safety and health 

conditions at various workplaces, and 

intervention and education by public 

health agencies. (Document ID 1965–A1, 

pp. 177–179). The NAS report suggests 

that electronic collection of Form 300 

and 301 data would supplement BLS 

Survey of Occupational Injuries and 

Illnesses (SOII) data, letting OSHA focus 

its interventions and prevention efforts 

on hazardous industries, workplaces, 

exposures, and high-risk groups. 

(Document ID 1965–A1, p. 179). 

According to the report, collecting the 

Form 300 and 301 data would allow for 

expanding and targeting outreach to 

employers, particularly smaller 

employers, to improve hazard 

identification and prevention efforts, 

and would give OSHA the opportunity 

to advise employers on how their rates 

of injury and illness compare with the 

rest of their industry. (Document ID 

1965–A1, p. 178). 

OSHA will continue to work with 

NIOSH, other government agencies, and 

interested stakeholders to share 

information and leverage efficiencies to 

reduce workplace injuries and illnesses 

as appropriate. And while OSHA 

appreciates the findings and 

recommendations of the NAS Report 

that commenters identified, the 

approaches suggested by NAS would 

require substantial investment of time 

and money to develop. OSHA has 

determined that at this juncture, the 

protection of worker safety and health 

will best be furthered by allocating its 

resources in more concrete ways in 

which OSHA can more fully draw on its 

existing experience, such as utilizing 

the 300A and severe injury data it is 


khammond on DSKBBV9HB2PROD with RULES2
392 Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 

already collecting and analyzing for 

enforcement and compliance assistance 

activities. 

Several commenters pointed out ways 

in which OSHA has used Forms 300 

and 301 and similar data in the past to 

further its mission of ensuring safe and 

healthy workplaces. (E.g., Document ID 

2003–A2, pp. 6–7; 2012–A1, pp. 3–4). 

For example, commenters asserted that 

OSHA has previously analyzed Form 

300 and 301 data from multiple 

workplaces to identify frequentlyrecurring injuries and to better protect 

workers’ safety and health, and used 

information from severe injury reports 

to understand injury causation and to 

inform the agency’s compliance 

assistance and outreach efforts. 

(Document ID 2012–A1, pp. 3–4; 2003– 

A2, pp. 6–7). Employers have had to 

submit severe injury reports, containing 

information similar to what is included 

on Form 301, to OSHA since 2015. 

(Document ID 2003–A2, p. 6). To the 

extent OSHA has evaluated small 

batches of similar data in the past to 

further its mission of protecting worker 

safety and health, commenters suggest 

that a broader collection could be 

similarly useful. 

OSHA agrees that data from Forms 

300 and 301 and similar data can be 

helpful, but disagrees that its past 

experience justifies the broad collection 

envisioned in 2016. As NIOSH 

acknowledged in its comment, the 

volume of Form 300 and 301 data 

employers were required to submit 

under the 2016 final rule would far 

exceed the number of severe injury 

reports OSHA receives. (Document ID 

2003–A2, p. 6). Collecting and using a 

high volume of data—without the 

relevancy filters imposed by severe 

injury reports or on-site inspections— 

would require substantial resources to 

process and analyze. OSHA has 

determined that, at the current time, the 

resources OSHA would need to devote 

to developing that capacity and 

determining best how use the data 

would better achieve the mission of the 

agency by being allocated to full 

utilization of the 300A and severe injury 

data. OSHA will thus continue to obtain 

and use data from Forms 300 and 301 

from employers as needed for on-site 

inspections and specific enforcement 

actions, as has proven helpful in the 

past. 

Moreover, as OSHA notes elsewhere 

in this preamble, before making 300 and 

301 records requested on an ad hoc 

basis or severe injury reports public, the 

agency manually screens all of those 

records for PII and data that could reidentify workers. But the sheer volume 

of the data, which is expected to come 

from over 775,000 reports, would make 

the costs to manually screen all of the 

300 and 301 data enormous; OSHA 

believes those resources are better 

allocated to activities closer to OSHA’s 

core enforcement mission. One 

commenter suggested that collecting the 

data from Forms 300 and 301 

electronically would benefit workers by 

allowing them access to these records 

without fear of retaliation for requesting 

the records from their employers. 

(Document ID 2083–A1, p. 2). But 

OSHA notes that workers have a right 

under 29 CFR 1904.35 to access their 

own employers’ 300 and 301 data, and 

Section 11(c) of the OSH Act, 29 U.S.C. 

660(c), prohibits employers from 

retaliating against workers for exercising 

that right. Another commenter asserted 

that a worker’s medical provider could 

benefit from OSHA’s electronic 

collection and publication of 300 and 

301 data and using the data to assess 

conditions at the relevant workplace. 

(Document ID 2010–A2, p. 4) 

(commenting on the 2013 NPRM). But 

OSHA again notes that workers retain 

the right to access 300 and 301 data 

from their own employers and share it 

with their medical providers. 

After considering these comments, 

OSHA has determined that because it 

already has systems in place to use the 

300A data for enforcement targeting and 

compliance assistance without 

impacting worker privacy, and because 

the Form 300 and 301 data would 

provide uncertain additional value, the 

Form 300A data are sufficient for 

enforcement targeting and compliance 

assistance at this time. OSHA will 

continue to request copies of Forms 300 

and 301 during its inspections, and 

make use of data from severe injury 

reports, as appropriate. 

Collecting and Processing the 300 and 

301 Data Would Divert Agency 

Resources From Higher Priority 

Initiatives 

As OSHA stated in the NPRM, 

electronically collecting and taking 

steps necessary to try to use Form 300 

and 301 data would require the agency 

to divert resources from other priorities, 

including the analysis of Form 300A 

data. As explained above, OSHA has 

already collected summary 300A data 

from 214,574 establishments, and 

expects that volume to increase. OSHA 

is seeking to fully utilize these data, and 

has designed and implemented a 

targeted enforcement mechanism for 

industries experiencing higher rates of 

injuries and illnesses. OSHA likewise 

evaluates severe injury reports, which it 

receives shortly after accidents, to target 

its enforcement and complianceassistance efforts. 

Many commenters agreed that OSHA 

would need to significantly increase or 

divert its resources from other priorities 

to collect, process and analyze the 

electronically submitted Form 300 and 

301 data. (E.g., Document ID 2008–A1, 

p. 2; 2019–A1, pp. 2, 6–7, 9–10; 2044– 

A1, p. 6 (citing 83 FR at 36496)). Some 

noted that, without diverting resources 

from other priorities, OSHA might not 

be able to analyze and use the data as 

it intended when it finalized the 2016 

final rule (Document ID 2070–A1, p. 9), 

and that OSHA already has access to 

other data sources it can analyze and 

more potential violators than it can 

investigate with its resource constraints 

(Document ID 2055–A1, p. 2). By 

rescinding the requirement to collect 

electronically Form 300 and 301 data, 

OSHA will better focus on pre-existing, 

successful enforcement efforts. (E.g., 

Document ID 2044–A1, p. 6; 2075–A1, 

p. 4). Commenters also agreed with 

OSHA that the uncertain benefits of 

requiring employers to electronically 

submit Forms 300 and 301 do not 

outweigh the costs and burdens to 

OSHA and employers and the risk to 

worker privacy. (E.g., Document ID 

1985–A1, p. 1; 2008–A1, p. 2; 2024–A1, 

p. 1). 

Other commenters suggested that 

requiring electronic submission of the 

Form 300 and 301 data would help 

OSHA allocate its resources and identify 

injury trends, their causes, and 

emerging hazards to improve its 

enforcement and outreach efforts 

beyond what OSHA can accomplish 

with the 300A data. (E.g., Document ID 

1929; 1961–A1, pp. 1–2; 2007–A1, pp. 

1–5; 2011–A1, p. 6; 2054–A1, pp. 1, 

6–7, 8–9). One commenter theorized 

that having access to the detailed 

information contained in Forms 300 and 

301, rather than simply the summary 

data from Form 300A, can improve 

OSHA’s use of its enforcement resources 

to target the highest priority issues. 

(Document ID 2007–A1, p. 5). But these 

commenters provide no evidence to 

support their claims, and OSHA finds 

none in the record. OSHA’s own 

experience with using Form 300 and 

301 data is insufficient to support these 

theories. These commenters’ 

speculation therefore does not alter 

OSHA’s view that diverting OSHA’s 

focus from longstanding and successful 

agency priorities is not justified to 

achieve the uncertain benefits of 

electronically collecting data from 

Forms 300 and 301. 

Commenters pointed to OSHA’s 

statements in the 2016 final rule that 

collecting data from Forms 300 and 301 


khammond on DSKBBV9HB2PROD with RULES2
Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 393 

would allow the agency to leverage its 

resources to execute its mission by 

helping its compliance assistance 

programs, encouraging employers and 

workers to identify and address 

workplace hazards to avoid the 

perception of being an unsafe place to 

work, and providing data to employers, 

workers, unions and academics that 

would assist them in researching and 

innovating to improve workplace safety 

and health. (Document ID 2007–A1, p. 

3; 2017–A1, p. 2). Although OSHA 

identified these potential benefits, 

OSHA never quantified them. This final 

rule does not ignore those prior 

statements or the possibility that 

benefits could result from collecting the 

data, but concludes that the scope of 

any such benefits is uncertain. OSHA 

does not believe that these uncertain 

benefits justify the diversion of OSHA’s 

resources from other agency initiatives 

with a proven record of effectiveness. 

Some commenters asserted that a 

recent Office of the Inspector General 

(OIG) report auditing OSHA’s fatality 

and severe injury reporting program 

(OIG, Dep’t of Labor, OSHA Needs to 

Improve the Guidance for Its Fatality 

and Severe Injury Reporting Program to 

Better Protect Workers, 02–18–203–10– 

105 (OIG report), available at: https://

www.oig.dol.gov/public/reports/oa/ 

viewpdf.php?r=02-18-203-10- 

105&y=2018) demonstrates a need for 

improved reporting, noting that the OIG 

report concluded employers 

underreport fatalities and severe injuries 

by as much as 50 percent. (E.g., 

Document ID 2017–A1, p. 2; 2051–A1, 

p. 3). Commenters noted that the OIG 

report found that OSHA cannot 

effectively target compliance and 

enforcement efforts without complete 

information on work-related fatalities 

and severe injuries. (E.g., Document ID 

2051–A1, p. 3; 2089–A1, p. 2). Another 

commenter suggested that the collection 

and publication of data from Forms 300 

and 301 would create ‘‘publicly 

available checks’’ and increased 

accountability for employers. 

(Document ID 2062–A1, p. 2). 

OSHA disagrees that the OIG report 

indicated a need to collect more injury 

and illness data. Rather, the report 

recommends that OSHA take steps to 

better enforce and implement the severe 

injury reporting requirements. (OIG 

report, p. 1). Specifically, the OIG 

recommended that OSHA (1) develop 

and provide guidance to staff to detect 

and prevent underreporting; (2) 

consistently issue citations for 

underreporting; (3) clarify guidance for 

documentation of OSHA’s essential 

decisions, evidence required to 

demonstrate abatement by the employer, 

and requirements for monitoring 

employer-conducted investigations; and 

(4) emphasize the importance of 

conducting inspections for incidents 

that resulted in a fatality, two or more 

in-patient hospitalizations, emphasis 

programs, or imminent danger. (OIG 

report, p. 15). OSHA is committed to 

implementing these recommendations 

as indicated in OSHA’s formal response 

to the report, (OIG report, pp. 21–23), 

and OSHA has determined such 

implementation is more likely to 

address OIG concerns than 

electronically collecting Forms 300 and 

301. 

OSHA will use the OIG report’s 

findings to shape and improve its severe 

injury reporting objectives. Indeed, this 

rulemaking seeks to improve OSHA’s 

capacity to direct its resources to 

current initiatives such as implementing 

the severe injury reporting 

requirements, rather than collecting new 

data with uncertain benefits. OSHA’s 

current priorities include fully utilizing 

the data from the Form 300As and 

severe injury reports it is already 

collecting to improve its enforcement 

and outreach objectives to ensure 

compliance with the OSH Act. Again, 

investing in a program to collect, 

process, and analyze data from 

hundreds of thousands of Forms 300 

and 301 would constrain OSHA’s ability 

to achieve these and other priority 

enforcement goals. 

Regarding the suggestion that 

collection and publication of data from 

Forms 300 and 301 might increase 

compliance with electronic reporting 

requirements (Document ID 2062–A1, p. 

2), OSHA finds it can better hold 

employers accountable through the 

appropriate allocation of resources to 

enforcement efforts and compliance 

assistance, rather than collecting data 

with uncertain benefits. This 

commenter provides no evidence for the 

speculative suggestion that publication 

of the data would create an incentive for 

employers to report fatalities and severe 

injuries. (Document ID 2062–A1, p. 2). 

Collecting 300/301 Data Could Lead to 

Less Accurate Records 

Commenters expressed concern that 

requiring employers to report 

electronically the data from Forms 300 

and 301 could have a negative impact 

on accurate recordkeeping. For example, 

some employers may not prepare Forms 

300 and 301 accurately for fear that the 

information would become public and 

cause reputational harm or subject them 

to targeted OSHA inspections. 

(Document ID 2019–A1, p. 7; 2044–A1, 

p. 34 (commenting on 2013 NPRM); 

2055–A1, p. 2). Commenters also 

indicated that employers fear that 

publishing Form 300 and 301 data will 

expose confidential and proprietary 

information to their competitors and 

adversaries. (Document ID 2070–A1, pp. 

9–10; 2076–A1, pp. 6–7). For example, 

public disclosure of location 

information may allow competitors to 

determine confidential business 

locations or acquisitions that have not 

been publicized, or publication of the 

substances or chemicals that were 

involved in injuries and illnesses may 

identify products, inventions, or 

proprietary technologies that are in 

research and development. (Document 

ID 2070–A1, pp. 9–10). The collection’s 

focus on lagging indicators, which 

measure past safety performance, also 

may not be representative of a 

company’s current safety efforts. 

(Document ID 2044–A1, p. 30) 

(commenting on 2013 NPRM). One 

commenter explained that Forms 300 

and 301 are most useful to the employer 

when they contain robust information 

about the details of workplace injuries 

and illnesses, but that employers will 

have incentives to sanitize their reports 

if they believe they will become public, 

and be mischaracterized, as a result of 

electronic submission to OSHA. 

(Document ID 2019–A1, p. 7). 

Commenters also noted that workers 

may be reluctant to report accurately 

their data for Forms 300 and 301 for fear 

that the details of their reports will 

become public and reveal their private 

information. (Document ID 2030; 2085– 

A8, p. 8 (commenting on 2013 NPRM)). 

One commenter noted that the 

Confidential Information Protection and 

Statistical Efficiency Act of 2002 

requires BLS to keep this kind of data 

confidential. (Document ID 2053–A1, p. 

2). In enacting the CIPSEA, Congress 

found that ensuring the confidentiality 

of sensitive information submitted to 

the government ‘‘is essential in 

continuing public cooperation in 

statistical programs.’’ (Pub. L. 107–347 

sec. 511(a)(5)). While the CIPSEA 

applies to BLS, not OSHA, OSHA shares 

Congress’s concern that fear of sensitive 

information becoming public could 

undermine accurate reporting. 

Other commenters expressed concern 

that employers will hide workplace 

injuries if they are not required to file 

Forms 300 and 301 electronically. 

(Document ID 1976–A1, p. 1; 1996–A1, 

p. 1; 1999–A1, p. 1; 2002–A1, p. 1). 

OSHA finds these comments to be 

speculative and unsupported by its 

experience reviewing Forms 300 and 

301 through on-site inspections. OSHA 

also does not find that requiring 

employers to submit their 300 and 301 

data electronically would motivate them 


khammond on DSKBBV9HB2PROD with RULES2
394 Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 

to report injuries and illnesses they 

otherwise would not have recorded. 

One commenter noted that the cost to 

large employers of submitting their 300 

and 301 data was not burdensome 

because compliance would have cost 

approximately $258.34 per 

establishment per year, which would be 

an average of less than one dollar per 

employee per year. (Document ID 2012– 

A1, p. 12). Although OSHA 

acknowledges that the requirement to 

submit data from Forms 300 and 301 to 

OSHA would have been economically 

feasible for large employers, OSHA’s 

central rationale for rescinding these 

requirements is not to reduce employer 

costs but rather to protect worker 

privacy and to direct agency resources 

towards fully utilizing the data it is 

already collecting to advance 

improvements to health and safety for 

workers. 

OSHA has determined that publishing 

the data could also cause more harm 

than good. Workers would know in 

advance that some details of their 

injuries would be public and on the 

internet. Deterring worker reporting 

through fear of publication could make 

the records less accurate. And, because 

employers are required to report 

workplace injuries and illnesses 

regardless of fault, OSHA no longer 

considers collection of employers’ 

injury and illness records likely to 

‘‘nudge’’ them to make their workplaces 

safer, which OSHA identified in 2016 as 

a benefit of publishing the 300 and 301 

data. (See 81 FR 29629; Document ID 

2007–A1, pp. 4–5). OSHA finds that the 

final rule may ensure more accurate 

records on Forms 300 and 301 by 

alleviating employers’ and workers’ 

fears about the consequences of the 

records becoming public, and will allow 

employers to devote more of their 

resources towards compliance with 

safety and health standards. 

State Plan Issues 

In the NPRM, OSHA noted that, 

pursuant to section 18 of the OSH Act 

(29 U.S.C. 667) and the requirements of 

29 CFR 1904.37 and 1902.7, within 6 

months after publication of the final 

OSHA rule, state-plan states must 

promulgate occupational injury and 

illness recording and reporting 

requirements substantially identical to 

those in 29 CFR part 1904. (83 FR at 

36505). All other injury and illness 

recording and reporting requirements 

(for example, industry exemptions, 

reporting of fatalities and 

hospitalizations, record retention, or 

employee involvement) that are 

promulgated by state-plan states may be 

more stringent than, or supplemental to, 

the federal requirements, but, because of 

the unique nature of the national 

recordkeeping program, states must 

consult with OSHA and obtain approval 

of such additional or more stringent 

reporting and recording requirements to 

ensure that they will not interfere with 

uniform reporting objectives under 29 

CFR 1904.37 and 1902.7. (See 83 FR at 

36505). 

Some commenters responded to this 

section of the NPRM with concerns that 

centralized, federal collection is the 

most efficient and cost-effective way to 

compile detailed data for enforcement 

and prevention, and that the analysis of 

small, discrete quantities of data from 

multiple state databases will make 

important trends less apparent. 

(Document ID 2062–A1. p. 1; 2028–A1, 

pp. 5–6; 1965–A1, pp. 6–7). 

Commenters theorized that the detailed 

reporting requirements of the prior final 

rule would have enabled both federal 

OSHA and state plans to target their 

prevention and enforcement measures at 

particular employers and industries. 

(Document ID 2028–A1, p. 3; 2046–A1, 

p. 2). 

Commenters also asserted that, as a 

result of this final rule, some states 

would have to set up separate reporting 

systems at significant cost to maintain 

reporting requirements consistent with 

the prior final rule. (Document ID 2028– 

A1, p. 5; 2088–A1, p. 13). The California 

Department of Industrial Relations is in 

favor of the reporting requirements of 

the prior final rule because national 

collection would be more efficient than 

state-by-state collection, among other 

reasons. (Document ID 2062–A1, p. 3). 

Commenters also pointed out that some 

state-level agencies, such as the 

Washington State Department of Labor 

and Industries (‘‘WA L&I’’), have 

gathered detailed data through their 

workers’ compensation system and 

collaborated with NIOSH in analyzing 

the data to inform targeted enforcement 

strategies. (Document ID 1993–A1, p. 1; 

1965–A1, pp. 57–59). One commenter 

pointed to the NAS Report, which noted 

that ‘‘only 20 percent of states reported 

having substantial epidemiologic and 

surveillance capacity in occupational 

health’’ and concluded that this lack of 

surveillance capacity ‘‘results . . . in 

. . . missed opportunities for 

collaboration across public health 

domains to address convergent public 

health concerns that affect workers as 

well as the general public.’’ (Document 

ID 1965–A1, p. 122 (NAS Report)). One 

group of commenters expressed concern 

that OSHA’s consultation requirement 

would make it harder for states to 

implement such systems and noted that 

states without state plans or with state 

plans limited to public sector workers 

will not have the opportunity to have 

access to detailed data like that required 

by the prior rule. (Document ID 2028– 

A1, pp. 5–6). 

As OSHA noted in the NPRM, the 

effectiveness of the Form 300 and 301 

data as an enforcement and prevention 

tool in advancing worker safety is 

unclear. The suggestion that the data 

would be useful to states without state 

plans (Document ID 2028–A1, pp. 5–6), 

is speculative, as OSHA has determined 

that the benefits of collecting such data 

on a national scale are uncertain and do 

not outweigh the collection’s burdens 

and costs. (83 FR at 36498). OSHA finds 

that the Form 300A collection 

adequately serves its enforcement 

purposes at this time without 

jeopardizing worker privacy, and OSHA 

is committed to sharing these data with 

state-plan states, including those 

covering only public sector workers. 

OSHA cannot justify collecting Form 

300 and 301 data where the data’s 

usefulness is unclear. (83 FR at 36498). 

OSHA disagrees that this final rule 

would necessarily hinder states in 

implementing their own requirements 

for collection of Form 300 and 301 data. 

As OSHA explained in the NPRM, the 

rule does not preempt state law. (83 FR 

at 36505). The consultation requirement 

is not intended to limit state plans to 

strict conformity with the rule but rather 

to aid states in avoiding interference 

with OSHA’s unique recordkeeping 

program. There is no evidence in the 

record that individual state collection of 

Form 300 and 301 data would cause 

such interference. To the extent some 

state agencies, such as WA L&I, have 

already collected similar data, this 

shows that some states have 

mechanisms to collect the data they 

need without OSHA’s collecting 

electronically the Form 300 and 301 

data. If state agencies determine that a 

detailed data collection system is best 

for their states, then they may pursue 

such a system in consultation with 

OSHA. 

OSHA acknowledges that systems to 

collect this volume of data would be 

costly for states to implement. 

Centralized collection might be more 

efficient and cost-effective than state-bystate collection, but OSHA has doubts 

about the usefulness of the data and 

concerns about the costs of collection as 

noted elsewhere in this preamble. States 

are empowered to do as OSHA has and 

weigh the substantial costs of collection 

against the likely utility of the data. 

OSHA also notes, in response to a 

comment that some states have more 

limited surveillance capacity than 

others (Document ID 1965–A1, p. 57), 


khammond on DSKBBV9HB2PROD with RULES2
Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 395 

7As OSHA explained in the NPRM, the SOII is 

an establishment survey and is a comprehensive 

source of national estimates of nonfatal injuries and 

illnesses that occur in the workplace. (83 FR at 

36499). The survey collects data on non-fatal 

injuries and illnesses for each calendar year from 

a sample of employers based on recordable injuries 

and illnesses as defined by OSHA in 29 CFR part 

1904. (83 FR at 36499). Using data from the survey, 

BLS estimates annual counts and rates by industry 

and state for workers in private industry and state 

and local government. (83 FR at 36499–500). In 

addition, the SOII provides details about the most 

severe injuries and illnesses (those involving days 

away from work), including characteristics of the 

workers involved and details of the circumstances 

surrounding the incident, using data collected on 

Forms 300A and 301 from the sampled 

establishments. (83 FR at 36500 (citing BLS 

Handbook of Methods: https://www.bls.gov/opub/ 

hom/soii/home.htm)). 

that those states will have access to the 

summary data collected by OSHA, and 

that OSHA itself must appropriately 

allocate its resources for surveillance to 

best serve OSHA’s mission of protecting 

all workers. States are empowered to 

share the data gathered at the state level 

at their discretion and consistent with 

any applicable laws. In promulgating 

this rule, OSHA erects no barrier to 

communication among state agencies. 

B. New Requirement To Include 

Employer Identification Number With 

Injury and Illness Data Submitted to 

OSHA Electronically Under 29 CFR 

1904.41 

The NPRM included a provision that 

would require covered employers to 

submit their Employer Identification 

Number (EIN) electronically along with 

their injury and illness data submission 

in the proposed rule. (83 FR at 36494). 

OSHA explained that it had limited the 

proposed data collection in its 2013 

NPRM (78 FR 67254) to Improve 

Tracking of Workplace Injuries and 

Illnesses to records that employers were 

already required to collect under part 

1904. Accordingly, the May 2016 final 

rule only required the electronic 

submission of such records. These 

records do not include the employer’s 

EIN. 

After collecting and analyzing the first 

year of data (i.e., Calendar Year 2016 

Form 300A data), however, OSHA and 

BLS realized that collecting EINs could 

help the agencies make full use of the 

data collected. The proposed EIN 

submission requirement grew out of that 

realization. As the agency explained in 

the proposal, this change could have a 

number of benefits. (83 FR at 36499– 

500). For example, OSHA posited that 

collecting EINs would increase the 

likelihood that BLS would be able to 

match data collected by OSHA under 

the electronic reporting requirements in 

29 CFR part 1904 to data collected by 

BLS for the Survey of Occupational 

Injury and Illnesses (SOII). The ability 

to accurately match the data is critical 

for evaluating how BLS might use 

OSHA-collected data to supplement the 

SOII, which in turn would enhance the 

ability of OSHA and other users of the 

SOII data to identify occupational injury 

and illness trends and emerging issues. 

Furthermore, the ability of BLS to match 

the OSHA-collected data also has the 

potential to reduce the burden on 

employers who are required to report 

injury and illness data both to OSHA 

(for the electronic recordkeeping 

requirements in part 1904) and to BLS 

(for the SOII).7

OSHA also noted in the proposal that 

without the EIN, there is no 

methodological approach to match 

completely the establishments that 

submit data through both OSHA’s 

collection of injury and illness data 

under § 1904.41 and the BLS data 

collection for the SOII. BLS cannot 

provide its collected data to OSHA 

because the Confidential Information 

Protection and Statistical Efficiency Act 

of 2002 (Pub. L. 107–347, 116 Stat. 2899 

(2002)) prohibits BLS from releasing 

establishment-specific data to either 

OSHA or the general public. (83 FR at 

36500). Although OSHA can provide the 

data it collects to BLS, without the EIN 

it is very difficult to match the 

establishments in OSHA’s data 

collection to the establishments in BLS’s 

data collection. Not having the EIN 

increases the resources necessary to 

match the data and reduces the accuracy 

of the match. 

OSHA further explained its 

preliminary determination that 

including the EIN in the electronic 

reporting to OSHA would improve 

BLS’s ability to match accurately the 

OSHA-collected data with the SOII data. 

(83 FR at 36500). OSHA suggested that, 

after evaluation of the accuracy of the 

data matching, it might be possible for 

BLS to use the OSHA-collected data to 

generate occupational injuries and 

illnesses estimates, reducing burden on 

employers by decreasing duplicative 

reporting. If the EIN is not collected and 

the data from the two sources cannot be 

accurately matched, reducing this 

burden becomes nearly impossible. 

Finally, OSHA suggested that 

including the EIN as part of electronic 

reporting could improve the quality and 

utility of the collected data. (83 FR at 

36500). For example, OSHA noted that 

it could use the EIN to identify errors 

such as multiple submissions of data 

from the same establishment and to link 

multiple years of data submissions from 

the same establishment. (83 FR at 

36500). The agency also observed that 

the EIN could be used to match against 

other databases that contain this 

identifier to add additional 

characteristics to the data. (83 FR at 

36500). For example, OSHA routinely 

collects the employer’s EIN during an 

inspection and enters the EIN into the 

OSHA Information System (OIS). OSHA 

noted in the proposal that Form 300A 

submissions with an EIN could be 

linked to the OIS to identify the 

previous enforcement history of the 

establishment when the inspection 

records contain the EIN. (83 FR at 

36500). 

In the proposal, OSHA also noted that 

EINs do not have the same level of 

protection as Social Security numbers. 

(83 FR at 36500). In fact, many 

employers’ EINs are available in a 

variety of public sources, including 

filings with the U.S. Securities and 

Exchange Commission, the Federal 

Communications Commission’s 

Commission Registration System, and 

the DOL’s Employee Benefits Security 

Administration. (83 FR at 36500). 

Businesses also have to share EINs with 

contractors and clients for tax reporting, 

such as filing an IRS Form 1099. (83 FR 

at 36500). As a result, OSHA explained, 

the Department has not generally 

withheld EINs from disclosure. (83 FR 

at 36500). 

OSHA asked stakeholders to comment 

on its proposal to add the EIN 

submission requirement generally. (83 

FR at 36499). The agency also 

specifically invited public comment on 

the advantages and disadvantages of 

requiring employer submission of EINs 

and on whether employers required to 

electronically report information to 

OSHA under part 1904 would consider 

the EIN to be exempt from disclosure, 

either as confidential business 

information or for another reason. (83 

FR at 36500). In addition, OSHA asked 

if there were any circumstances where 

the EIN would be considered PII and 

whether there were privacy concerns 

that might arise from employers 

submitting their EIN. (83 FR at 36500). 

Commenters submitted a number of 

comments in response to OSHA’s 

request. These comments generally fall 

into three categories: (1) Comments 

related to the benefits of collecting EINs, 

(2) comments focusing on whether an 

employer’s EIN is commercially 

confidential or sensitive, and (3) 

comments suggesting alternatives to the 

agency’s proposal that might achieve the 

agency’s goal of reducing respondent 

burden and increasing the utility of the 

data collected, without the submission 


khammond on DSKBBV9HB2PROD with RULES2
396 Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 

of EINs. Each of these issues, 

commenters’ submissions, and the 

agency’s final determinations are laid 

out in more detail below. 

Benefits of Collecting the EIN 

As discussed above, OSHA 

preliminarily determined that collecting 

EINs would have a number of benefits, 

including streamlining reporting for 

employers who are required to report 

injury and illness data both to OSHA 

and BLS, improving the agencies’ ability 

to match their data, and improving the 

quality and utility of the collected data. 

(83 FR at 36499–500). OSHA received 

many comments on the benefits of 

collecting the EIN. 

Many commenters agreed with OSHA 

that collection of the EIN would 

enhance the utility of the data and 

therefore improve worker safety and 

health. (E.g., Document ID 2012–A1, p. 

15). Several commenters provided 

specific examples of how the EIN can be 

used by OSHA for research purposes, 

such as identifying employers with 

patterns of injuries (E.g., Document ID 

2015–A1, p. 7) and matching against 

other databases that contain the EIN to 

add characteristics to the data. (E.g., 

Document ID 2003–A2, p. 7). Several 

commenters also noted that using the 

EIN to enhance research is consistent 

with recommendations from the NAS 

Report. (E.g., Document ID 2003–A2, p. 

7). Still other commenters observed that 

collecting EINs would allow OSHA to 

improve the quality and utility of the 

data collected, and provided many 

examples of the benefits associated with 

having this data element. (E.g., 

Document ID 2088–A1, p. 14; 2012–A1, 

p. 15; 2003–A2, p. 7). For example, 

some commenters noted that adding the 

EIN would enhance the value of the data 

for enforcement and compliance 

assistance by allowing OSHA to identify 

the relationship between establishments 

rather than having to rely on company 

names that can be similar across 

different businesses. (E.g., Document ID 

2007–A1, pp. 8–9; 2012–A1, p. 15; 

2074–A1, p. 5). 

Many commenters also agreed with 

OSHA that collecting the EIN along with 

data submissions under part 1904 could 

potentially reduce duplicative reporting 

for employers that are also required to 

submit data both to BLS under the SOII. 

(E.g., Document ID 2088–A1, p. 14; 

2036–A1, p. 8). Several commenters 

noted that using the EIN to reduce 

duplication of burden is consistent with 

the NAS report. (E.g., Document ID 

2085–A1, p. 20). 

Other commenters, however, 

disagreed, observing that there ‘‘appears 

to be little value to OSHA gained in 

collecting the EIN.’’ (Document ID 

2084–A2, p. 5). 

After carefully reviewing all the 

comments submitted on this subject, 

OSHA finds that collection of the EIN 

will result in the benefits detailed by 

commenters. Having this common 

identifier will help OSHA understand 

exactly which establishment the Form 

300A data represents, link 

establishments between databases, and 

track data over time. The difficulties 

involved in matching and tracking 

establishments by name and address 

introduce uncertainty which in turn 

reduces the utility of the data collected. 

A numerical identifier that is common 

over time and between databases 

eliminates these uncertainties. 

Collecting the EIN is also an essential 

first step towards eliminating 

duplicative reporting to OSHA and BLS 

in the future. In short, collection and 

use of the EIN presents the most 

practical and efficient solution for 

matching and linking the BLS and 

OSHA data sets and at the same time 

increases the utility and accuracy of the 

data within OSHA’s data set. 

Sensitivity of the EIN 

Although nearly all of the 

commenters who opined on the 

potential benefits of collecting the EIN 

agreed with OSHA that the collection 

would be beneficial, a number of 

commenters argued that any benefits to 

OSHA in collecting the EIN were 

outweighed by the risks if the EIN is 

publicly disclosed. (Document ID 2064– 

A1, p. 2). For example, some 

commenters expressed concern about 

the commercial sensitivity of the EIN 

and the potential for fraud. (E.g., 

Document ID 2057–A1, p. 5). Some 

commenters maintained that the EIN 

was confidential business information 

comparable to a Social Security number. 

(E.g., Document ID 2041–A1, p. 2; 2066– 

A1, p. 2). One commenter stated that it 

did not object to OSHA’s proposal to 

include EINs with Form 300A filings, 

provided that OSHA maintains this 

information as confidential. (Document 

ID 2049–A1, p. 2). 

Others, though not claiming that the 

EIN was confidential commercial 

information, nonetheless asserted that 

collecting the EIN could harm 

businesses and that such harm 

outweighed any benefits of collection. 

(E.g., Document ID 2084–A2, p. 5; 2039– 

A1, p. 3). For example, one commenter 

asserted that employers are concerned 

about making EINs more widely 

available through FOIA requests ‘‘given 

the high potential for fraud. For 

example, a 2013 audit by the U.S. 

Department of the Treasury identified 

767,071 corporate tax returns with 

potentially fraudulent refunds totaling 

almost $2.3 billion due to stolen and 

falsely obtained EINs.’’ (Document ID 

2057–A1, p. 5). Commenters also stated 

that the risk of bad actors causing 

‘‘irreparable harm’’ through malicious 

use of the EIN ‘‘far outweighs the issues 

involved in duplicative reporting.’’ 

(Document ID 2039–A1, p. 3; see also 

Document ID 2084–A2, p. 5; 2064–A1, 

p. 2). 

Other commenters conceded that the 

EIN was not commercially confidential 

and did not oppose OSHA’s proposal to 

collect the EIN with injury and illness 

data. (E.g., Document ID 2036–A1, p. 8; 

2070–A1, p. 17). For example, Mark 

Dreux of the Corn Refiners Association 

(CRA) stated: ‘‘Because employers are 

required to disclose their EINs in many 

different contexts . . . CRA’s members 

do not consider it to be confidential or 

proprietary business information.’’ 

(Document ID 2036–A1, p. 8). 

Consequently, CRA indicated that its 

members did not have any concerns 

with the proposed requirement to 

submit EINs in conjunction with injury 

and illness data to facilitate the 

exchange of data between OSHA and 

BLS. (Document ID 2036–A1, p. 8). In 

fact, CRA’s members agreed with OSHA 

that ‘‘the submission of employers’ EINs 

will simplify and avoid duplicative 

reporting of information between the 

two agencies.’’ (Document ID 2036–A1, 

p. 8; see also Document ID 2070–A1, p. 

17). Other employers simply noted that 

they did not object to collection of EINs. 

(E.g., Document ID 1930–A1, p. 5). 

There were no comments that claimed 

the EIN is Personally Identifiable 

Information (PII). Several commenters 

specifically stated that it is not PII. (E.g., 

Document ID 1969; 2070–A1, p. 17). 

After reviewing these comments, 

OSHA concludes that the EIN is not 

confidential commercial information, 

nor is it too sensitive to collect with 

injury and illness data. The EIN is a 

government-issued number (thus, not 

commercial), and as discussed above, 

many commenters conceded that EINs 

are routinely made public (thus, not 

confidential). Many companies must 

include their EINs on public filings or 

in filings that are later disclosed in 

response to FOIA requests. (See 83 FR 

at 36500). For these reasons, OSHA has 

determined the EIN is not too sensitive 

to collect given the possibility of release 

to the public under FOIA. 

OSHA also reviewed the Treasury 

Inspector General for Tax 

Administration’s 2013 report, Stolen 

and Falsely Obtained Employer 

Identification Numbers Are Used to 

Report False Income and Withholding, 


khammond on DSKBBV9HB2PROD with RULES2
Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 397 

referenced in a comment (see Document 

ID 2057–A1, p. 5). The report does not 

indicate any harm done to the legitimate 

business owners of the stolen EINs. 

While the report shows that tax fraud 

involving misused EINs exists, it does 

not provide any indication that 

collection of the EIN by OSHA would 

put employers at increased risk or 

exacerbate the problem of false tax 

returns. OSHA does not agree that the 

findings of this report are relevant to the 

agency’s collection of the EIN with 

injury and illness data. 

Alternative Proposals and 

Miscellaneous Issues 

Several commenters encouraged 

OSHA to seek and use alternative 

methods to achieve the goal of reducing 

respondent burden and increasing the 

utility of the data collected without 

collecting the EIN, such as exploring 

technological approaches to resolve the 

duplication issue (Document ID 2039– 

A1, p. 3), and others suggested that 

OSHA should not need the EIN ‘‘to 

determine whether it has correct 

information when comparing it with 

[BLS].’’ (Document ID 2073–A1, p. 2). 

One commenters suggested that OSHA 

should delay collection of the EIN 

‘‘unless there is relative certainty that 

the data can and will be used for its 

intended purpose.’’ (Document ID 2019– 

A1, p. 8). 

OSHA agrees that further 

collaboration with BLS to identify 

methods for reducing respondent 

burden is vital. Collection and use of the 

EIN presents the most practical and 

efficient solution for matching and 

linking the two agencies’ separate data 

sets at this time. OSHA does not agree 

that a delay in the collection is 

warranted. The benefits of having these 

data are clear, as discussed above. Any 

delay in the collection of the EIN would 

delay the reduction in respondent 

burden and increased utility of the Form 

300A data collected. 

The final rule requires employers to 

provide the EIN of their establishments 

when submitting their injury and illness 

data. As discussed above, evidence in 

the docket shows the EIN is a widely 

available public record. Employers 

routinely made their EIN available to 

both government and private entities, 

and OSHA already collects and stores 

EINs in its inspection records. OSHA 

concludes the collection and storage of 

the EINs through the ITA will pose 

minimal adverse effects to 

establishments that provide these data. 

At the same time, OSHA concludes the 

benefits of collecting these data are 

substantial. Having the EIN will 

increase the utility of the data by both 

BLS and OSHA and may reduce the 

burden on employers that are required 

to respond to both the BLS and OSHA 

data collections. OSHA will continue to 

collaborate with BLS to identify 

technological approaches to reduce 

respondent burden, including exploring 

changes to both data collection systems 

and real-time sharing of OSHA data 

with BLS. 

Compliance Dates 

The requirement to include the EIN 

for each establishment submitting injury 

and illness data under 29 CFR 1904.41 

will become effective on February 25, 

2019. The compliance date for this 

provision is March 2, 2020. The EIN 

will therefore be required for covered 

establishments submitting their 300A 

data from 2019, but not for covered 

establishments submitting their 300A 

data from 2018, which have to be 

submitted by March 2, 2019. 

IV. Final Economic Analysis and 

Regulatory Flexibility Certification 

A. Introduction 

Executive Orders 12866 and 13563 

require that OSHA estimate the benefits, 

costs, and net benefits of proposed and 

final regulations. Executive Orders 

12866 and 13563, the Regulatory 

Flexibility Act (5 U.S.C. 601–612) and 

the Unfunded Mandates Reform Act 

(UMRA) (2 U.S.C. 1501–1571) also 

require OSHA to estimate the costs, 

assess the benefits, and analyze the 

impacts of certain rules that the agency 

promulgates. Executive Orders 12866 

and 13563 direct agencies to assess all 

costs and benefits of available regulatory 

alternatives and, if regulation is 

necessary, to select regulatory 

approaches that maximize net benefits 

(including potential economic, 

environmental, public health and safety, 

and other effects; distributive impacts; 

and equity). Executive Order 13563 

emphasizes the importance of 

quantifying both costs and benefits, 

reducing costs, harmonizing rules, and 

promoting flexibility. 

In its preliminary economic analysis 

(PEA) in the proposal, OSHA estimated 

that this rule would have net cost 

savings of $8.28 million per year at a 3 

percent discount rate, including $8.23 

million per year for the private sector 

and $52,754 per year for the 

government. Annualized at a 7 percent 

discount rate, OSHA estimated that the 

proposed rule would have net cost 

savings of $8.25 million per year, 

including $8.18 million per year for the 

private sector and $64,070 per year for 

the government. Annualized at a 

perpetual 7 percent discount rate, the 

estimate rose to net cost savings of $8.35 

million per year. The agency stated its 

belief that the electronic collection of 

information in the Forms 300 and 301 

poses risks to worker privacy and 

additional cost to employers and OSHA 

that outweigh the uncertain 

enforcement benefits of collecting that 

information. (83 FR at 36501). 

In this final economic analysis, OSHA 

estimates that the rule would have net 

cost savings of $15.9 million per year at 

a 3 percent discount rate, including $8.4 

million per year for the private sector 

and $7.5 million per year for the 

government. Annualized at a 7 percent 

discount rate, the rule would have net 

cost savings of $15.86 million per year, 

including $8.37 million per year for the 

private sector and $7.5 million per year 

for the government. Annualized at a 

perpetual 7 percent discount rate, the 

rule would have net cost savings of 

$16million per year. The agency has 

determined that the rescission of the 

requirement to submit electronically the 

Forms 300 and 301 data will benefit 

worker privacy by preventing routine 

government collection of information 

that may be quite sensitive, including 

descriptions of workers’ injuries and the 

body parts affected. OSHA has 

determined that, at this time, avoiding 

this risk to worker privacy outweighs 

the uncertain incremental benefits to 

enforcement gained from electronically 

collecting the data. In addition, the rule 

will allow OSHA to focus its resources 

on the collection of 300A data and the 

data provided through the new serious 

injury and illness reporting system. 

OSHA finds that the new requirement 

for establishments to submit their EIN 

will help both OSHA and BLS make full 

use of the data the agencies collect. 

Collecting the EIN is helpful to 

understanding exactly which 

establishment the Form 300A data 

represents, linking establishments 

between databases, and tracking data 

over time. The difficulties involved in 

matching and tracking establishments 

by name and address introduce 

uncertainty, which in turn reduces the 

utility of the data collected. A numerical 

identifier that is common over time and 

between databases eliminates these 

uncertainties. Collecting the EIN is also 

a positive first step towards eliminating 

duplicative reporting to OSHA and BLS 

in the future. In short, OSHA concludes 

that collection of the EIN presents the 

most practical and efficient solution for 

matching and linking the BLS and 

OSHA data sets and at the same time 

increases the quality and utility of the 

collected data. 

The final rule is not an ‘‘economically 

significant regulatory action’’ under E.O. 


khammond on DSKBBV9HB2PROD with RULES2
398 Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 

8See https://www.bls.gov/oes/current/ 

oes299011.htm. 

9See https://www.bls.gov/news.release/ 

ecec.nr0.htm. 

10See the sensitivity analyses in the Improved 

Tracking FEA (https://www.gpo.gov/fdsys/pkg/FR2017-11-24/pdf/2017-25392.pdf, page 55765) and 

the FEA in support of OSHA’s 2016 final standard 

on Occupational Exposure to Respirable Crystalline 

Silica (81 FR 16285) (https://www.gpo.gov/fdsys/ 

pkg/FR-2016-03-25/pdf/2016-04800.pdf pp.16488– 

16492.). The methodology was modeled after an 

approach used by the Environmental Protection 

Agency. More information on this approach can be 

found at: U.S. Environmental Protection Agency, 

‘‘Wage Rates for Economic Analyses of the Toxics 

Release Inventory Program,’’ June 10, 2002 (Ex. 

2066). This analysis itself was based on a survey of 

several large chemical manufacturing plants: 

12866 or UMRA (2 U.S.C. 1532(a)), and 

it is not a ‘‘major rule’’ under the 

Congressional Review Act (CRA) (5 

U.S.C. 801 et seq.). The agency estimates 

that the rulemaking imposes far less 

than $100 million in annual economic 

costs. In addition, it does not meet any 

of the other criteria specified by UMRA 

or CRA for a significant regulatory 

action or major rule. The final rule is a 

deregulatory action under Executive 

Order 13771 (82 FR 9339 (January 30, 

2017)). 

The final rule will make two changes 

to the existing recording and reporting 

requirements in part 1904. First, OSHA 

will eliminate the requirement for 

establishments that are required to keep 

injury and illness records under part 

1904, and that had 250 or more 

employees in the previous year, to 

electronically submit information from 

OSHA recordkeeping Forms 300 and 

301 to OSHA or OSHA’s designee, on an 

annual basis. Second, OSHA will 

require covered employers to submit 

their EIN electronically along with other 

injury and illness data they are required 

to submit to OSHA. These changes in 

existing requirements are identical to 

those included in the proposal. The 

final rule does not make any other 

changes to an employer’s obligations 

regarding injury and illness records. 

In the subsections below, OSHA will 

first examine the cost savings, costs, net 

cost savings, and benefits of the 

activities outlined above, including a 

discussion of the comments submitted 

on these topics. The agency will then 

turn to its economic feasibility finding 

and its certification under the 

Regulatory Flexibility Act. 

B. Cost Savings 

As discussed in more detail below, 

OSHA preliminarily estimated that the 

proposed elimination of the requirement 

that establishments with 250 or more 

employees submit information 

electronically from their OSHA Forms 

300 and 301 would result in cost 

savings to employers and to the 

government. (See 83 FR at 36501–02). 

Numerous commenters responded that 

businesses are already required to keep 

these data and that reporting the data to 

OSHA was not a costly additional 

requirement. (E.g., Document ID 1943; 

1945; 1947; 2077–A1, p. 2). One 

commenter stated that making the data 

from Forms 300 and 301 available ‘‘is a 

reasonable cost of doing business.’’ 

(Document ID 1942). None of these 

comments challenged OSHA’s specific 

cost estimates; rather, they simply 

asserted that the costs were not 

substantial. OSHA’s estimate of the cost 

savings to employers from eliminating 

the requirement to submit the data from 

Forms 300 and 301 is consistent with 

OSHA’s finding in 2016 regarding the 

incremental cost of submitting these 

data. And, as detailed earlier in this 

preamble, even though any related costs 

may be minor for larger employers, 

OSHA has decided to rescind the 

requirement to submit the data from 

Forms 300 and 301 primarily to protect 

sensitive worker information from the 

risk of public disclosure, and to focus its 

resources on fully utilizing the 300A 

data and severe injury reports OSHA 

already collects rather than diverting 

resources from those efforts given the 

uncertain extent of any incremental 

benefits the 300 and 301 data would 

have for OSHA’s enforcement and 

outreach activities. 

For the PEA, OSHA relied on the 

Final Economic Analysis (FEA) in the 

May 2016 final rule (see 81 FR at 

29674–87), updated to include more 

recent data and some modifications in 

OSHA’s methodology. OSHA obtained 

the estimated cost of electronic data 

submission by multiplying the 

compensation per hour of the person 

expected to perform the task of 

electronic data submission by the time 

required to submit the data. (83 FR at 

36501). 

In the PEA, as in the 2016 FEA, OSHA 

selected an employee in the occupation 

of Industrial Health and Safety 

Specialist as being at the appropriate 

salary level. The agency stated that the 

mean hourly wage for Standard 

Occupational Classification (SOC) code 

29–9011, Industrial Health and Safety 

Specialists, in the May 2016 data from 

the BLS Occupational Employment 

Survey (OES), was $34.85. However, 

OSHA recognized that not all firms 

assign the responsibility for 

recordkeeping to an Industrial Health 

and Safety Specialist. For example, a 

smaller firm may use a bookkeeper or a 

plant manager, while a larger firm may 

use a higher-level specialist. Therefore, 

OSHA asked for comment on whether 

Industrial Health and Safety Specialist 

is the appropriate salary level for the 

employee performing this task. (83 FR at 

36501). 

OSHA did not receive any comments 

on this question; nor did commenters 

object to the mean hourly rate used in 

the PEA. Therefore, OSHA finds that 

Industrial Health and Safety Specialist 

is the appropriate salary level. The 

updated mean hourly rate for this 

position, per the May 2017 OES data, is 

$35.38.8 OSHA notes that this is the raw 

wage and does not include the other 

fringe benefits that make up full hourly 

compensation or overhead costs 

calculated in this analysis. 

In the PEA, OSHA multiplied the 

mean hourly wage for Industrial Health 

and Safety Specialist ($34.85) by the 

applicable mean fringe benefit factor for 

workers in private industry as reported 

in the June 2017 data from the BLS 

National Compensation Survey (1.44) to 

obtain the estimated total compensation 

(wages and benefits) of $50.18 per hour. 

(83 FR at 36501). 

OSHA did not receive any comments 

on this point. Therefore, OSHA is 

retaining the estimate, with updates 

based on the June 2018 data from the 

BLS National Compensation Survey.9

The Survey again reported a mean fringe 

benefit factor of 1.44 for workers in 

private industry. Multiplying the mean 

fringe benefit factor by the updated 

hourly wage of $35.38 produces an 

estimated total compensation of $50.95 

(an increase of 1.5 percent from the 

PEA, due to the increase in the mean 

hourly wage). OSHA believes that the 

calculated cost of $50.95 per hour is a 

reasonable estimated total hourly 

compensation for a typical record 

keeper. 

As noted in the PEA, overhead costs 

are indirect expenses that cannot be tied 

to producing a specific product or 

service. Common examples include 

rent, utilities, and office equipment. 

Unfortunately, there is no general 

consensus on the cost elements that fit 

this definition. The lack of a common 

definition has led to a wide range of 

overhead estimates. Consequently, the 

treatment of overhead costs needs to be 

case-specific. For the PEA, OSHA 

adopted an overhead rate of 17 percent 

of base wages. OSHA explained that the 

17 percent rate was consistent with the 

overhead rate used for sensitivity 

analyses in the FEA in support of the 

2017 final rule delaying the deadline for 

submission of 300A data (82 FR 55761) 

and the FEA in support of OSHA’s 2016 

final standard on Occupational 

Exposure to Respirable Crystalline 

Silica.10 (83 FR at 36501). 


khammond on DSKBBV9HB2PROD with RULES2
Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 399 

Heiden Associates, Final Report: A Study of 

Industry Compliance Costs Under the Final 

Comprehensive Assessment Information Rule, 

Prepared for the Chemical Manufacturers 

Association, December 14, 1989, Ex. 2065. 

11To the extent some establishments may not 

have an internet connection on site, that could also 

increase the time burden and thus raise the cost 

estimate. 

12OSHA solicited comment on this assumption in 

the PEA but received none and so has retained this 

method for estimating total recordable cases for this 

FEA. 

13Note that totals summarized in the text may not 

precisely sum from underlying elements due to 

rounding. The precise calculation of the numbers in 

the FEA appears in the spreadsheet in the 

rulemaking docket titled ‘‘FEA calculations.’’ 

To calculate the total labor cost for an 

Industrial Health and Safety Specialist, 

Standard Occupational Classification 

(SOC) code 29–9011 for the PEA, OSHA 

added three components together: Base 

wage ($34.85) + fringe benefits ($15.33, 

derived as 44% of $34.85) + applicable 

overhead costs ($5.92, derived as 17% 

of $34.85). This increased the labor cost 

of the fully-loaded hourly wage for an 

Industrial Health and Safety Specialist 

to $56.10. (83 FR at 36501). 

OSHA did not receive any comments 

concerning its use of overhead or the 

calculations to add an overhead charge 

to the loaded wage rate. Therefore, for 

the FEA, OSHA has calculated the total 

labor cost for an Industrial Health and 

Safety Specialist, Standard 

Occupational Classification (SOC) code 

29–9011, using the same method. The 

three components are added together: 

Base wage ($35.38) + fringe benefits 

($15.57, derived as 44% of $35.38) + 

applicable overhead costs ($6.01, 

derived as 17% of $35.38). This 

increases the labor cost of the fullyloaded hourly wage for an Industrial 

Health and Safety Specialist to $56.96. 

OSHA considers this to be a reasonable 

estimate of total labor costs. 

To estimate the time required for the 

data submission in the PEA, OSHA used 

the same estimated unit time 

requirements as reported by BLS in its 

paperwork burden analysis for the 

Survey of Occupational Injuries and 

Illnesses (SOII) (OMB Control Number 

1220–0045). BLS estimated 10 minutes 

per recordable injury/illness case for 

electronic submission of the information 

on Form 300 (Log of Work-Related 

Injuries and Illnesses) and Form 301 

(Injury and Illness Incident Report). 

OSHA also noted that, in the 2016 FEA, 

the agency estimated 2 minutes more 

time than the BLS paperwork burden, 

for a total of 12 minutes per recordable 

case (10 minutes per case for Form 301 

entries plus 2 minutes per case for entry 

of Form 300 log entries), to account for 

the differences between BLS and OSHA 

submission requirements. (83 FR at 

36501–02). 

OSHA received two comments about 

its preliminary time and burden hour 

calculations. (Document ID 2012–A1, p. 

12). The first commenter argued that 

OSHA’s estimated establishmentspecific costs of the electronic 

submission of data to OSHA are likely 

to be far higher than the actual costs to 

employers, since the PEA assumed that 

all the data will be entered manually for 

electronic submission. (Document ID 

2012–A1, p. 12). The commenter wrote 

that OSHA noted in the 2016 rule that 

establishments that already keep their 

records electronically may have lower 

submission times if they can export or 

transmit the required information rather 

than entering it into the web form. 

(Document ID 2012–A1, p. 12) (quoting 

81 FR 29690). The commenter asserted 

that OSHA ignored this potential 

decrease in burden hours in the PEA. 

(Document ID 2012–A1, p. 12). 

OSHA recognizes that many large 

establishments will already be keeping 

their records electronically and would 

likely have submitted their data 

electronically through a batch upload or 

other bulk electronic transmission, thus 

reducing the time that would have been 

needed to comply with the electronic 

reporting requirement and the 

corresponding cost estimate. The agency 

does not have precise information 

regarding the percentage of employers 

that fall into that category. Even if the 

percentage of those large employers is 

substantial, OSHA does not have, and 

commenters did not provide, data on 

the ease with which those employers 

could package this information and 

transmit it in the format required.11

Therefore, as in the 2016 final rule, 

OSHA is retaining the time estimate that 

assumed manual data entry for 

electronic submission. 

In addition, to the extent that the 

commenter is arguing that the agency’s 

omission of this fact from the PEA was 

an attempt to obscure a potential 

decrease in the proposal’s estimated 

cost savings, OSHA notes that the 

statement regarding potential time 

savings was made in response to a 

comment submitted during the 2016 

rulemaking—a comment that did not 

cause the agency to change its time 

estimate. Moreover, the agency was 

clear in the PEA that its methodology 

was based on the numbers in the 2016 

rule. (See 83 FR 36501). 

The second commenter on this issue 

similarly argued that OSHA’s cost 

estimate of 12 minutes per recordable 

case is based on the wrong data point. 

The commenter maintained that 

OSHA’s preliminary cost analysis failed 

to disaggregate the time spent preparing 

Forms 300, 300A, and 301 (which an 

employer must incur regardless of 

whether the form must be submitted to 

OSHA electronically) from the time 

spent electronically submitting Forms 

300 and 301 to OSHA. The commenter 

argues that OSHA’s cost estimate should 

be based only on the marginal time of 

electronic reporting itself. (Document ID 

2033–A1, p. 6). 

OSHA agrees that the time estimate 

(and, thus, the cost savings estimate) 

should account only for the incremental 

time spent on each data submission— 

that is precisely why the agency 

calculated cost savings in that manner 

in the PEA and continues to do so in 

this FEA. (See 83 FR at 36501–02; see 

also 81 FR at 29676 (discussing the time 

needed to submit the Forms 300 and 

301 data electronically). The cost of 

keeping records, including Forms 301, 

301 and 300A were accounted for in 

previous OSHA final rules and ICRs. 

The 2016 rule imposed additional costs 

for electronic submission, and those 

were reported in that FEA. (See 81 FR 

at 29676). This current final rule 

removes only those newly imposed 

costs. 

Therefore, having considered all the 

comments in the record on this issue, 

OSHA continues to rely the time 

estimates from the PEA. OSHA believes 

that the original estimate of 12 minutes 

per recordable case is a reasonable 

average. 

In the proposal, OSHA estimated the 

number of injuries and illnesses that 

would have been reported by covered 

establishments with 250 or more 

employees under the 2016 final rule 

(and, thus, the number that would no 

longer be required to be reported under 

the proposal). To do so, OSHA assumed 

that the total number of recordable cases 

in establishments with 250 or more 

employees was proportional to the 

establishments’ share of employment 

within each industry.12 OSHA then 

used the most recent SOII data to 

estimate that, without the final rule, 

covered establishments with 250 or 

more employees would report 775,210 

injury and illness cases per year. The 

PEA thus estimated that cost per case at 

$11.22 (12/60 × $56.10), and the total 

cost at $8,699,173 ($11.22 per case × 

775,210 cases).13 (83 FR at 36502). 

OSHA did not receive any comments 

on these estimates. OSHA continues to 

find the above methodology and 

estimates to be reasonable and has used 

them in the final rule, with updates 

based on the new wage rate and 


khammond on DSKBBV9HB2PROD with RULES2
400 Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 

14This cost estimate was developed prior to the 

NPRM, and is subject to change based on 

subsequent developments to OSHA’s ITA. 

15 In addition, note that the totals in Table 1 of 

this section of the preamble and the totals 

summarized in the text may not precisely sum from 

underlying elements due to rounding. The precise 

calculation of the numbers in the FEA appears in 

the spreadsheet in the rulemaking docket titled 

‘‘FEA calculations.’’ 

16Overall, the estimated cost savings to private 

industry of removing the requirement for electronic 

reporting of case data is 25 percent greater than the 

2016 estimated cost of promulgating the provision 

($6,948,487). There are three reasons for this 25 

percent increase: The number of establishments 

with more than 250 employees has grown, the mean 

hourly wage has increased, and OSHA is now 

including a 17 percent overhead estimate in the cost 

estimates. 

establishment totals.14 The final cost per 

case to report the information from 

Forms 300 and 301 is estimated at 

$11.39 (12/60 × $56.96), and the total 

cost is $8,829,642 ($11.39 per case × 

775,210 cases).15 Therefore, removing 

the requirement to submit the 

information from OSHA Forms 300 and 

301 to OSHA electronically would 

result in a total cost savings to the 

private sector of $8,829,642.16

As noted in the PEA, the 2016 FEA 

included government costs for the rule 

because creating a reporting and data 

collection system was a significant 

fraction of the total costs of the 

regulation. OSHA estimated that not 

collecting the case-specific data from 

OSHA Forms 300 and 301 would 

generate a small additional cost savings 

for the government because that portion 

of the reporting and data collection 

system has not yet been created and 

would not have to be created under this 

final rule. OSHA estimated a lump sum 

savings from not creating the software to 

collect the data from Forms 300 and 301 

to be $450,000. OSHA did not receive 

any comments about the cost to the 

government of creating software to 

collect the data from Forms 300 and 301 

and finds that the original estimates are 

reasonable in light of overall costs 

expected, so in the FEA OSHA will 

retain the estimate of $450,000. 

Annualized at 3 percent over 10 years, 

this would represent a savings to the 

government of $52,754 per year; 

annualized at 7 percent over 10 years, 

the cost savings would be slightly 

higher: $64,070. This estimate 

underestimates costs to the government 

of having a system for collection of this 

data. It includes the costs of software 

development, but it does not include 

other administrative costs, or the 

analysis that would be needed in order 

to use the data received by the system 

for enforcement purposes. 

A significant source of costs that was 

identified during the preparation of this 

economic analysis is the anticipated 

costs of attempting to remove PII and 

information that enables reidentification of individuals from data 

that would have been collected under 

the 2016 final rule. This cost was not 

considered in the rulemaking preceding 

the 2016 final rule because OSHA 

anticipated using software for this 

purpose. As explained above, a court 

could require OSHA to release the data 

as a result of a FOIA request. This risk 

is not insignificant—in a recent 

decision, subsequent to publication of 

the NPRM for this rule, in a lawsuit 

seeking to order OSHA to enforce the 

requirement for covered employers to 

submit their Form 300 and 301 data 

from 2017 to OSHA electronically, the 

court concluded that OSHA would 

likely be required to release a significant 

portion of the data to the plaintiffs 

under FOIA despite OSHA’s concerns 

about employee privacy. See Public 

Citizen Health Research Group v. 

Acosta, No. 18–1729, slip op. at 9 

(D.D.C. Dec. 12, 2018). The court 

reasoned that, if some records present a 

meaningful possibility of reidentification, OSHA could redact any 

sensitive information ‘‘on a case by case 

basis.’’ Id. If the Form 300 and 301 data 

were to be released, OSHA would need 

to manually review the data to be 

released—from approximately 775,000 

cases annually—to remove PII and other 

information that could allow reidentification of ill or injured workers. 

This review would be necessary 

because, as noted above, software 

cannot guarantee full scrubbing of PII 

and has no ability to judge reidentifiable information. OSHA has 

therefore added annual costs for caseby-case review. 

As noted above, OSHA estimates, 

based on the time it has taken OSHA 

staff to review and remove personal 

information from other OSHA data, that 

case-by-case review would require two 

levels of review. OSHA anticipates that 

the first level review would be done by 

a GS–12, Step 5 Analyst (on the 

Washington, DC locality GS pay scale) 

and that analyst’s work would be 

reviewed by a GS–14, Step 5 Supervisor 

(also on the Washington, DC locality 

pay scale). 

The government hourly labor costs for 

the work of these employees were 

calculated in the following manner. 

Federal GS–12, Step 5 Analysts would 

conduct most of the review work. The 

fully-loaded hourly wage of a GS–12, 

Step 5 Analyst is calculated by taking 

the annual salary, dividing by the 

requisite 2087 hours worked per year, 

adding a fringe benefit factor of 1.6, and 

finally adding a 17 percent overhead 

charge. Using that formula, the fullyloaded hourly wage rate of a GS–12, 

Step 5 Analyst is $78.38 (annual salary 

of $92,421/2087 hours = base wage of 

$44.28 × 1.6 + $44.28 × .17 = $78.38). 

A GS–14, Step 5 Supervisor would 

review the review work. Using the same 

formula, the fully-loaded hourly wage 

rate of the supervisor is $110.14 (annual 

salary of $129,869/2087 hours = base 

wage of $62.23 × 1.6 + $62.23 × .17 = 

$110.14). 

The cost calculation for manually 

reviewing Form 300 and 301 data, and 

removing any PII and other information 

that could allow re-identification of ill 

or injured workers, is as follows. OSHA 

is estimating that the first level review 

by the GS–12, Step 5 Analyst would 

take, on average, six minutes per record 

to review the record and redact any PII 

and other information that could allow 

re-identification of ill or injured 

workers. The agency is also estimating 

that all records would need to be 

reviewed. The first level review would 

have an estimated total annual cost of 

$6,076,323 (775,210 records × 6 minutes 

per record × 1 hour per 60 minutes × 

$78.38 per hour). The second level 

review completed by the GS–14, Step 5 

Supervisor is estimated to take, on 

average, one minute per record and, 

again, all records would need to 

undergo this second level review. The 

supervisor review of the first-level 

review has an estimated total annual 

cost of $1,423,064 (775,210 records × 1 

minute per record × 1 hour per 60 

minutes × $110.14). The total labor cost 

to review and remove PII by 

examination of each record is estimated 

to be $7,499,387 ($6,076,323 + 

$1,423,064) annually. 

OSHA notes that these numbers are 

broadly consistent with the annual costs 

of MSHA’s data collection and 

publication program (from the MSHA 

ICR Supporting Statement, https://

www.reginfo.gov/public/do/ 

DownloadDocument?objectID

=76285301). 

C. New Costs (From the EIN Collection) 

In the PEA, OSHA also estimated the 

potential new costs of amending the 

recordkeeping regulation to require 

covered employers to submit their EINs 

electronically along with their injury 

and illness data submission. The agency 

anticipated that some employees given 

this task would already know their 

employer’s EIN from their other duties, 

but others would need to spend some 

time finding out this information. OSHA 

estimated an average of 5 minutes for an 

employee to find out his or her 

employer’s EIN and to enter it on the 

submission form. Therefore, OSHA 


khammond on DSKBBV9HB2PROD with RULES2
Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 401 

17See https://www2.census.gov/programssurveys/ 

susb/datasets/2015/us_state_emplchange_2014- 

2015.txt. 

18For the CBP, see https://www.census.gov/ 

programs-surveys/cbp.html. 

19 In addition, note that the totals in Table 1 of 

this section of the preamble, as well as totals 

summarized in the text, may not precisely sum from 

underlying elements due to rounding. The precise 

calculation of the numbers in the FEA appears in 

the rulemaking docket in the spreadsheet titled 

‘‘FEA calculations.’’ 

estimated that the unit cost for a 

submission would be the loaded wage of 

the employee who submitted the 

information multiplied by his or her 

time plus overhead, or $4.68 [(5/60) × 

$56.10]. (83 FR at 36502). 

OSHA did not receive any comments 

on this estimate, and the agency has 

determined that the preliminary 

estimate was reasonable. Therefore, 

OSHA has retained the 5 minute 

estimate in this FEA. The updated unit 

cost for a submission would be the wage 

of the employee who submitted the 

information multiplied by his or her 

time plus overhead, or $4.75 [(5/60) × 

$56.96]. 

In the PEA, OSHA explained that the 

currently-implemented electronic 

reporting system is already designed to 

retain information about each 

establishment based on the login 

information, including the EIN. 

Therefore, employers would only have 

to provide OSHA their EIN once, so this 

would not be a recurring cost. However, 

it would be an additional one-time cost 

for employers who are newly reporting 

data because, for example, the 

establishment is new or the employer 

newly reached the reporting threshold 

for employment size. OSHA estimated 

that each year there will be about 10.15 

percent more establishments that will be 

required to report their EIN. OSHA 

derived the 10.15 percent figure from 

the U.S. Census Bureau’s Statistics of 

U.S. Businesses (SUSB), specifically the 

employment change data set,17 which 

shows the increase in U.S. business 

establishments from 2014 to 2015. In 

2015, there were 689,819 new 

establishments, out of a total of 

6,795,201 establishments. Dividing the 

first figure by the second gives a change 

of about 10.15 percent. (83 FR at 36502). 

There were no comments criticizing 

OSHA’s use of the SUSB data or the 

methodology to estimate the number of 

new reporting establishments each year, 

and OSHA continues to find the above 

methodology and estimates to be 

reasonable. Therefore, OSHA is 

retaining these estimates for the FEA. 

In the PEA, OSHA estimated costs for 

covered establishments to provide their 

EINs, using establishment and 

employment data from the U.S. Census 

County Business Patterns (CBP).18 The 

three categories of included 

establishments included in the CBP data 

are: (1) All establishments with 250 or 

more employees in industries that are 

required to routinely keep OSHA injury 

and illness records, (2) establishments 

with 20–249 employees in certain highhazard industries, as defined in the 

Appendix to the May 2016 final rule, 

and (3) farms and ranches with 20 or 

more employees. CBP data do not 

include numbers of farms and ranches 

with 20 or more employees, so in the 

May 2016 final rule, OSHA used data 

from the 2012 Census of Agriculture. 

Updated data from the 2017 Census of 

Agriculture were not available for the 

PEA, so the PEA used the 2012 count of 

20,623 farms with 20 or more 

employees. CBP data also showed that 

there were 36,903 establishments with 

250 or more employees in industries 

required to routinely keep records and 

405,666 establishments with 20–249 

employees in the designated highhazard industries. Combining these 

figures with 20,623 farms and ranches 

results in a total of 463,192 

establishments that would be required 

to submit an EIN under the proposed 

rule. With a cost per establishment of 

$4.68, the total first year cost of 

providing EINs would be $2,165,751 

(463,192 × $4.68). The annualized cost 

over ten years at a 3 percent discount 

rate was $253,892, and at a 7 percent 

discount rate the cost was $308,354. (83 

FR at 36502). 

OSHA did not receive any comments 

on these estimates, and the agency has 

determined that the preliminary 

estimates were reasonable. Therefore, 

OSHA is retaining them (with the 

available updates) in the FEA. Because 

updated establishment data were not 

available, OSHA has retained the PEA 

estimate of 463,192 establishments that 

would be required to submit and EIN 

under the final rule. With a cost per 

establishment of $4.75, the updated 

total first year cost of providing EINs 

would be $2,200,162 (463,192 × 

$4.75).19 When this cost is annualized 

over ten years, the annualized cost at a 

3 percent discount rate is $257,926 and 

at a 7 percent discount rate the cost is 

$313,254. 

As noted above, OSHA estimates that 

463,192 establishments (including 

establishments with more than 250 

employees, those with 20–249 

employees in certain NAICS codes, and 

farms with more than 20 employees) 

will be subject to reporting their EIN in 

the first year under this rule. In the PEA, 

the agency explained that with 10.15 

percent new establishments each year, 

there would be an additional 47,012 

establishments each year that would 

newly need to report their EIN, resulting 

in an additional cost of $4.68 × 47,012 

or $219,858. (83 FR at 36502). OSHA 

did not receive any comments on the 

estimated additional costs for new 

establishments each year, and the 

agency has determined that this is a 

reasonable estimate. Therefore, the 

agency has retained these estimates in 

the final rule. The final cost for those 

establishments, using the updated unit 

cost for a submission ($4.75), will be 

$4.75 × 47,012 or $223,307. As 

explained in the PEA, the cost for new 

establishments each year does not occur 

in the first year. (83 FR at 36502). 

Therefore, OSHA annualized 9 years of 

new establishment costs over ten years, 

which results in annualized costs of 

$216,608 at a discount rate of 3 percent 

and $207,676 at a 7 percent discount 

rate. 

OSHA noted in the PEA that the EIN 

data field is already included in the 

reporting system design, so the agency 

did not anticipate any additional 

government costs associated with 

submittal of the EIN. (83 FR at 36502). 

Commenters did not object to this 

determination, and the agency has no 

reason to believe that any such costs 

will be incurred by the government. 

Therefore, OSHA is not accounting for 

any additional government costs 

associated with EIN submittal in the 

final rule. 

D. Net Cost Savings 

OSHA presented its estimates of the 

cost savings associated with eliminating 

the Forms 300 and 301 electronic data 

submission requirements, the new costs 

associated with collecting the EIN, and 

the net total costs in Table 1 of the 

proposed rule. (83 FR at 36502–03). 

Commenters on the proposal did not 

submit any thoughts on these estimates. 

Therefore, OSHA has retained the 

estimates, with updates, as described 

above. The cost savings of the final rule, 

the new costs associated with collecting 

the EIN, and the net total cost savings 

are shown in Table 1. Combining the 

cost savings to the private sector and to 

the government, the estimated total 

annual cost savings from the final rule 

would be $16,383,000 at a 3 percent 

discount rate and $16,395,000 at 7 

percent discount rate. The additional 

costs to the private sector from 

collection of the EIN are estimated to be 

$474,000 at a 3 percent discount rate 

and $521,000 at 7 percent discount rate. 

The net cost savings for this rule to the 

private sector are estimated to be 

$8,410,000 at a 3 percent discount rate 


khammond on DSKBBV9HB2PROD with RULES2
402 Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 

20Source: OSHA, Office of Regulatory Analysis. 

21OSHA is reporting these estimates rounded to 

the nearest thousand in order not to suggest a 

spurious degree of accuracy. 

22The Agency discussed and responded to all 

public comments on this determination in Section 

III, Summary and Explanation of the Final Rule. 

(See, e.g., Concerns About the Potential Release of 

Sensitive Worker Information and Uncertain Extent 

of Benefits from Collecting the Data from Forms 300 

and 301). 

23This number was derived by dividing the total 

estimated cost savings to private industry of 

$8,699,173 from the proposal by 36,903 affected 

establishments with 250 or more employees. (83 FR 

at 36503). 

and $8,375,000 at 7 percent discount 

rate. 

TABLE 1—TOTAL COST SAVINGS AND TOTAL ADDITIONAL COSTS OF THE FINAL RULE 20

Cost savings element PEA annual cost 

savings 

FEA annual cost 

savings 21

Cost savings for eliminating electronic submission of part 1904 records by establishments with 250 

or more employees (Total Private Sector Savings).

$8,699,173 ............. $8,831,000 

Total Government Software Cost Savings, 3 percent discount rate over ten years .............................. 52,754 .................... 53,000 

Total Government Software Cost Savings, 7 percent discount rate over ten years .............................. 64,070 .................... 64,000 

Total Annual Government PII Review Cost Savings .............................................................................. (*) ........................... 7,499,000 

Total Cost Savings per year, 3 percent discount rate over ten years .................................................... 8,751,927 ............... 16,383,000 

Total Cost Savings per year, 7 percent discount rate over ten years .................................................... 8,763,243 ............... 16,395,000 

New costs from EIN collection Cost 

First Year EIN Cost ................................................................................................................................. 2,165,751 ............... 2,199,000 

Annualized First Year Costs, 3 percent discount rate over ten years .................................................... 253,892 .................. 258,000 

Annualized First Year Costs, 7 percent discount rate over ten years .................................................... 308,354 .................. 313,000 

Subsequent Annual EIN Costs (from new establishments), starting in second year ............................. 219,858 .................. 223,000 

Subsequent annual EIN Cost Annualized at a 3 percent discount rate over ten years ........................ 213,262 .................. 217,000 

Subsequent annual EIN Cost Annualized at a 7 percent discount rate over ten years ........................ 204,468 .................. 208,000 

Annualized Total EIN Cost, 3 percent discount rate over ten years ...................................................... 467,194 .................. 474,000 

Annualized Total EIN Cost, 7 percent discount rate over ten years ...................................................... 512,822 .................. 521,000 

Net Cost Savings, 3 percent discount rate over ten years ..................................................................... 8,284,733 ............... 15,909,000 

Net Cost Savings, 7 percent discount rate over ten years ..................................................................... 8,250,421 ............... 15,862,000 

* Not calculated. 

As OSHA explained in the proposal 

(83 FR at 36503), there could be 

substantial cost savings from requiring 

covered employers to include the EIN in 

their reporting. There is roughly a 40 

percent overlap between the BLS SOII 

sample and private sector 

establishments required to report to 

OSHA. If OSHA collected Form 300A 

from all covered private sector units and 

BLS were able to fully match these units 

and use them in generating SOII 

estimates, the reduction in duplication 

would represent approximately 15,000 

hours of respondent burden. In its SOII 

paperwork burden analysis, BLS 

estimates the total cost of submitting 

this form for private sector 

establishments to be $891,000. The 

potential cost savings for avoiding 

duplication is 40 percent of this value— 

$356,000. 

E. Benefits 

In the PEA, OSHA preliminarily 

determined that the substantial benefits 

to worker privacy outweighed the 

uncertain forgone benefits to 

enforcement. The agency requested 

comment on its preliminary 

determination, including on its 

preliminary conclusions that neither 

worker privacy nor enforcement benefits 

can be meaningfully quantified. (83 FR 

at 36503). 

As discussed in detail in Section III, 

Summary and Explanation of the Final 

Rule, OSHA received a number of 

comments regarding its preliminary 

benefits determination.22 After carefully 

reviewing these comments, OSHA has 

determined that the extent of any 

benefits of collecting the data from 

Forms 300 and 301 for OSHA 

enforcement and compliance assistance 

activities is currently uncertain. OSHA 

has determined that, at this time, 

avoiding the risk to worker privacy of 

collecting the data from Forms 300 and 

301 outweighs the uncertain 

incremental benefits to enforcement 

from the data. The rule will also allow 

OSHA to focus its resources on the 

collection and use of 300A data and 

severe injury reports, which the 

agency’s past experience has proven 

useful. 

F. Economic Feasibility 

In the PEA, OSHA stated that 

proposed elimination of the requirement 

for establishments with 250 or more 

employees to submit the information 

from OSHA Forms 300 and 301 to 

OSHA annually would reduce costs and 

so would have no negative feasibility 

effects. (83 FR at 36503). Even with the 

proposed EIN requirement, the proposal 

still resulted in a large overall reduction 

in costs. (83 FR at 36503).Thus, OSHA 

concluded that the proposed rule was 

economically feasible. (83 FR at 36503). 

Commenters did not submit any 

comments objecting to this 

determination and, due to the increase 

in the wage rates, the reduction in costs 

has increased since the proposal. 

Therefore, OSHA finds that the final 

rule is economically feasible. 

G. Regulatory Flexibility Certification 

In the PEA, OSHA explained that the 

current requirement for annual 

electronic submission of information 

from OSHA Forms 300 and 301 affects 

only a very small minority of small 

firms. In many industry sectors, there 

are no small firms with at least 250 

employees. Even in those industry 

sectors where the definition of small 

firm includes some firms with at least 

250 employees, the overwhelming 

majority of small firms have fewer than 

250 employees. There will, however, be 

some small firms affected in some 

industries. OSHA estimated that 

removing this requirement as proposed 

would result in a cost savings of, on 

average, $236 per establishment for each 

establishment with 250 or more 

employees affected by the 2016 final 

rule.23 OSHA preliminarily determined 

that such a small amount of cost savings 


khammond on DSKBBV9HB2PROD with RULES2
Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 403 

24This number is derived by dividing the total 

final cost savings to private industry of $8,831,000 

by 36,903 affected establishments with 250 or more 

employees. 

would not have a significant impact on 

a firm with 250 or more employees. (83 

FR at 36503). Commenters did not 

object to these determinations. OSHA 

reaffirms its preliminary finding and 

also finds that the updated cost savings 

of $239 per establishment for each 

establishment with 250 or more 

employees affected by the 2016 final 

rule will not have a significant impact 

on a firm with 250 or more employees.24

The PEA also included a certification 

that the proposed rule would not have 

a significant economic impact on a 

substantial number of small entities. (83 

FR at 36503). OSHA did not receive any 

comments on this certification. As with 

the proposal, the final rule will result in 

an overall reduction of costs. Removing 

the requirement for establishments with 

250 or more employees to submit the 

information from OSHA Forms 300 and 

301 annually to OSHA would reduce 

costs, and the estimated cost of the EIN 

requirement is $4.75 per establishment, 

a negligible amount. Hence, per sec. 605 

of the Regulatory Flexibility Act, OSHA 

certifies that this final rule will not have 

a significant economic impact on a 

substantial number of small entities. 

H. Executive Order 13771: Reducing 

Regulation and Controlling Regulatory 

Costs 

Consistent with Executive Order 

13771 (82 FR 9339, January 30, 2017), 

OSHA’s preliminary economic analysis 

estimated the net annual cost savings of 

this rule to be $8.28 million per year at 

a 3 discount rate, and $8.25 million per 

year, at a discount rate of 7 percent. (83 

FR at 36501). Therefore, OSHA 

concluded that the proposed rule was 

expected to be a deregulatory action 

under the Executive Order. (83 FR at 

36496). OSHA received several 

comments on this preliminary 

conclusion. 

One commenter argued that OSHA 

did not demonstrate how it complied 

the Executive Order or with the Office 

of Management and Budget’s (OMB) 

guidance to agency heads on how to 

comply with the Executive Order. (See 

Document ID 2033–A1, pp. 6–7 (citing 

OMB Memorandum M–17–21–OMB, 

Guidance Implementing Executive 

Order 13771, ‘‘Reducing Regulation and 

Controlling Regulatory Costs’’ (Apr. 5, 

2017) (OMB Guidance on E.O. 13771))). 

But that comment misunderstands the 

Agency’s burden under the Executive 

Order and the related guidance. The 

guidance defines the term ‘‘deregulatory 

action’’ to mean ‘‘an action that has 

been finalized and has total costs less 

than zero.’’ (OMB Guidance on E.O. 

13771, p. 4). In the proposal, OSHA 

estimated that this rule would have net 

cost savings of $8.28 million per year at 

a 3 percent discount rate, including 

$8.23 million per year for the private 

sector and $52,754 per year for the 

government. (See 83 FR at 36500–501, 

36502–03). Annualized at a 7 percent 

discount rate, OSHA estimated that the 

proposed rule would have net cost 

savings of $8.25 million per year, 

including $8.18 million per year for the 

private sector and $64,070 per year for 

the government. (See 83 FR at 36501, 

36502–03). The Agency included 

detailed information about how it 

calculated those numbers. Because 

OSHA expected the rule to have cost 

savings (i.e., total costs less than zero), 

it stated that it expected the proposed 

rule to be deregulatory action under the 

Executive Order. (83 FR at 36596). 

Nothing more was required under the 

Executive Order. 

Another commenter remarked that 

adding a requirement for additional data 

seemed contrary to OSHA’s claim that 

the proposed rule is a deregulatory 

action under the Executive Order. 

(Document ID 2039–A1, p. 3 (quoting 83 

FR at 36496)). This comment also 

misinterprets the Executive Order’s 

requirements. As noted above, OMB’s 

guidance defines the term ‘‘deregulatory 

action’’ to mean ‘‘an action that has 

been finalized and has total costs less 

than zero.’’ (OMB Guidance on E.O. 

13771, p. 4). This definition does not 

consider whether part of the rule 

imposes costs, but other portions of the 

rule provide cost savings. Rather, it 

looks at the total costs imposed by the 

rule. As explained in the proposal, 

OSHA expected the total costs of the 

proposal to be well below zero. 

Therefore, the Agency finds that its 

preliminary expectation was correct. 

After carefully considering the 

comments submitted on this issue, 

OSHA reaffirms its preliminary 

determination that this rule is expected 

to be a deregulatory action within the 

meaning of Executive Order 13771. This 

finding is based on the Agency’s 

estimate that the total annual cost 

savings from the final rule would be 

$8,884,000 at a 3 percent discount rate 

and $8,896,000 at 7 percent discount 

rate. Further details on the estimated 

costs and cost savings estimates for this 

rule can be found in Section VI, Final 

Economic Analysis and Regulatory 

Flexibility Analysis. 

V. Unfunded Mandates 

For purposes of the Unfunded 

Mandates Reform Act (2 U.S.C. 1501 et 

seq.), as well as Executive Order 13132 

(64 FR 43255 (Aug. 4, 1999)), this final 

rule does not include any federal 

mandate that may result in increased 

expenditures by state, local, and tribal 

governments, or increased expenditures 

by the private sector of more than $100 

million. Accordingly, OSHA is not 

required to issue a written statement 

containing a qualitative and quantitative 

assessment of the anticipated costs and 

benefits of the Federal mandate, as 

required under Section 202(a) of the 

Unfunded Mandates Reform Act of 1995 

(2 U.S.C. 1532(a)). 

VI. Federalism 

The agency reviewed this rule in 

accordance with the Executive Order on 

Federalism 13132. (64 FR 43255). The 

final rule involves a ‘‘regulation’’ issued 

under sections 8 and 24 of the OSH Act 

(29 U.S.C. 657, 673), and not an 

‘‘occupational safety and health 

standard’’ issued under section 6 of the 

OSH Act (29 U.S.C. 655). Therefore, 

pursuant to section 18 of the OSH Act 

(29 U.S.C. 667(a)), the rule does not 

preempt state law. The effect of the final 

rule on states is discussed in section VII, 

State-Plan States. 

VII. State-Plan States 

Pursuant to section 18 of the OSH Act 

(29 U.S.C. 667) and the requirements of 

29 CFR 1904.37 and 1902.7, within 6 

months after publication of the final 

OSHA rule, state-plan states must 

promulgate occupational injury and 

illness recording and reporting 

requirements that are substantially 

identical to those in 29 CFR part 1904 

‘‘Recording and Reporting Occupational 

Injuries and Illnesses.’’ All other injury 

and illness recording and reporting 

requirements (for example, industry 

exemptions, reporting of fatalities and 

hospitalizations, record retention, or 

employee involvement) that are 

promulgated by state-plan states may be 

more stringent than, or supplemental to, 

the federal requirements, but, because of 

the unique nature of the national 

recordkeeping program, states must 

consult with OSHA and obtain approval 

of such additional or more stringent 

reporting and recording requirements to 

ensure that they will not interfere with 

uniform reporting objectives (29 CFR 

1904.37(b)(2); 29 CFR 1902.7(a)). 

There are 28 state plan states and 

territories. The states and territories that 

cover private sector employers are 

Alaska, Arizona, California, Hawaii, 

Indiana, Iowa, Kentucky, Maryland, 


khammond on DSKBBV9HB2PROD with RULES2
404 Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 

Michigan, Minnesota, Nevada, New 

Mexico, North Carolina, Oregon, Puerto 

Rico, South Carolina, Tennessee, Utah, 

Vermont, Virginia, Washington, and 

Wyoming. Connecticut, Illinois, Maine, 

New Jersey, New York, and the Virgin 

Islands have OSHA-approved state 

plans that apply to state and local 

government employees only. 

VIII. Environmental Impact Assessment 

OSHA has reviewed the provisions of 

this final rule in accordance with the 

requirements of the National 

Environmental Policy Act (NEPA) of 

1969 (42 U.S.C. 4321 et seq.), the 

Council on Environmental Quality 

(CEQ) NEPA regulations (40 CFR parts 

1500–1508), and the Department of 

Labor’s NEPA Procedures (29 CFR part 

11). As a result of this review, OSHA 

has determined that the final rule will 

have no significant adverse effect on air, 

water, or soil quality, plant or animal 

life, use of land, or other aspects of the 

environment. 

IX. Paperwork Reduction Act 

Overview 

This final rule revises an existing 

collection of information that is subject 

to review by OMB under the Paperwork 

Reduction Act of 1995 (PRA) (44 U.S.C. 

3501 et. seq.) and its implementing 

regulations (5 CFR part 1320). The PRA 

generally requires that agencies consider 

the impact of paperwork and other 

information collection burdens imposed 

on the public, obtain public input, and 

obtain approval from OMB before 

conducting any collection of 

information (44 U.S.C. 3507). The PRA 

defines a ‘‘collection of information’’ as 

‘‘the obtaining, causing to be obtained, 

soliciting, or requiring the disclosure to 

third parties or the public, of facts or 

opinions by or for an agency, regardless 

of form or format[.]’’ (44 U.S.C. 

3502(3)(A)). Federal agencies generally 

cannot conduct or sponsor a collection 

of information, and the public is 

generally not required to respond to an 

information collection, unless it is 

approved by OMB under the PRA and 

displays a currently-valid OMB Control 

Number. In addition, notwithstanding 

any other provisions of law, no person 

shall be subject to penalty for failing to 

comply with a collection of information 

if the collection of information does not 

display a valid OMB Control Number. 

(See 44 U.S.C. 3512). 

Solicitation of Comments 

OSHA published a Federal Register 

notice that allowed the public an 

opportunity to comment on the 

proposed Information Collection 

Request (ICR) containing the 

information collection requirements in 

the proposed rule for 60 days, as 

required by 44 U.S.C. 3507. Specifically, 

in the NPRM, OSHA explained how the 

proposed rule would affect its ICR 

estimates and asked members of the 

public to submit comments on the 

paperwork requirements. (83 FR at 

36504–05). Concurrent with the 

proposed rule, OSHA submitted the ICR 

to OMB for review (ICR Reference 

Number 201807–1218–002) in 

accordance with 44 U.S.C. 3507(d). 

In addition to generally soliciting 

comments on the paperwork 

requirements, the proposed rule 

indicated that OSHA and OMB were 

particularly interested in comments 

that: 

• Evaluate whether the proposed 

collection of information is necessary 

for the proper performance of the 

functions of the agency, including 

whether the information will have 

practical utility; 

• Evaluate the accuracy of the 

agency’s estimate of the burden of the 

proposed collection of information, 

including the validity of the 

methodology and assumptions used; 

• Enhance the quality, utility, and 

clarity of the information to be 

collected; and 

• Minimize the burden of the 

collection of information on those who 

are to respond, including through the 

use of appropriate automated, 

electronic, mechanical, or other 

technological collection techniques or 

other forms of information technology, 

e.g., permitting electronic submission of 

responses. 

(83 FR at 36505). 

OMB concluded its review by filing a 

comment requesting OSHA to resubmit 

the request at the Final Rule stage, after 

considering any public comments and 

clarifying how the information 

collection requirements in final rule 

were changed because of the comments. 

OSHA received a number of comments 

in response to the proposed rule that 

addressed information collection 

requirements and contained information 

relevant to the burden hour and costs 

analysis in the ICR. Summaries of these 

comments and OSHA’s responses are 

found above in Sections III, Summary 

and Explanation of the Final Rule, and 

IV, Final Economic Analysis and 

Regulatory Flexibility Certification, and 

in the final ICR. OSHA considered these 

comments when it developed the 

revised ICR associated with the final 

rule. 

Concurrent with publication of this 

final rule, the Department of Labor has 

submitted the final ICR, containing the 

full analysis and description of the 

burden hours and costs associated with 

the final rule, to OMB for approval. A 

copy of this ICR will be available on the 

internet at http://www.reginfo.gov/ 

public/do/PRAViewICR?ref_

nbr=201811-1218-004 on the day 

following publication of the final rule. 

At the conclusion of OMB’s review, 

OSHA will publish a separate notice in 

the Federal Register to announce the 

results. That notice will also include a 

list of OMB-approved information 

collection requirements and total 

burden hours and costs imposed by the 

new standard. 

Summary of Information Collection 

Requirements 

OSHA’s existing recordkeeping forms 

consist of the OSHA 300 Log, the 300A 

Summary, and the 301 Incident Report. 

These forms are contained in the ICR 

titled Recording and Reporting 

Occupational Injuries and Illnesses (29 

CFR part 1904), which OMB approved 

under OMB Control Number 1218–0176 

(expiration date 06/30/2021). 

This final rule affects the ICR 

estimates as follows: 

1. Establishments that are subject to 

the part 1904 requirements and have 

250 or more employees will no longer 

be required to electronically submit 

information recorded on their OSHA 

Forms 300 and 301 to OSHA once a 

year. 

2. Establishments subject to the data 

collection must provide one additional 

data element, the EIN. 

The burden hours for the reporting 

requirements under § 1904.41 are 

estimated to be 140,545 per year, which 

is a reduction of 112,694 burden hours 

from what was estimated for the 

previous reporting requirements. There 

are no capital costs for this collection of 

information. 

More specifically, this action amends 

the recordkeeping regulation to remove 

the requirement for establishments that 

are required to keep injury and illness 

records under part 1904, and that had 

250 or more employees in the previous 

year, to electronically submit to OSHA 

or OSHA’s designee case characteristic 

information from the OSHA Form 300 

(Log of Work-Related Injuries and 

Illnesses) and OSHA Form 301 (Injury 

and Illness Incident Report) once a year. 

Under the final rule, these 

establishments are only required to 

submit summary information from the 

OSHA Form 300A. There are 

approximately 37,000 establishments 

that are no longer subject to a 

requirement to submit the information 

on OSHA Forms 300 and 301 for 


khammond on DSKBBV9HB2PROD with RULES2
Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 405 

approximately 775,000 injury and 

illness cases under the rule. (OSHA 

used BLS’s 2015 Survey of Occupational 

Injuries and Illnesses (SOII) data 

(https://www.bls.gov/iif/oshwc/osh/os/ 

ostb4734.pdf) to estimate that, without 

the final rule, covered establishments 

with 250 or more employees would 

report 775,210 injury and illness cases 

per year.) 

In addition, under the final rule, 

463,192 establishments are now 

required to provide their EINs to OSHA. 

The OSHA recordkeeping and 

reporting information collection may be 

summarized as follows. (Note these 

estimates are for the full burden of the 

recordkeeping and reporting 

information collection, including 

aspects that are unchanged by this 

rulemaking). 

Agency: DOL-OSHA. 

Title of Collection: Recording and 

Reporting Occupational Injuries and 

Illnesses (29 CFR part 1904). 

OMB control number: 1218–0176. 

Number of respondents: 1,002,912. 

Number of annual responses: 

5,903,976. 

Total estimated annual burden time: 

2,140,856 hours. 

Total estimated annual other costs 

burden (start-up, capital, operation, and 

maintenance): $0. 

X. Consultation and Coordination With 

Indian Tribal Governments 

OSHA reviewed this final rule in 

accordance with Executive Order 13175 

(65 FR 67249 (Nov. 9, 2000)) and 

determined that it does not have ‘‘tribal 

implications’’ as defined in that order. 

This final rule does not have substantial 

direct effects on one or more Indian 

tribes, on the relationship between the 

Federal Government and Indian tribes, 

or on the distribution of power and 

responsibilities between the Federal 

Government and Indian tribes. 

List of Subjects in 29 CFR Part 1904 

Health statistics, Occupational safety 

and health, Reporting and 

recordkeeping requirements, State 

plans. 

Signed at Washington, DC, on January 17, 

2019. 

Loren E. Sweatt, 

Deputy Assistant Secretary of Labor for 

Occupational Safety and Health. 

Final Rule 

Amendments to Regulations 

For the reasons stated in the 

preamble, OSHA amends part 1904 of 

chapter XVII of title 29 as follows: 

PART 1904—[AMENDED] 

Subpart E—Reporting Fatality, Injury 

and Illness Information to the 

Government 

■ 1. The authority citation for subpart E 

of 29 CFR part 1904 continues to read 

as follows: 

Authority: 29 U.S.C. 657, 673, 5 U.S.C. 

553, and Secretary of Labor’s Order No. 1– 

2012 (77 FR 3912, Jan. 25, 2012). 

■ 2. In § 1904.41, revise the section 

heading and paragraph (a)(1), add 

paragraph (a)(4), and revise paragraph 

(b) to read as follows: 

§ 1904.41 Electronic submission of 

Employer Identification Number (EIN) and 

injury and illness records to OSHA. 

(a) * * * 

(1) Annual electronic submission of 

OSHA Form 300A Summary of WorkRelated Injuries and Illnesses by 

establishments with 250 or more 

employees. If your establishment had 

250 or more employees at any time 

during the previous calendar year, and 

this part requires your establishment to 

keep records, then you must 

electronically submit information from 

OSHA Form 300A Summary of WorkRelated Injuries and Illnesses to OSHA 

or OSHA’s designee. You must submit 

the information once a year, no later 

than the date listed in paragraph (c) of 

this section of the year after the calendar 

year covered by the form (for example, 

2019 for the 2018 form). 

* * * * * 

(4) Electronic submission of the 

Employer Identification Number (EIN). 

For each establishment that is subject to 

these reporting requirements, you must 

provide the EIN used by the 

establishment. 

(b) Implementation—(1) Does every 

employer have to routinely submit this 

information to OSHA? No, only two 

categories of employers must routinely 

submit this information. First, if your 

establishment had 250 or more 

employees at any time during the 

previous calendar year, and this part 

requires your establishment to keep 

records, then you must submit the 

required information to OSHA once a 

year. Second, if your establishment had 

20 or more employees but fewer than 

250 employees at any time during the 

previous calendar year, and your 

establishment is classified in an 

industry listed in appendix A to this 

subpart, then you must submit the 

required information to OSHA once a 

year. Employers in these two categories 

must submit the required information 

by the date listed in paragraph (c) of this 

section of the year after the calendar 

year covered by the form (for example, 

2019 for the 2018 form). If you are not 

in either of these two categories, then 

you must submit the information to 

OSHA only if OSHA notifies you to do 

so for an individual data collection. 

(2) Do part-time, seasonal, or 

temporary workers count as employees 

in the criteria for number of employees 

in paragraph (a) of this section? Yes, 

each individual employed in the 

establishment at any time during the 

calendar year counts as one employee, 

including full-time, part-time, seasonal, 

and temporary workers. 

(3) How will OSHA notify me that I 

must submit information as part of an 

individual data collection under 

paragraph (a)(3) of this section? OSHA 

will notify you by mail if you will have 

to submit information as part of an 

individual data collection under 

paragraph (a)(3). OSHA will also 

announce individual data collections 

through publication in the Federal 

Register and the OSHA newsletter, and 

announcements on the OSHA website. If 

you are an employer who must 

routinely submit the information, then 

OSHA will not notify you about your 

routine submittal. 

(4) When do I have to submit the 

information? If you are required to 

submit information under paragraph 

(a)(1) or (2) of this section, then you 

must submit the information once a 

year, by the date listed in paragraph (c) 

of this section of the year after the 

calendar year covered by the form (for 

example, 2019 for the 2018 form). If you 

are submitting information because 

OSHA notified you to submit 

information as part of an individual data 

collection under paragraph (a)(3) of this 

section, then you must submit the 

information as specified in the 

notification. 

(5) How do I submit the information? 

You must submit the information 

electronically. OSHA will provide a 

secure website for the electronic 

submission of information. For 

individual data collections under 

paragraph (a)(3) of this section, OSHA 

will include the website’s location in 

the notification for the data collection. 

(6) Do I have to submit information if 

my establishment is partially exempt 

from keeping OSHA injury and illness 

records? If you are partially exempt 

from keeping injury and illness records 

under §§ 1904.1 and/or 1904.2, then you 

do not have to routinely submit 

information under paragraphs (a)(1) and 

(2) of this section. You will have to 

submit information under paragraph 

(a)(3) of this section if OSHA informs 

you in writing that it will collect injury 

and illness information from you. If you 


khammond on DSKBBV9HB2PROD with RULES2
406 Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules and Regulations 

receive such a notification, then you 

must keep the injury and illness records 

required by this part and submit 

information as directed. 

(7) Do I have to submit information if 

I am located in a State Plan State? Yes, 

the requirements apply to employers 

located in State Plan States. 

(8) May an enterprise or corporate 

office electronically submit information 

for its establishment(s)? Yes, if your 

enterprise or corporate office had 

ownership of or control over one or 

more establishments required to submit 

information under paragraph (a) of this 

section, then the enterprise or corporate 

office may collect and electronically 

submit the information for the 

establishment(s). 

* * * * * 

[FR Doc. 2019–00101 Filed 1–24–19; 8:45 am] 

BILLING CODE 4510–26–P 


khammond on DSKBBV9HB2PROD with RULES2