Protecting Personally Identifiable Information (PII)

The Occupational Safety and Health Administration (OSHA) published a final rule

requiring that establishments meeting certain size and industry criteria electronically 

submit case-specific injury and illness data from their OSHA Form 300 Log of WorkRelated Injuries and Illnesses and the OSHA Form 301 Injury and Illness Incident 

Report. These data will be used to analyze occupational injuries and illnesses and 

hazardous conditions in workplaces and will be made available for public access. 

Covered establishments must electronically submit their data through OSHA’s secure 

Injury Tracking Application (ITA) beginning in January 2024. OSHA minimizes the 

collection of personally identifiable information (PII) during this process and takes 

steps to protect the data submitted. In submitting this data, establishments should 

not include certain PII pertaining to worker(s). This fact sheet discusses what PII is, 

how establishments can avoid submitting PII through the ITA, and what OSHA is 

doing to protect worker privacy. 

Who is required to submit information 

from the Form 300 Log and Form 

301 Incident Report under the new 

regulation?

Establishments with 100 or more employees 

in designated industries are required to submit 

case-specific information from their OSHA 

Form 300 Log and Form 301 Incident Report. 

Establishments located in states that are covered 

by Federal OSHA can determine if they are 

required to submit through OSHA’s ITA Coverage 

Application. Establishments covered by a State 

Plan should directly contact their State Plan.

What is PII?

PII, or personally identifiable information, 

includes any information that could reasonably 

be expected to identify individuals directly (e.g., 

name, address, social security number or other 

identifying number or code, telephone number, 

email address, etc.) or indirectly in conjunction 

with other data elements (e.g., age, gender, race/

ethnicity, occupation, etc.).

Must establishments submit employee 

PII from the Form 300 Log and Form 301 

Incident Report to OSHA through the ITA?

Covered establishments must submit an injured 

or ill employee’s date of birth through the ITA but 

the ITA automatically converts this information 

to “age”. Covered establishments are required 

to submit through the ITA other information 

about an injured or ill employee, such as job 

title, date hired, and gender, that, in some 

limited circumstances, could be used to identify 

individual employees in conjunction with other 

data. Do not submit non-mandatory information 

if it could reasonably be used to identify 

individuals directly.

What PII should not be submitted to 

OSHA through the ITA?

When electronically submitting data through 

the ITA, establishments should not include the 

following information:

• Names

• Social Security numbers

• Telephone numbers

• Home addresses

• Email addresses

• Healthcare provider information

• Family member information

What can establishments do to help keep 

employees’ data private? 

Establishments should review Form 300 Log 

and Form 301 Incident Reports and remove 

unnecessary PII from the narrative fields 

before submitting them to the ITA. In addition, 

for privacy concern cases as defined by 

29 CFR 1904.29(b)(7), establishments should 

enter “privacy concern case” on the Form 300 

FactSheet
Log instead of the employee’s name, and keep 

a separate, confidential list of case numbers 

and employee names for privacy concern cases 

so that the establishment can update the cases 

and provide the information to the government 

if asked to do so. See 29 CFR 1904.29(b)(9) for 

additional recordkeeping requirements for 

privacy concern cases.

How will OSHA protect the identity of 

the injured or ill workers whose data is 

submitted to OSHA through the ITA?

OSHA will protect worker privacy by taking 

the following steps with data submitted through 

the ITA:

• OSHA will not collect worker names or 

addresses;

• OSHA will remind employers not to submit 

information that could directly identify 

workers, such as names, Social Security 

numbers, addresses, telephone numbers, etc.;

• OSHA will automatically convert all birth 

dates to age upon submission through the ITA 

and discard birth date data;

• OSHA will not make publicly available ITA 

data it receives concerning employee age, 

gender, date hired, and whether the worker 

was treated in an emergency room and/or 

hospitalized overnight as an inpatient;

• OSHA will use automated information 

technology and some manual review to 

detect and remove remaining information that 

could reasonably be expected to identify an 

individual directly.

For additional information see: 

• OSHA’s Information Tracking Application

• OSHA’s ITA Fact Sheet

• OSHA ITA Privacy Impact Assessment

Workers’ Rights 

Workers have the right to: 

• Working conditions that do not pose a risk of 

serious harm. 

• Receive information and training (in a 

language and vocabulary the worker 

understands) about workplace hazards, 

methods to prevent them, and the OSHA 

standards that apply to their workplace. 

• Review records of work-related injuries and 

illnesses. 

• File a complaint asking OSHA to inspect their 

workplace if they believe there is a serious 

hazard or that their employer is not following 

OSHA’s rules. OSHA will keep all identities 

confidential. 

• Exercise their rights under the law without 

retaliation, including reporting an injury or 

raising health and safety concerns with their 

employer or OSHA. If a worker has been 

retaliated against for using their rights, they 

must file a complaint with OSHA as soon as 

possible, but no later than 30 days. 

For additional information see OSHA’s Workers 

page (www.osha.gov/workers). 

How to Contact OSHA 

Under the Occupational Safety and Health 

Act of 1970, employers are responsible for 

providing safe and healthful workplaces for 

their employees. OSHA’s role is to ensure these 

conditions for America’s workers by setting and 

enforcing standards, and providing training, 

education and assistance. For more information, 

visit www.osha.gov or call OSHA at 1-800-321- 

OSHA (6742), TTY 1-877-889-5627.

DTSEM FS-4388 12/2023

This is one in a series of informational fact sheets highlighting OSHA programs, policies or standards. 

It does not impose any new compliance requirements. For a comprehensive list of compliance 

requirements of OSHA standards or regulations, refer to Title 29 of the Code of Federal Regulations. 

This information will be made available to sensory-impaired individuals upon request. The voice 

phone is (202) 693-1999; teletypewriter (TTY) number: (877) 889-5627.