"OSHA 300 Log: Recordkeeping Requirements and Best Practices"

Let me tell you something that should terrify every California business owner reading this right now.

OSHA doesn't need to catch you doing something dangerous. They don't need to witness an accident. They don't need a whistleblower. All they need is to look at your paperwork. And if your OSHA 300 Log is wrong -- incomplete, late, or just sloppy -- they will fine you. Enthusiastically.

The average OSHA recordkeeping citation runs $16,131 per violation as of 2024 (29 CFR 1903.15, adjusted annually under the Federal Civil Penalties Inflation Adjustment Act). Willful violations? Up to $161,323. Per instance. And here's the kicker: recordkeeping violations stack. Ten missing entries means ten violations. Do the math.

This isn't some obscure regulatory corner case. Recordkeeping violations are among the most frequently cited standards in OSHA's playbook. They're easy to find, easy to prove, and brutally expensive.

So let's fix that. Right now. No fluff, no filler, just exactly what you need to know to keep your logs clean, your postings on time, and OSHA out of your wallet.

The Three Forms You Must Know

OSHA recordkeeping under 29 CFR Part 1904 revolves around three documents. Think of them as the holy trinity of workplace injury documentation. Miss one, and the whole system falls apart.

Form 300: Log of Work-Related Injuries and Illnesses

This is your running ledger. Every recordable workplace injury or illness gets an entry here. The 300 Log tracks:

• Employee name (or a case number for privacy concern cases under 29 CFR 1904.29(b)(7))
• Job title
• Date of injury or illness onset
• Where the event occurred
• Description of the injury or illness, body parts affected, and the object or substance involved
• Classification: death, days away from work, job transfer or restriction, or other recordable case
• The number of days away from work or days of job transfer/restriction

You maintain this log on a calendar-year basis. It must be kept at the establishment where the injuries occurred, available for inspection at all times (29 CFR 1904.35). Not in your accountant's drawer. Not at your corporate headquarters three states away. At the establishment.

Form 300A: Summary of Work-Related Injuries and Illnesses

The 300A is a one-page annual summary derived from your 300 Log. It aggregates your total case counts, total days away, total transfers/restrictions, and your average annual employment and total hours worked.

Here's what most employers botch: the 300A must be **certified by a company executive** -- defined as an owner, officer, or the highest-ranking company official working at that establishment (29 CFR 1904.32(b)(3)). Your HR coordinator cannot sign this form. Your safety manager cannot sign this form. An executive signs it.

And it must be posted. In a conspicuous place. Where employees can see it. More on that timeline shortly.

Form 301: Injury and Illness Incident Report

The 301 is the detailed incident report. One per recordable case. It captures:

• Full employee information (name, address, date of birth, hire date)
• Physician or healthcare professional who treated the employee
• Emergency room visit (yes/no), hospitalization (yes/no)
• Detailed narrative: what the employee was doing, what happened, what the injury or illness was, what object or substance directly harmed the employee
• Date and time of the event
• Whether the employee died

You can substitute an equivalent form -- workers' compensation first reports of injury often qualify -- as long as it captures all the data elements required by the 301 (29 CFR 1904.29(b)(4)). Most California employers use the state DWC-1 form combined with the employer's own incident report to satisfy this requirement.

What Must Be Recorded

This is where employers get into the most trouble. They either record everything (wasting time and inflating their incident rates) or record nothing (inviting citations). The standard is specific. Learn it.

Under 29 CFR 1904.7, a work-related injury or illness must be recorded if it results in any of the following:

1. **Death**
2. **Days away from work** (even one day beyond the day of injury)
3. **Restricted work activity or job transfer**
4. **Medical treatment beyond first aid**
5. **Loss of consciousness**
6. **A significant injury or illness diagnosed by a physician or other licensed healthcare professional** (even if it doesn't result in any of the above)

That's it. If the case doesn't hit one of these triggers, it's not recordable. Log it in your first-aid log if you want, but it doesn't go on the 300.

The First Aid vs. Medical Treatment Distinction

This single distinction causes more recording errors than anything else in the entire regulation. Get this wrong, and everything downstream is wrong.

**First aid** is exhaustively defined at 29 CFR 1904.7(a). It includes -- and is limited to:

• Using non-prescription medications at nonprescription strength
• Tetanus immunizations
• Cleaning, flushing, or soaking wounds on the surface of the skin
• Using wound closure devices such as butterfly bandages or Steri-Strips
• Using splints and rigid supports (used as temporary measures)
• Using hot or cold compresses, therapy, or non-rigid back belts
• Using temporary immobilization devices while transporting an accident victim
• Drilling a fingernail or toenail to relieve pressure, or draining fluid from a blister
• Using eye patches
• Removing foreign bodies from the eye using irrigation or a cotton swab
• Removing splinters or foreign material from areas other than the eye by irrigation, tweezers, cotton swabs, or other simple means
• Using finger guards
• Using massages
• Drinking fluids for relief of heat stress
• Using oxygen as a preventive measure or one-time administration for diagnostic purposes

**If the treatment is NOT on this list, it is medical treatment, and the case is recordable.** Period. No judgment calls. No "well, it seemed minor." If a doctor prescribes a prescription-strength medication, it's recordable. If they use stitches instead of butterfly bandages, it's recordable. If they order physical therapy (not just a massage), it's recordable.

The regulation is binary by design. OSHA doesn't want you making subjective determinations about severity. They want you checking a list.

Timeline Requirements: The Dates That Matter

OSHA recordkeeping runs on a strict calendar. Miss a deadline and you're in violation. There's no grace period, no "but I was busy" exception.

7 Calendar Days to Record

Under 29 CFR 1904.29(b)(3), you must enter each recordable injury or illness on your 300 Log and complete a 301 Incident Report within **seven calendar days** of receiving information that a recordable case has occurred.

Note the trigger: seven days from when you *learn about it*, not seven days from when it happened. If an employee reports a work-related injury three weeks after the fact, your seven-day clock starts on the day they tell you.

February 1 through April 30: The Posting Window

The certified 300A Summary must be posted from **February 1 through April 30** of the year following the year covered by the form (29 CFR 1904.32(b)(5)-(6)). That's a hard start date and a hard end date. Don't post it on February 15. Don't take it down on March 31.

The 300A must be displayed in a conspicuous place where notices to employees are customarily posted. If you have a bulletin board with your labor law posters, that's where the 300A goes.

Even if you had zero recordable injuries, you still post the 300A. You certify it with zeros, sign it, and post it. No exceptions.

5-Year Retention

You must retain the 300 Log, the privacy case list (if applicable), the 300A Summary, and all 301 Incident Reports for **five years** following the end of the calendar year they cover (29 CFR 1904.33). During that five-year retention period, you must also update stored 300 Logs to reflect newly discovered cases or changes in previously recorded cases.

Electronic Submission: Who Files and When

OSHA's electronic recordkeeping rule (29 CFR 1904.41, as amended in 2024) requires certain employers to submit their injury and illness data electronically through OSHA's Injury Tracking Application (ITA) at https://www.osha.gov/injuryreporting.

The submission deadline is **March 2** of the year following the year covered.

Tier 1: Establishments with 250+ Employees

If your establishment had **250 or more employees** at any point during the previous calendar year, you must electronically submit:

• Form 300 (complete log)
• Form 300A (annual summary)
• Form 301 (all incident reports)

This is the full data dump. OSHA gets everything.

Tier 2: Establishments with 20-249 Employees in Designated Industries

If your establishment had **20 to 249 employees** and your NAICS code appears on OSHA's designated high-hazard industry list (Appendix B to Subpart E), you must electronically submit:

• Form 300A (annual summary only)

The designated industry list covers about 100 NAICS codes spanning construction, manufacturing, agriculture, warehousing, healthcare, and other historically high-hazard sectors. If you're not sure whether your NAICS code is on the list, check it. Ignorance is not a defense.

Tier 3: Everyone Else

If you don't meet either threshold, you don't have to submit electronically. But you still maintain the logs. You still post the 300A. You still produce the records within four business hours if OSHA asks (29 CFR 1904.40).

Cal/OSHA Additions: Where California Goes Further

If you operate in California, federal OSHA is your floor, not your ceiling. Cal/OSHA (Title 8, California Code of Regulations) adds requirements that catch out-of-state employers and complacent in-state ones alike.

The 8-Hour Serious Injury Report

Under California Labor Code Section 6409.1(b) and 8 CCR 342(a), employers must report any **serious injury, illness, or death** to Cal/OSHA within **eight hours** by telephone or online. Not by email. Not by fax. Telephone or online submission through the Cal/OSHA reporting portal.

Federal OSHA requires reporting within 8 hours for fatalities and 24 hours for inpatient hospitalizations, amputations, and eye losses (29 CFR 1904.39). California's definition of "serious" is **broader**. Under Labor Code 6302(h), a serious injury or illness includes:

• Any injury or illness occurring in a place of employment that requires inpatient hospitalization for a period in excess of 24 hours for other than medical observation
• Any amputation
• The loss of an eye
• Any serious degree of permanent disfigurement
• **Any injury or illness requiring hospitalization, regardless of the length of stay** (this is broader than federal OSHA's "inpatient hospitalization for purposes other than observation")

The practical effect: in California, if an employee goes to the hospital and is admitted -- even for a few hours -- you report it. Don't gamble on whether it counts as "observation."

Cal/OSHA Log 300 Supplemental Requirements

Cal/OSHA requires employers to maintain a separate **Log 300** for each establishment and to make it available to employees, former employees, and their representatives upon request within the timeframes specified in 8 CCR 14300.35. California also enforces anti-retaliation protections under Labor Code 6310, making it illegal to discriminate against any employee for reporting an injury or requesting access to injury and illness records.

Injury and Illness Prevention Program (IIPP) Integration

California mandates that every employer maintain an Injury and Illness Prevention Program under 8 CCR 3203. Your OSHA 300 Log data feeds directly into your IIPP. The log identifies hazard patterns, repeat injuries, and trending incident types. If your IIPP doesn't reference your 300 Log data, it's incomplete -- and a Cal/OSHA inspector will notice.

Nine Common Recordkeeping Errors That Trigger Citations

I've seen these mistakes cost employers thousands. Every single one of them is avoidable.

1. Not Recording Cases Because "It Didn't Seem Serious"

The recordability criteria don't include a severity assessment. If an employee receives prescription medication for a work-related injury, it's recordable -- even if they're back at work the same day with no restrictions. The trigger is the treatment, not your opinion about the injury.

2. Confusing First Aid with Medical Treatment

An employee gets stitches. The employer logs it as first aid because "it was just a few stitches." Sutures are not on the first aid list. Recordable. Every time. Review the exhaustive first aid list at 29 CFR 1904.7(a) and apply it literally.

3. Late Entries on the 300 Log

Seven calendar days. Not seven business days. Not "when we get around to it." If you learn about a recordable case on a Friday, the entry is due by the following Thursday. Set up a system -- an intake form, an alert, a workflow -- that triggers the clock automatically.

4. Missing or Unsigned 300A Summary

The 300A must be certified by a company executive and posted by February 1. Unsigned forms are violations. Forms signed by non-executives are violations. Forms posted on February 10 are violations. This is pure calendar discipline.

5. Failing to Update the Log for Retroactive Changes

Employee goes out on workers' comp in March. In June, they have surgery and their days away increase. Under 29 CFR 1904.33(a), you must update the 300 Log entry to reflect the additional days. Many employers set it and forget it. OSHA doesn't forget.

6. Miscounting Days Away From Work

The day of the injury does NOT count. Counting starts the day after the injury. Weekends and holidays count if the employee would not have been able to work on those days. If an employee is on restricted duty, those are days of restriction, not days away -- and they're counted separately. Cap at 180 days per case (29 CFR 1904.7(b)(3)(viii)).

7. Keeping Logs at Corporate Instead of the Establishment

The 300 Log must be maintained at the establishment where the injuries occur. A "central recordkeeping" arrangement is permitted under 29 CFR 1904.30(b)(3), but only if you can produce the forms at the establishment within four business hours of a request. If your corporate office is in San Francisco and the establishment is in Riverside, can you physically deliver the log in four hours? If not, keep it on-site.

8. Not Recording Hearing Loss

Standard threshold shifts (STS) in hearing are recordable if work-related and the employee's total hearing level is 25 dB or more above audiometric zero, averaged over 2000, 3000, and 4000 Hz in the affected ear (29 CFR 1904.10). Many employers either don't conduct audiometric testing or fail to compare results against baselines. If you have employees in noise-exposed environments (85 dB TWA or above), you need a hearing conservation program and you need to record STS cases.

9. Failing to Maintain Privacy Case Lists

Certain injuries -- those involving the intimate body parts, the reproductive system, sexual assault, HIV infection, tuberculosis, and mental illness -- must be recorded on the 300 Log with the case number only, not the employee's name (29 CFR 1904.29(b)(7)). The employee's name goes on a separate confidential list maintained alongside the 300 Log. Many employers either record the name on the 300 (privacy violation) or omit the case entirely (recording violation). Neither is acceptable.

Best Practices for Bulletproof Recordkeeping

Stop treating OSHA recordkeeping as a clerical task you dump on whoever's closest to the filing cabinet. It's a compliance obligation with real financial consequences. Here's how to get it right.

Build a Recording Decision Tree

Create a simple flowchart your supervisors can follow. Did the employee receive treatment? Is the treatment on the first aid list? If no, record it. Was there a day away from work? Record it. Loss of consciousness? Record it. Death? Obviously record it. Take the judgment out of the equation.

Centralize Intake, Decentralize Access

Use a single intake process -- a form, a portal, an app -- that captures every workplace injury report. Route it to the person responsible for the 300 Log within 24 hours. But keep the completed logs accessible at each establishment. Centralized collection, decentralized storage.

Set Calendar Alerts for Every Deadline

• **January 15:** Begin preparing 300A Summary for the prior year
• **February 1:** Post certified 300A Summary
• **March 2:** Submit electronic data (if required)
• **April 30:** Earliest date to remove posted 300A
• **Ongoing:** 7-day recording window for each new case
• **Ongoing:** Update logs for changes in case status

Train Every Supervisor on First Aid vs. Medical Treatment

Don't assume your frontline managers know the difference. Print the first aid list from 29 CFR 1904.7(a). Laminate it. Post it in every break room. Review it quarterly. The supervisor who incorrectly classifies a case as first aid is the supervisor who creates a recordkeeping violation.

Audit Your Logs Quarterly

Don't wait until January to review a year's worth of entries. Every quarter, compare your 300 Log entries against your workers' compensation claims, your HR incident reports, and your first-aid logs. Discrepancies between these data sources are exactly what OSHA looks for during inspections.

Integrate With Your IIPP

Your Injury and Illness Prevention Program should pull data directly from your 300 Log. Trending injuries by department, body part, or cause should drive your hazard assessments and corrective actions. If you're maintaining the log but not using the data, you're doing twice the work for half the value.

What Protekon Delivers

Here's the reality for most California SMBs: you know you're supposed to maintain these logs. You probably have a 300 Log somewhere. It's probably wrong.

You're not incompetent. You're busy. You're running a business. You don't have a full-time safety officer reading Federal Register updates and cross-referencing Cal/OSHA Title 8 amendments.

That's the problem Protekon solves.

**Protekon provides managed compliance-as-a-service** that handles OSHA recordkeeping as part of a complete workplace safety and compliance program. Specifically:

• **Log maintenance and review.** We maintain your OSHA 300 Log, 300A Summary, and 301 Incident Reports with correct classifications, timely entries, and proper privacy protections. Every entry is reviewed against the recordability criteria -- not guessed at by a supervisor with a laminated card.
• **Deadline management.** February 1 posting, March 2 electronic submission, 7-day recording windows, 8-hour Cal/OSHA serious injury reports. Every deadline is tracked, triggered, and confirmed. You don't miss dates because you were focused on running your business.
• **Cal/OSHA alignment.** Federal compliance is the floor. We ensure your recordkeeping meets California's broader definitions, supplemental requirements, and IIPP integration mandates. One standard, one system, no gaps.
• **Quarterly audits.** We reconcile your 300 Log against your workers' comp claims, HR reports, and first-aid records every quarter. Discrepancies get resolved before they become citations.
• **Inspection readiness.** If Cal/OSHA shows up -- and in the Inland Empire, they do -- your records are current, complete, correctly classified, and available within four hours at every establishment. No scrambling. No excuses.
• **Training support.** Your supervisors get clear, practical guidance on the first aid vs. medical treatment distinction, reporting timelines, and privacy case handling. Not a binder they'll never read. Actual training that reduces recording errors at the source.

OSHA recordkeeping is not optional. It's not difficult. But it is precise, and precision requires attention that most small and mid-sized employers cannot consistently provide while also doing the hundred other things their business demands.

Protekon provides that attention. Consistently. Correctly. So you can get back to the work that actually grows your business.

---

*Protekon is a managed compliance-as-a-service platform for California SMBs. OSHA recordkeeping, SB 553 compliance, IIPP management, and inspection readiness -- handled. Visit [protekon.com](https://protekon.com) or call to schedule a compliance assessment.*