What is an establishment?

When it comes to figuring out who needs to submit OSHA injury and illness records, the first thing to understand is that these requirements apply to each establishment, not necessarily to the company as a whole. That raises the question, what exactly is considered an “establishment”?

Who must submit?

Armed with a better understanding of what an establishment is, you can determine if you need to submit electronically and what must be submitted? The answer depends on establishment size, industry classification, and recordkeeping obligations under Part 1904 including the following categories:

Large establishments in any industry:

• Companies with 250 or more employees at any time during the previous calendar year, and
• Required to keep OSHA injury and illness records.
• Submit OSHA Form 300A

Medium-sized establishments in specific industries

• Companies with 20–249 employees at any time during the previous calendar year, and
• Industry is listed in Appendix A to Subpart E (designated industries).
• Submit OSHA Form 300A

Examples can include construction, manufacturing, and transportation.

Certain high-hazard industries

• Companies with 100 or more employees at any time during the previous calendar year, and
• Industry is listed in Appendix B to Subpart E (high hazard industries).
• Submit OSHA Forms 300A, 300, and 301

Examples can include hospitals, food manufacturing plants, and waste treatment facilities.

What if my organization doesn’t fit in with the listed categories?

Keep in mind that unless your establishment falls into OSHA’s required categories, you usually don’t have to submit injury and illness data electronically through the Injury Tracking Application (ITA), unless OSHA specifically notifies you that electronic submission is required.

That said, being exempt from electronic submission does not eliminate your other OSHA recordkeeping responsibilities under 29 CFR Part 1904. If you are required to keep injury and illness records, you must still:

• Maintain OSHA Forms 300, 300A, and 301 for five years following the end of the calendar year they cover, and
• Post the OSHA 300A Annual Summary in a visible location each year from February 1 through April 30, even if no recordable injuries or illnesses occurred.

When to submit?

If you have determined you must electronically submit your records, then the last piece of the puzzle is knowing the submission deadline. The electronic submission window for the previous calendar year’s data runs January 2 through March 2 annually. For example, 2025 data must be submitted by March 2, 2026. Late submissions can still be made until December 31, but missing the March deadline may trigger compliance issues.

Actionable steps for compliance

• Confirm coverage: Determine whether your establishment is required to submit electronically by using OSHA’s ITA Coverage Tool, based on employee count and industry classification.
• Prepare required records: Ensure OSHA Forms 300 and 301 are complete and accurate for the reporting year, and complete and certify Form 300A by January 31 as required.
• Review for accuracy: Verify employee counts, NAICS codes, and consistency across all forms to minimize submission errors or rejections.
• Protect employee privacy: Ensure personally identifiable information (PII), such as employee names, addresses, and healthcare details, is not included in electronic submissions.
• Submit through OSHA’s ITA: Submit the required data to OSHA’s ITA using manual entry, csv file upload, or API integration, depending on the number of establishments and internal systems.

Key to remember: Electronic submission requirements are based on establishment size and industry classification. Keep in mind, even if you’re not required to submit data electronically, you may still be required to keep injury and illness records, retain them for five years, and post the OSHA 300A every year.

Spotting the scam

According to FMCSA, the emails aren’t coming from any legitimate government source, despite appearing official. Many messages include branding, signatures, or formatting similar to authentic USDOT or FMCSA correspondence. However, the agency stresses that official communication almost always comes from email addresses ending in .gov. The only exception is when FMCSA sends customer satisfaction surveys following interactions with its Contact Center, and those messages never request personal or financial information.

How to verify authenticity

Motor carriers are urged to remain vigilant. Officials recommend both hovering over links to verify the true destination before clicking and double checking that any website link ends in .gov. If there is any uncertainty, carriers should contact FMCSA directly through its official help portal or by calling the agency’s Call Center at 1-800-832-5660.

Those who receive suspicious emails are advised not to click links, open attachments, or reply to the sender. Instead, FMCSA encourages reporting the incident to the FMCSA Contact Center. Additional guidance on identifying phishing attempts is available through the Federal Trade Commission.

As cybercriminals continue to target the transportation sector, FMCSA urges carriers to stay alert and verify all unexpected communications to protect their businesses and industry partners.