OSHA e-submitters: Mind your PIIs and Qs
If you’re required to submit Form 300 and 301 data to OSHA by March 2, how do you keep your employees’ personally identifiable information (PII) private? Thankfully, OSHA just posted two resources to assist! Note that it’s critical to get this right. OSHA says it WILL post most submitted data online.
Background
OSHA published its final Improve Tracking rule last July. This rule added a requirement to 29 CFR 1904.41 for establishments with 100 or more employees in designated industries (listed in Appendix B to Subpart E of Part 1904). These establishments must now submit case-specific information from their:
- OSHA Form 300, Log of Work-Related Injuries and Illnesses; and
- OSHA Form 301, Injury and Illness Incident Report.
This requirement is on top of existing ones to submit information from the OSHA Form 300A, Summary of Work-Related Injuries and Illnesses.
The data must be submitted electronically through OSHA’s Injury Tracking Application (ITA). After undergoing stress testing, the ITA began accepting 2023 injury/illness data on January 2, 2024. However, the due date to complete submissions is March 2, 2024.
Two resources
To help you keep employee data private, OSHA recently posted:
- An OSHA Fact Sheet, “Protecting Personally Identifiable Information (PII),” OSHA FS-4388 12/2023; and
- Injury Tracking Applications FAQs on 300/301 ITA Submission and Technical Issues.
Review these carefully! For your convenience, we summarize the major points in the two resources below.
OSHA uses the term PII
As stated, PII stands for personally identifiable information. It includes any information that could reasonably be expected to identify individuals:
- Directly (e.g., name, address, social security number or other identifying number or code, telephone number, email address, etc.); or
- Indirectly in conjunction with other data elements (e.g., age, gender, race/ethnicity, occupation, etc.).
Must your establishment submit worker PII?
If you’re covered by the new rule, you must submit:
- An injured/ill employee’s date of birth, but the ITA automatically converts this information to the age; and
- Other information about an injured/ill employee, such as job title, date hired, and gender, that, in some limited circumstances, could be used to identify individual employees in conjunction with other data.
What PII should NOT be submitted?
According to OSHA, when submitting data through the ITA, your establishment should NOT include the following information:
- Names,
- Social security numbers,
- Telephone numbers,
- Home addresses,
- Email addresses,
- Healthcare provider information, and
- Family member information.
OSHA FAQs further specify that you are NOT required to submit the:
- Employee name (column B) of the Form 300 Log;
- Employee name (field 1) of the Form 301 Incident Report;
- Employee address (field 2) of the Form 301 Incident Report;
- Name of physician or other healthcare professional (field 6) of the Form 301 Incident Report; and
- Facility name and address if treatment was given away from the worksite (field 7) of the Form 301 Incident Report.
OSHA also says, “Do NOT submit non-mandatory information if it could reasonably be used to identify individuals directly.”
What can you do to help keep worker data private?
OSHA offers two more tips:
- Review the Form 300 Log and Form 301 Incident Reports and remove unnecessary PII from the narrative fields before submitting them to the ITA.
- For privacy concern cases, as defined by paragraph 1904.29(b)(7), enter “privacy concern case” on the Form 300 Log instead of the employee’s name. Then keep a separate, confidential list of case numbers and employee names for privacy concern cases so that your establishment can update the cases and provide the information to the government if asked to do so.
See paragraph 1904.29(b)(9) for more requirements for privacy concern cases.
Is it possible to submit Form 301 data without specifying the gender?
OSHA expects employers to report gender data when they are available. Yet, in 2024 the ITA will not reject submissions if you submit Form 301 data without completing Field 5 (Male/Female). This is to account for non-binary genders and privacy cases.
What will OSHA do to protect worker identities?
The agency explains that it will take steps to protect worker privacy. Specifically, the agency will:
- Not collect worker names or addresses;
- Remind employers not to submit information that could directly identify workers, such as names, social security numbers, addresses, telephone numbers, etc.;
- Automatically convert all birth dates to age upon ITA submission and discard birth date data;
- Not make publicly available ITA data it receives concerning employee age, gender, date hired, and whether the worker was treated in an emergency room and/or hospitalized overnight as an inpatient; and
- Use AI technology and some manual review to detect and remove remaining information that could reasonably be expected to identify an individual directly.
Key to remember
Two OSHA resources offer tips on how to keep PII private for e-submissions under 1904.41.
