OSHA Electronic Submission via the ITA: Deadlines and Requirements for Healthcare

Every January, the same question lands in occupational-health inboxes across the country: "Do we have to upload our injury log to OSHA this year, and if so, which forms?" This guide walks through OSHA electronic submission via the ITA (the Injury Tracking Application) for healthcare employers — who has to file, which forms, and the deadline. For most hospitals, nursing homes, and larger clinics the answer is yes: healthcare carries high injury and illness rates, so many of its establishments fall under the electronic reporting rule at 29 CFR 1904.41. The exact obligation, though, depends on how many people work at each site and which industry code that site falls under. Get it wrong and you either over-share protected data or miss a filing OSHA can cite you for.

Here's how the process actually works, which establishments it covers, and the deadline that does not move.

The short version: what, where, and when

OSHA collects injury and illness data through the Injury Tracking Application (ITA), its online portal for uploading the data you already record on your OSHA logs. You don't mail anything and you don't fax a PDF — covered establishments enter the numbers directly, upload a file, or push data through an API. OSHA's injury reporting hub is the front door for the portal itself; the requirement behind it lives in 29 CFR 1904.41.

The deadline is March 2 each year, and it covers the previous calendar year's records. So the data you keep through 2025 is due into the ITA by March 2, 2026. That date does not slide when a weekend falls on it, and OSHA does not send a reminder. Put it on the compliance calendar the same way you track TB re-screening or respirator fit-test due dates.

One access note that trips people up every year: the ITA requires a Login.gov account tied to your work email. If the nurse or safety officer who filed last year has left, nobody inherits the login automatically. Confirm access in January, not on March 1.

Which forms you submit depends on your size and industry

This is where healthcare facilities get tangled, because 29 CFR 1904.41 sets three tiers and the same organization can land in different tiers at different sites:

• 20–249 employees at an establishment in an industry listed in Appendix A to Subpart E of Part 1904: submit Form 300A (the annual summary) only.
• 250 or more employees at an establishment that is required to keep OSHA records and is not otherwise in a higher tier: submit Form 300A only.
• 100 or more employees at an establishment in an industry listed in Appendix B to Subpart E of Part 1904: submit all three — the 300 Log, the 300A Summary, and the 301 Incident Reports.

The tiers are not a simple ladder by headcount, and this is the detail large hospitals miss most often: the Appendix B rule governs whenever it applies. If your establishment is in an Appendix B industry and has 100 or more employees, you submit all three forms — the "300A only" line for 250+ establishments does not let you file the summary alone. In practice, a 400-bed hospital in an Appendix B industry submits the 300, 300A, and 301, not just the 300A.

Hospitals and nursing and residential care facilities appear in these appendices — general medical and surgical hospitals, psychiatric hospitals, skilled nursing facilities, and continuing-care and assisted-living communities are among the industries listed. A mid-to-large hospital with 100+ employees at one site is therefore likely in the all-three tier, submitting case-by-case 300 and 301 detail. A smaller clinic or a single long-term-care building with, say, 60 staff would typically submit the 300A alone.

The non-negotiable step: look up your specific NAICS code against Appendix A and Appendix B to Subpart E of Part 1904 rather than assuming. The difference between "300A only" and "all three forms" is entirely which appendix your code sits in. Verify each site before you decide what to file.

Count employees by establishment, not by company

The size thresholds are per establishment — a single physical location — not per corporate entity. A health system running four hospitals and a dozen clinics does not add everyone into one number. Each site is evaluated on its own headcount and its own industry code, and each covered site files separately in the ITA.

"Number of employees" means the peak employment at that establishment during the calendar year, and it includes everyone who worked there: full-time, part-time, seasonal, temporary, and workers supplied by a staffing agency if you supervised their day-to-day work. A surgical center that ramps up for flu season or staffs travelers through a census spike counts those people. Use the highest single point during the year, not an average.

State Plan states: confirm your own requirements

If your facility operates in an OSHA-approved State Plan state, don't stop at the federal rule. State Plans run their own occupational-safety programs, and OSHA directs establishments under State Plan jurisdiction to confirm reporting requirements and timing directly with their State Plan. Most State Plans have adopted electronic reporting requirements identical to the federal rule, but some adopted them on a different timeline, and a few have their own wrinkles. California's Cal/OSHA, for example, has its own electronic reporting requirement. If you have sites in multiple states, check each State Plan rather than assuming the federal deadline and form set apply uniformly.

Do small facilities have to submit?

Often, no — and this is the part that saves small clinics real work.

Establishments with fewer than 20 employees never have to submit electronically, regardless of how hazardous the industry is. If your standalone clinic or single-site therapy practice tops out at 18 people, you're outside the ITA requirement even though you're in healthcare.

Separately, employers with 10 or fewer employees at all times during the prior calendar year are exempt from routinely keeping OSHA 300/300A/301 records under 29 CFR 1904.1 — unless OSHA or the Bureau of Labor Statistics specifically writes and asks you to keep them. That exemption is about recordkeeping, not about emergencies: every employer, regardless of size, must still report severe events directly to OSHA (see below). But a 10-or-fewer employer is not on the March 2 electronic-submission cycle.

One more edge case worth flagging: a covered establishment that had zero recordable injuries last year still has to submit. A clean year does not excuse you — you upload a 300A showing zeroes. Skipping it because "there was nothing to report" is a common and citable miss.

Severe injuries are a separate, faster clock

Electronic submission through the ITA is the annual, log-based obligation. It is entirely separate from OSHA's severe-injury reporting rule, which is event-driven and has much tighter timelines that apply to every employer:

• Fatality: report to OSHA within 8 hours.
• In-patient hospitalization, amputation, or loss of an eye: report within 24 hours.

You report these by phone or through OSHA's reporting page. Meeting your March 2 ITA deadline does nothing to satisfy this obligation, and vice versa — they are two different requirements.

What OSHA actually collects (and what it doesn't)

Occupational-health staff worry, correctly, about pushing protected health information into a government portal. For establishments that submit the full 300 and 301 data, 29 CFR 1904.41 provides that they do not submit fields identifying the injured worker — the rule excludes the employee's name and address and the name of the physician or other health care professional, along with the name and address of the facility where treatment was provided. You still enter the establishment's identifying information and the case details themselves. Build your upload file to carry the case data without those personal identifiers.

A practical filing checklist

• January: confirm ITA/Login.gov access. Reconcile each establishment's headcount (peak, all worker types) and verify its NAICS code against Appendix A and Appendix B to Subpart E of Part 1904.
• Decide the tier per site: 300A only, or all three forms. Don't apply one answer system-wide, and remember that Appendix B (100+) overrides the 300A-only line.
• Check State Plan status: for any site in a State Plan state, confirm requirements and timing with that plan.
• February: finalize and have a qualified person certify each 300A. Prepare uploads — manual entry for one small site, or CSV batch upload / API for a multi-site system.
• Before March 2: submit, then save the confirmation for each establishment. Retain your underlying 300, 300A, and 301 records for five years as required by 29 CFR 1904.33.

Across more than a couple of buildings, spreadsheets and shared drives start to strain — headcounts drift, someone certifies the wrong year, a site gets skipped. Occupational-health systems, including carefoundryESC, keep the recordable log, the 300A, and the establishment roster in one place so the March 2 export is a report you run. The compliance logic above holds no matter what you use to track it.

FAQ

Which forms are submitted through the ITA? Depending on size and industry: the 300A annual summary alone, or the 300 Log, 300A Summary, and 301 Incident Reports together. Confirm your tier against Appendix A and Appendix B to Subpart E of Part 1904 (29 CFR 1904.41).

What's the deadline? March 2 each year, covering the prior calendar year's data. It does not extend for weekends, and OSHA won't remind you.

We had no injuries last year — do we still file? Yes. Covered establishments submit a 300A even when it shows zero recordables. A clean year is not an exemption.

Does a small clinic have to submit? Establishments with fewer than 20 employees are not required to submit electronically, and employers with 10 or fewer are generally exempt from routine recordkeeping under 29 CFR 1904.1 — though severe-injury reporting (8 hours for a fatality, 24 hours for a hospitalization, amputation, or loss of an eye) still applies to everyone.

We're in a State Plan state — does the federal deadline apply? Confirm with your State Plan. Most mirror the federal rule, but adoption timing and some specifics vary, so verify each state where you operate.

---

Not sure which tier your sites fall into? Pull each establishment's peak headcount and NAICS code now, check them against Appendix A and Appendix B to Subpart E of Part 1904, and confirm State Plan status for any out-of-federal-jurisdiction sites. You'll walk into February knowing exactly what you owe.