OSHA Recordkeeping for Healthcare: The Complete Guide to Forms 300, 300A, and 301

If you run occupational health at a hospital or a nursing facility, here's the sentence I most want you to take away first: OSHA recordkeeping for healthcare is not optional, and you are not exempt. Not partially, not "we're basically a clinic," not any of it. Hospitals and residential care facilities are covered by OSHA's injury-and-illness recordkeeping rule, and they rank among the highest-injury industries OSHA tracks. The assumption that "healthcare equals office equals paperwork we can skip" gets facilities cited every year.

The rule lives at 29 CFR Part 1904, and Part 1904 recordkeeping runs on three forms that most people mix up. Let's untangle them, sort out who actually has to keep them, walk the annual calendar, and cover the electronic-filing tier that now catches most mid-size and large healthcare employers.

Which forms do healthcare facilities need?

Three forms, each with a job. OSHA names them explicitly in 1904.29(a): "The OSHA 300 form is called the Log of Work-Related Injuries and Illnesses, the 300-A is the Summary of Work-Related Injuries and Illnesses, and the OSHA 301 form is called the Injury and Illness Incident Report."

Here's what each one does:

• Form 300 — the Log. One running line per recordable case for the calendar year. Employee's job title, where and when it happened, a short description, and the classification: death, days away from work, restricted duty or job transfer, or other recordable. The OSHA 300 log is your master list.
• Form 301 — the Incident Report. The detail record behind a single case. One 301 per recordable event, capturing what the employee was doing, what happened, the object or substance involved, and the nature of the injury or illness. It's the narrative the Log line points back to.
• Form 300A — the Annual Summary. The year-end roll-up. You tally the 300 Log by category, drop in the totals and your average employee count and hours worked, and that single page becomes the summary you certify and post.

The relationship is the part people miss, so be precise about it: every recordable case produces one 300 Log line and one 301 report. Per 1904.29(b)(2), you complete a 301 (or an equivalent form that captures the same information) for each case entered on the Log. At year-end, the 300 totals feed the one 300A. Log and 301 are the working records all year; 300A is the once-a-year public summary.

A note on "recordable," because it drives everything: not every injury goes on the Log. Under 1904.7(a), what lands on the Log is a work-related case involving death, days away from work, restricted work or job transfer, medical treatment beyond first aid, loss of consciousness, or a significant injury or illness diagnosed by a physician or other licensed health care professional. First aid — cleaning and bandaging a small cut, a dose of non-prescription medication at non-prescription strength — is spelled out in 1904.7(b)(5) and generally isn't recordable.

Two healthcare-specific points on top of that. A needlestick or cut from a sharp object that is contaminated with another person's blood or other potentially infectious material (OPIM) is automatically recordable under 1904.8. Separately — and don't conflate the two — those cases (and other sensitive diagnoses) are handled as privacy cases on the Log under 1904.29(b)(9): you write "privacy case" in place of the employee's name. Get the recordability determination right first; the forms are just where the answer gets written down.

Who is required to keep OSHA injury and illness records?

Two partial exemptions exist, and healthcare threads right through them.

The first is size. Under 29 CFR 1904.1, an employer with 10 or fewer employees at all times during the previous calendar year is partially exempt from routine recordkeeping. That's a company-wide peak headcount for the prior year, not a per-shift or per-site snapshot, so count carefully before you rely on it.

The second is industry. Establishments in certain low-hazard industries listed in Appendix A to Subpart B are partially exempt regardless of size. Here's where healthcare people get tripped up. The only healthcare NAICS codes on that exempt list are the office-based and outpatient ones:

• 6211 — Offices of Physicians
• 6212 — Offices of Dentists
• 6213 — Offices of Other Health Practitioners
• 6214 — Outpatient Care Centers
• 6215 — Medical and Diagnostic Laboratories

Hospitals (NAICS 622) and Nursing and Residential Care Facilities (NAICS 623) are not on the list. They keep full records — no exception. So a 400-bed general hospital, a skilled nursing facility, an assisted-living community, a psychiatric hospital: all fully covered. A three-provider physician office: probably exempt. If your facility mixes settings (a hospital with an owned outpatient clinic), each establishment is classified on its own primary activity, so don't assume one exemption blankets the system. The recordkeeping requirements for hospitals and nursing homes apply regardless of how the rest of the organization is structured.

One more thing that catches even careful teams: partial exemption is only from the routine paperwork. Every employer covered by the OSH Act — exempt or not, tiny or huge — must still report severe events. Per OSHA's Hospitals eTool, you report a work-related fatality within 8 hours and any work-related in-patient hospitalization, amputation, or loss of an eye within 24 hours. That obligation never turns off.

How the 300, 300A, and 301 forms relate to each other

Think of it as one workflow that runs all year and closes out once.

A recordable event happens. Within seven calendar days of receiving information that a recordable injury or illness has occurred, you enter it on the 300 Log and complete the matching 301 — 1904.29(b)(3) sets that clock. Seven calendar days, not business days, and it starts when you learn about the case, not when it happened. A late-reported back strain still triggers the seven-day window from the day it reaches you.

Those two records accumulate case by case through December 31. In January, you stop and review the full Log for the year — correct classifications, catch cases you missed, update any that changed (a "days away" count that grew, a case that became a fatality). Then you total the columns onto the 300A, a company executive certifies it, and you post it. That's the whole cycle: recordable event → 7-day Log + 301 entry → year-end review → certify → post the 300A. The Log and 301s do the daily work; the 300A is the annual output everyone else sees.

What are the annual OSHA recordkeeping deadlines?

Four dates and one retention period. Put them on a shared calendar and stop rediscovering them every January.

Within 7 calendar days of learning of a recordable case — enter it on the 300 Log and complete the 301 (1904.29(b)(3)).

February 1 through April 30 — post the certified 300A Summary where employee notices normally go, and leave it up the entire span (1904.32(b)(6)). Before you post, you must review the Log entries, prepare the summary, and certify it (1904.32(a)). Post it even in a year with zero recordable cases — a 300A showing all zeros still has to go up.

March 2 — electronic submission deadline for establishments that fall into the e-filing tiers (more on that next), for the prior calendar year's data (1904.41).

Five years — retain the 300 Log, the privacy case list if you keep one, the 300A, and the 301 forms for five years following the end of the calendar year they cover (1904.33(a)). During that window you also have to update the stored 300 Log if you learn of new recordable cases or changes to recorded ones.

So a case that occurs in 2026 sits on the 2026 Log, rolls into the 2026 300A that you post February 1–April 30, 2027, e-file (if applicable) by March 2, 2027, and keep on file through the end of 2031.

Electronic submission: the ITA tiers that catch healthcare

This is where the rules changed most recently, and where a lot of hospitals and nursing homes discovered new obligations they didn't have a few years ago.

All electronic submission flows through OSHA's Injury Tracking Application (ITA). Per OSHA's forms page, OSHA does not accept paper submissions — ITA supports manual webform entry, CSV upload, or API transmission, and that's the only channel. Who has to submit, under 1904.41:

• 250+ employees at an establishment that keeps records — submit 300A data.
• 20–249 employees in an industry listed in Appendix A to Subpart E — submit 300A data.
• 100+ employees in a high-hazard industry listed in Appendix B to Subpart E — submit detailed data from Forms 300 and 301 in addition to the 300A. This is the 2024 expansion.

Read that third tier twice, because Appendix B to Subpart E explicitly names healthcare:

• 6221 — General Medical and Surgical Hospitals
• 6222 — Psychiatric and Substance Abuse Hospitals
• 6223 — Specialty Hospitals
• 6231 — Nursing Care (Skilled Nursing) Facilities
• 6232 — Residential Intellectual/Developmental Disability, Mental Health, and Substance Abuse Facilities
• 6233 — Continuing Care Retirement Communities and Assisted Living Facilities
• 6239 — Other Residential Care Facilities

Plain reading: a hospital or nursing facility with 100 or more employees at an establishment now submits case-level 300 and 301 detail to OSHA every year, not just the summary page. That's a meaningful shift — you're handing OSHA the individual case data, which OSHA then partly publishes. Per the 2024 recordkeeping final rule implementing 1904.41, the fields that identify a worker — employee name, address, and the names of health care professionals and treatment facilities — are excluded from what you submit through the ITA, but the case detail goes in.

The counting method for these thresholds is establishment-level peak employment in the prior year, and it has enough edge cases (temporary workers, multi-site companies) that I'd point you to the ITA Coverage Application and 1904.41 itself rather than eyeball it. If you're near a threshold, check the tool.

Certification and penalties

The 300A can't be certified by whoever happens to be free. 1904.32(b)(4) defines a company executive as an owner, a corporate officer, the highest-ranking company official working at the establishment, or that person's immediate supervisor. The certifier is attesting, based on their knowledge of the process, that the summary is correct and complete. In practice the safety officer or OH nurse prepares it and a named executive signs — the signature isn't a rubber stamp, it's a legal attestation.

Getting recordkeeping wrong carries real cost. Per OSHA's 2026 penalty adjustment memo (dated May 21, 2026 — no inflation increase for 2026, so 2025 figures carry forward), the maximums are:

• Serious and Other-Than-Serious: $16,550 per violation
• Willful and Repeat: $165,514 per violation
• Failure to Abate: $16,550 per day past the abatement date
• Posting and Recordkeeping violations: $16,550 per violation

A recordkeeping citation is per-violation, and inspectors do read Logs against 301s during walkarounds. Missing 301s, cases that should have been recordable and weren't, a 300A that never went up — each is exposure.

A short compliance checklist

• Confirm your establishment's NAICS classification and whether you're covered (hospitals and nursing/residential care: yes).
• Make the recordability call on each injury as it's reported — that's the hard part; the forms are downstream.
• Enter every recordable case on the 300 Log and complete a 301 within 7 calendar days.
• Keep the privacy case list current for cases that require name suppression.
• Each January, review the full Log, prepare and certify the 300A, and post it February 1–April 30 (even if it's all zeros).
• Determine your ITA tier and e-file by March 2 — 300A for most, plus 300 and 301 detail if you're a 100+-employee hospital or nursing facility.
• Retain everything for 5 years and update stored Logs as cases change.

Keeping the Log, the 301s, and the 300A in sync — and pulling the year-end summary and the ITA-ready export without re-keying anything — is exactly the drudgery worth automating. carefoundryESC generates the 300 Log, 300A summary, and 301 reports (including privacy-case handling) from the incident data your team already enters, which takes the arithmetic and the transcription errors out of the picture. But the compliance judgment stays with you; software fills out forms, it doesn't decide what's recordable.

FAQ

Are hospitals exempt from OSHA recordkeeping because they're healthcare? No. Only office-based and outpatient healthcare (NAICS 6211–6215) appear on OSHA's partial-exemption list. Hospitals (NAICS 622) and nursing/residential care facilities (NAICS 623) keep full records and, at 100+ employees per establishment, e-file 300 and 301 detail.

How long do I have to record an injury after it happens? Seven calendar days from when you receive information that a recordable case occurred — not from the injury date and not business days (1904.29(b)(3)).

Do I still post the 300A if we had no injuries? Yes. A 300A showing zeros still goes up February 1 through April 30 (1904.32(b)(6)).

Do I mail these forms to OSHA? No. Covered establishments submit through the Injury Tracking Application; OSHA doesn't accept paper.

---

This guide covers federal OSHA. Roughly half of U.S. states run their own OSHA-approved State Plans, which must be at least as effective as federal OSHA and may impose different or additional requirements. Confirm your obligations with your applicable State Plan and verify current details directly with OSHA — this article is general information, not legal advice.