Jurisdiction compliance: the rules that change when you cross a state line
Occupational health law is not uniform across the United States. Twenty-two OSHA State Plans cover private employers, and roughly twenty states now require a healthcare employer to keep a violent incident log. They do not agree about what happens after an incident is logged. This page explains what changes by state, and how carefoundryESC handles it.
Three layers, not one product
A hospital in Sacramento and a hospital in Dallas carry different obligations, and a platform that ships both sets of screens to both of them is a worse product for each. carefoundryESC separates the rules into three layers.
| Layer | Who it applies to | What it adds |
|---|---|---|
| OSHA compliance baseline | Any employer, in any state | Serious injury report and clock, sharps injury log, redacted Form 301, ITA submission file |
| California | Recording under Cal/OSHA | §3342 violent incident log and its clocks, §5199 declinations and exposure clocks, Cal/OSHA form variants |
| Washington | Recording under L&I / DOSH | RCW 49.19 investigation of every incident, safety committee summary, state reporting clock |
The baseline: what every employer carries
The serious injury report, and its clock
Federal OSHA gives you 8 hours to report a work-related fatality and 24 hours for an in-patient hospitalization, amputation or loss of an eye. California gives you 8 hours for all of it, counts any inpatient admission rather than only an overnight stay for treatment, has no 30-day limit between incident and death, and adds any serious degree of permanent disfigurement.
The evaluator knows both regimes and applies the one you record under. The clock runs from the moment the employer knew or, with diligent inquiry, would have known, which is not the same moment as the injury. The countdown is the product here: a hospital that misses eight hours is looking at a citation, and in most systems nothing anywhere tells anyone the clock is running.
The sharps injury log
A separate log from the 300, recording the device, its brand, whether it had engineered sharps injury protection and whether that was activated, the procedure under way, and the employee's own opinion on whether anything could have prevented it. That last field is the employee's, not the clinician's, so it can arrive through the employee portal rather than only from a staff form.
The screen opens on what is incomplete, because the failure mode in every clinic is the same: the exposure gets recorded while the employee is being treated, and the prevention half never gets finished.
The redacted Form 301
When an authorized employee representative asks for incident reports, nine elements must be deleted: name, address, date of birth, date of hire, gender, name of physician, where treatment was provided, whether treated in an emergency room, and whether hospitalized overnight as an inpatient.
This is a separate template that never loads the employee relation at all. A flag on the full form is one careless edit away from a disclosure; a template that cannot reach a name cannot leak one.
The ITA submission file
Establishments with 100 or more employees in the listed healthcare NAICS codes submit case-level 300 and 301 data, not just 300A totals, by March 2 each year. Most build that file by hand.
carefoundryESC produces it, and runs OSHA's own documented cross-checks first, in sentences that name what to fix. That matters because the ITA validates on upload and answers by email, so a rejection costs a round trip. Two of its codings are counterintuitive and catch people out every year: no_injuries_illnesses is 1 when there were injuries, and size is a band rather than a headcount.
California: Cal/OSHA
The violent incident log, 8 CCR §3342
California was the first state in the nation to adopt a healthcare-specific workplace violence standard. Every incident is logged with eight field groups: when and where, a description, who committed it, the circumstances at the time, the type of location, the type of incident, the consequences including whether security or law enforcement were involved, and who completed the entry.
The log carries no personal identifying information. The employer plainly knows who was assaulted, because it has to treat them and count their lost time, so the identity lives on the record behind a separate permission and is never printed on the log or the report. Violent incident records are kept five years; training records one year.
General acute care, acute psychiatric and special hospitals report to the Division: within 24 hours if the incident caused injury, involved a firearm or other dangerous weapon, or presents an urgent or emergent threat, and within 72 hours otherwise. Reportability is advisory with an audited override, because whether something presented an "urgent or emergent threat" is a judgment a person is answerable for, not an inference.
Aerosol transmissible diseases, §5199
A California-only standard, and the one that actually governs employee health in a California hospital. Two pieces are commonly missed:
- Declination statements. An employee who declines a vaccine signs a prescribed form, Appendix C1 for routine vaccines and C2 for seasonal influenza. The text is transcribed verbatim rather than paraphrased, because a reworded statement is not the one the regulation prescribes and the employee's signature would be on a different document.
- Two clocks that are not the post-exposure clock. An exposure analysis identifying who had a significant exposure within 72 hours, recording who was included, who was excluded and why; then notification of exposed employees no later than 96 hours. Both run from when the employer became aware, not from the shift, because a tuberculosis case is routinely identified days later and dating from the shift would show every such case as born overdue.
The forms
A point worth making plainly, because it is widely assumed otherwise: Cal/OSHA's Form 301 is field-for-field identical to the federal one, and the 300 and 300A carry the same columns and totals. What differs is the caption, the agency, the authority (Labor Code §6410 rather than 29 CFR), the Title 8 citations, and one added falsification warning on the 300A. Posting runs February 1 to April 30 and retention is five years, exactly as federally.
Washington: L&I (DOSH)
Washington requires the same violent incident log and then asks for something different. Under RCW 49.19 the employer investigates every incident and reports a recurring data summary to its safety committee, on the state's own eight-hour reporting clock.
Washington also does not require a separate sharps injury log, folding it into the 300 instead. The application does not offer a Washington hospital a screen for a log it has no duty to keep.
Why these are off by default
Because they are obligations only some employers carry. A clinic in Texas has no legal use for a California violent incident log, and putting one in every menu would be worse product rather than more generous. A super-admin switches on the layer an organization actually operates under.
One consequence worth stating: an organization can hold a state pack while still recording under federal OSHA, which would apply the wrong deadlines under the wrong caption. That shows a notice rather than being guessed at.
What it costs
Nothing extra. These layers are included in every plan at every size. They are not add-ons, there is no module pricing, and asking for the one you need does not change your invoice. Pricing is still the four published plans, sized only by employee headcount.
Operating somewhere else
Other states are built on request. If you record under a plan not listed here, tell us which and what it asks of you: several states are moving on healthcare workplace violence, and the log underneath is the same document in each of them. Write to info@carefoundry.com.
Request a demo, see the pricing, or read the guide to state plans and what changes under them.
Sources
- California Title 8 (dir.ca.gov): 8 CCR §3342 (workplace violence prevention in health care), §342 (serious injury reporting), §5193(c)(2) (sharps injury log), §5199 (aerosol transmissible diseases), §14300.35 and §14300.41.
- Federal: 29 CFR 1904, including 1904.39 reporting and the OSHA Injury Tracking Application specifications.
- Washington: RCW 49.19.
- Statements about what carefoundryESC does are accurate as of the current release. If anything here is out of date, write to info@carefoundry.com and we will correct it.