Fifty Sites Keep a 300 Log. Each One Decides Who Sees the Names Behind 'Privacy Case.'

A corporate risk manager is pulling injury records together for an insurance renewal. The spreadsheet has one tab per site, assembled from each location's OSHA 300 Log. On the tab for a distribution center, one row has no name in the employee column. It says "privacy case." The risk manager emails the site HR coordinator to ask who it was, because the insurer's loss-run questionnaire wants a claim number matched to a person. The coordinator, trying to be helpful, replies with the name.

Nothing about that exchange feels like a violation. Everyone involved works for the same company and has a reason to ask. But the point of the "privacy case" entry is that the log stays safe to show people, and a name sent by email has just left the only place the rules expect it to live. Multiplied across dozens or hundreds of establishments, each with its own coordinator making its own judgment call, this is how a small recordkeeping mechanism turns into a portfolio-wide exposure.

What the rule actually does

Under 29 CFR 1904.29(b), an employer normally enters the employee's name on the OSHA 300 Log. For a defined group of cases, called privacy concern cases, the employer must not enter the name. Instead the employer writes "privacy case" in the space where the name would go. The cases are the ones where publicity attached to the log could do real harm to the worker: an injury or illness to an intimate body part or the reproductive system, an injury or illness resulting from a sexual assault, mental illness, HIV infection, hepatitis or tuberculosis, and needlestick injuries and cuts from sharps contaminated with another person's blood or other potentially infectious material. A final category covers other illnesses where the employee independently and voluntarily asks that the name be left off.

The standard pairs that substitution with a requirement that matters just as much. The employer must keep a separate, confidential list of the case numbers and employee names for the establishment's privacy concern cases, so the entries can be updated and the information provided to the government when asked. In other words, the name is not destroyed. It moves to a second document that has a smaller set of people allowed to open it.

The rule also deals with descriptions. If the employer has a reasonable basis to believe that the description of a privacy concern case could identify the worker even without the name, the employer may use discretion in how the injury or illness is described on the 300 Log and the 301 incident report. The entry still has to carry enough information to identify the cause of the incident and the general severity, but it does not have to include details of an intimate or private nature.

Finally, the rule limits what an employer may do if it chooses to hand the forms to people who have no legal right to them. The details of those disclosure limits and their exceptions are in 1904.29(b), and they are worth reading directly before your company writes any policy that shares logs outside the safety function.

Why the unit of the rule is the establishment

Each establishment keeps its own 300 Log. That follows from the basic scoping rule in Part 1904, under which records are kept for each physical location where employees work, rather than for the company in aggregate. For privacy concern cases, the consequence is simple and easy to miss: the confidential list is also a per-establishment document. A company with fifty sites has fifty confidential lists, and the standard says nothing about who at head office may or may not see them.

That is the first place portfolios go wrong. The corporate recordkeeping policy, if one exists, usually says something like "all sites must maintain OSHA logs in accordance with Part 1904." It rarely says where the confidential list is stored, who holds the key, what happens when the coordinator leaves, or how it gets transferred when an acquisition or divestiture moves a location to a different owner. In a single-site business the answer is "the owner keeps it in a locked drawer." In a portfolio the answer is whatever each coordinator decided on their first day.

Consider the places the same name can end up. The site HR file. The workers' compensation claim file with the carrier or the third-party administrator. The first report of injury. An incident management system where a corporate EHS team enters data from every site. An email thread between the site and a regional manager. Some of those copies are legitimate and necessary; the rule is about what appears on the log and how the confidential list is kept, not about erasing the worker's identity from every record the company holds. But the log itself is the document employees, former employees and their representatives can ask to see, so the discipline has to be airtight there.

Where multi-site programs leak

The first leak is classification drift. Whether a case is a privacy concern case is a judgment applied by a person at each site, usually without guidance. One coordinator treats a needlestick as a privacy case every time, as the rule requires. Another has never heard of the category. A third applies it to any injury that feels embarrassing, which the list does not support. The 300 Logs end up inconsistent across the company, and nobody notices because no one reads them side by side. The remedy is a short decision aid that names the categories in the standard and routes unclear cases to one person who decides consistently.

The second leak is the roll-up. Companies build central dashboards from site logs, and the easiest way to build a dashboard is to export the whole log. If the export includes the free-text description, a privacy concern case can reappear in identifiable form on a screen seen by dozens of people. A central system should carry the case number and the classification, not the narrative, for cases flagged as privacy concerns, and the confidential list should stay at the establishment level or in a restricted-access register.

The third leak is the voluntary-request category. The employee who asks to be left off the log is exercising a right the standard gives them, but the request has to be independent and voluntary. A site manager who suggests that the worker "might prefer to stay off the log" to avoid affecting the site's safety statistics is on the wrong side of the line, and that kind of conversation can also raise questions under the anti-retaliation provisions of the recordkeeping rule. The policy language should say that the option belongs to the employee and that managers do not prompt it.

The fourth leak is access requests. Employees, former employees and their representatives have rights to see the 300 Log, which is covered in its own section of the standard. The same coordinator who answers that request must know to hand over the log as it stands, with "privacy case" in place of the name, and must not volunteer the confidential list. In a company with a central legal or HR intake, make sure the request routes to someone who has been taught that distinction. A request that arrives at the head office but concerns a specific site's log should go back to that site's records holder, or the central team needs to hold a copy of the log with the same masking.

The fifth leak is turnover and transfer. Records coordinators change, sites merge, and acquired locations arrive with logs that were maintained under another owner's habits. An acquisition checklist that asks "do you have OSHA logs for the last five years?" should also ask "where is your confidential privacy case list and who has access?"

A design for a company that cannot visit every site

There is no need to centralize every list. The standard puts them at the establishment, and a corporate team that tries to collect them all creates a new, larger target. A more defensible design has four parts.

First, a one-page policy, written in plain language, that states the categories from 1904.29(b), says the site records holder applies them, and names a single corporate contact for hard questions. Second, a defined location for each confidential list: a restricted folder, a locked cabinet, or a role-limited field in a records system, with a named owner and a named backup. Third, a rule that central systems carry no names or narratives for privacy concern cases, only case numbers and classifications. Fourth, an annual spot check in which someone who is not the site's coordinator reads a sample of 300 Logs across locations for consistency, looking at whether the same type of incident was handled the same way.

The spot check is the part that earns its keep. It costs a few hours and it is the only way head office learns that three sites use three definitions. It also gives the company a chance to find an unredacted narrative before an employee or a regulator does.

What this does not settle

The standard tells you what to put on the log and what to keep on the confidential list. It does not answer every privacy question that arises from an injury. State laws on medical information, employee privacy and notification can add duties that sit outside Part 1904, and a multi-state footprint can mean different answers by location. Your counsel should review any policy that governs how names and health information move between sites, insurers and corporate teams.

This post is general information, not legal advice, and following it does not guarantee compliance with Part 1904 or any state requirement. What it can do is help a head office see a question that usually stays invisible: a word in a column on a log looks like one small decision, but in a company with many establishments it is a hundred of them, made by whoever happened to be at the desk.