A Request Lands at 4:50 on a Thursday Afternoon
Maria is the safety manager at a 300-person distribution center. Within ten minutes she receives two messages. A former employee's representative has asked for a copy of the OSHA 300 log. Separately, the company's insurer wants the logs from several past years for a policy review.
Last year's binder is in the front office. The older years are scattered across a shared drive, a storage closet at the second site, and possibly the laptop of a colleague who has left. She is not sure how long the logs must be kept, who is entitled to see them, or whether the two requests run on the same clock.
They are governed differently, and the difference matters. By the end of this article you will be able to state the retention period, name each access deadline with its source, and see where your own judgment starts.
Reference material with citations, not legal advice. You decide recordability and compensability, and you file.
How Long to Keep OSHA 300 Logs: The Five-Year Rule
The OSHA record retention requirements are short to state. Under 29 CFR 1904.33, an employer must keep the OSHA 300 Log, the privacy case list (if one exists), the 300A annual summary and each 301 Incident Report for five years following the end of the calendar year the records cover (29 CFR 1904.33(a), eCFR, checked 2026). The trigger is the close of the record year and the unit is years. It is a keeping duty, so no agency receives the records unless it asks. The three documents are explained in OSHA 300 vs 300A vs 301.
Worked example: a log covering calendar year 2025 closes on December 31, 2025. Counting five years from that date, the employer keeps it through December 31, 2030. The next record year has its own end date, so an employer with several sites and several record years holds many retention dates at once.
So, how long to keep OSHA 300 logs? Five years after each record year ends. That is the OSHA minimum. State workers' compensation agencies, carriers and your own counsel may set other periods for related files. Confirm those with each body, because this article does not state them.
Retention is also per establishment. OSHA requires a separate 300 log for each establishment expected to operate for one year or longer (29 CFR 1904.30(a), checked 2026). A multi-site employer therefore tracks retention site by site. Workers you supervise day to day, including temporary, leased or contract workers not on your payroll, belong on your log (OSHA interpretation, 2018). Their records are part of the set you retain.
The duty is yours whatever system holds the records. A binder, a shared drive, a workbook and a vendor's software all store records, but none of them takes over the obligation. If a subscription ends or a laptop is retired, you must still be able to produce five years of records. Keep your own copy. For what the log itself contains, see the OSHA 300 log.
Who Can Ask for the Records, and How Fast
Part 1904 sets two access clocks. A third kind of request, from an insurer, has no clock in these sections. For the wider picture, see OSHA recordkeeping requirements.
| Requester | Trigger | Deadline and unit | Recipient | Source |
|---|---|---|---|---|
| Employee, former employee or employee representative | A request for a copy of the OSHA 300 Log | End of the next business day; first copy free | The requester | 1904.35(b)(2)(iii), (vi) |
| Authorized government representative | A request for Part 1904 records | Four business hours | The government representative | 1904.40(a) |
| Insurer or carrier | A request for logs | Not set by these two sections | Your insurer | Your policy terms; confirm with your carrier |
Employee access
When an employee, former employee or employee representative makes an employee request for a copy of the OSHA 300 log, the employer must give the requester the relevant log(s) by the end of the next business day. The employer may not charge for the first copy (29 CFR 1904.35(b)(2)(iii), (vi), checked 2026). A 301 Incident Report requested by the employee it describes, a former employee or their personal representative is also due by the end of the next business day. An authorized employee representative gets copies of 301s within 7 calendar days, limited to the section titled "Tell us about the case" (1904.35(b)(2)(v)). Section 1904.35 sets no separate request rule for the 300A; the summary is posted for employees under 1904.32.
Names come off the log for privacy concern cases. Section 1904.29(b)(7) says its list is complete (29 CFR 1904.29, checked 2026). The rule gives you the list. You decide whether a particular case is on it.
Government access
The shorter clock applies to authorized government representatives. The four-hours-to-provide-records rule reads:
"you must provide copies of the records within four (4) business hours" — 29 CFR 1904.40(a), checked 2026
The trigger is a request for Part 1904 records from an authorized government representative: a representative of the Secretary of Labor, of the Secretary of Health and Human Services (including NIOSH), or of a State Plan agency (1904.40(b)(1)). The unit is business hours, and the recipient is that representative.
An insurer asking for OSHA 300 logs
The two clocks above are written for employees and government representatives. Neither 1904.35 nor 1904.40 mentions insurers, so these sections set no deadline for an insurer asking for OSHA 300 logs. What you share, in what form and when depends on your policy terms and your own judgment. Confirm with your carrier and counsel, and keep a note of what you sent.
Edge Cases That Trip Up Retention and Access
Records spread across sites. Four business hours is a short window if a site's log sits in a closet two states away. The practical question is whether the person who answers can reach every establishment's current log and the prior years quickly.
Counting hours and days. The regulation counts in business days for employees and business hours for government requests. If the records sit in a different time zone, the rule lets you use the business hours of the establishment where the records are kept (1904.40(b)(2)). How your schedule maps to those terms is worth confirming with OSHA before you need it, not during a request.
The government may already have data. OSHA tells compliance officers to check the Injury Tracking Application database during all inspections to identify employers that were required to submit records but did not (OSHA interpretation, 2024). The ITA is the authoritative channel, and you file through it yourself. Your retained records are what let you explain what you submitted.
The 300A and its certification. The 300A is one of the three retained documents, and the certifying executive must be one of the categories in 1904.32. Keep the certification with the summary. See 300A certification by a company executive.
Related files elsewhere. Carrier claim files, state first-report copies and medical files are not part of the 1904.33 duty. They may carry separate retention periods set by other bodies.
Keeping the Record Defensible
A defensible record can answer three questions: what was recorded, when, and where the copy is. Many employers answer them with spreadsheets, shared folders and email. That approach is flexible and familiar, and many readers built theirs with care. It holds files and dates, but it does not usually calculate a retention end date for each record year or log when an access request arrived and when it was answered.
Here is where each kind of tool fits:
- OSHA and state agencies: the blank forms are free, and ITA is OSHA's own channel. They define the duty and receive filings, but they do not manage your internal retention.
- Spreadsheets plus email: fine for small volumes, but the retention rule lives in someone's head.
- Purpose-built reference tools: keep the rule, its source and the dates together.
ClaimsIntake is reference and workflow software. The app is being built, so everything in this paragraph is future tense. It will offer a five-year record view with an append-only audit trail and rule-version history, plus PDF and CSV export. That view will last while the customer is subscribed, plus 90 days after cancellation. It will not replace the employer's own retention, so export your records before any cancellation. ClaimsIntake will not decide recordability, give legal advice, hold medical records or file anything for you.
Today, the store workbook OSHA Record Retention, Access Request and Audit Readiness Register works from the records you enter. It computes a retention end date for each record year and access request due dates from the receipt date you log. You still decide recordability and you still file. A smaller single-state employer with a handful of record years will likely find a workbook sufficient. The recordkeeping audit checklist pairs well with it.
Your Next Steps
Start with an inventory. List every establishment and record year you hold, and write down each retention end date using the 1904.33 rule. Confirm that the 300, 300A and 301s are all present for each year, including records for supervised temporary workers.
Next, name one person to answer access requests and a backup for days off. Write down where each site's records live. A government request leaves little time to find them. If you will answer an insurer asking for OSHA 300 logs, agree the practice with your carrier and counsel first.
Finally, confirm exact timing questions directly with OSHA or your State Plan agency. That applies especially to how business hours and business days are counted at your sites. The question of how long to keep OSHA 300 logs has a clear answer. The harder work is knowing where the records are when someone asks.
To track retention end dates and access requests across sites, see the OSHA Record Retention, Access Request and Audit Readiness Register. It supports your process. You decide and you file.
