OSHA Form 301: The Injury and Illness Incident Report

When the supervisor's note arrives and the 301 is still blank

At 3:50 p.m. on a Thursday, the safety coordinator at a 300-employee distribution center finds an email from a shift supervisor. A forklift operator struck a wrist on a pallet rack, went to an urgent-care clinic, and came back with a work restriction. There is no form attached, only three lines of text and a time.

The coordinator keeps a spreadsheet for the 300 log. The 301 is a blank PDF in a shared folder, and nobody is sure whether the carrier's first report counts as one. Someone also asks whether the employee's name belongs on the log or must be left off.

Those are the three questions this article answers: when the 301 is due, what it asks, and how privacy cases change what appears on the log. By the end you will be able to name the clock, its source, and the points where the decision is yours.

Reference material with citations, not legal advice. You decide recordability and compensability, and you file.

What OSHA Form 301 requires, and the seven-calendar-day window

OSHA Form 301 is the incident report. The employer completes one for each recordable injury or illness, and it holds the narrative detail that the 300 Log leaves out. Think of the log as the index and the 301 as the file behind each line.

The deadline has four parts. Under 29 CFR 1904.29, paragraph (b)(3), an employer must enter each recordable case on the OSHA 300 Log and complete the 301 within seven calendar days of receiving information that a recordable injury or illness has occurred, in the employer's own records for that establishment (29 CFR 1904.29, checked 2026). Nothing is filed with OSHA at that point. The regulation's own words:

"within seven (7) calendar days of receiving information that a recordable injury or illness has occurred" — 29 CFR 1904.29, checked 2026

Two points about the trigger. The clock starts on information that a recordable case occurred, not on the date of the incident itself. And whether the case is recordable is your decision. You apply the criteria in the regulation, and our overview of what makes an injury recordable walks through them.

The osha 300 log 7 calendar days duty and the 301 duty sit in the same sentence of the regulation, so the two records move together. For how the three OSHA forms divide the work, see the 300, 300A and 301 compared.

This clock is separate from any workers' compensation clock. State first-report deadlines have their own triggers, units and recipients. The regulation allows an insurance or state form to stand in for the 301 if it contains all the same information, so a carrier's first report can sometimes do double duty. That question has its own article: first report of injury as an OSHA 301. Check that any substitute form carries every item before you rely on it.

What each section of the 301 asks

Reading the blank form is the quickest way to see what OSHA Form 301 asks, and OSHA publishes it free. It has three broad parts.

The employee. This part identifies the person: full name, address, date of birth, date hired and sex. It is the part that privacy-case handling most affects, which the next section covers.

The health care professional. The form asks who treated the employee and where, and whether the employee was treated in an emergency room or admitted overnight as an in-patient. Hospitalization matters twice. It can trigger the separate 24-hour severe-injury report to OSHA, and it is one of the facts you use when deciding whether a case is recordable.

The case itself. Here the employer records the case number, the date and time of the event, and what the employee was doing just before it. The form then asks what happened, what the injury or illness was and which body part it affected, and what object or substance directly harmed the employee.

The form asks for the nature of the injury and the body part affected. It does not ask for a treatment history. Diagnoses, treatment notes and clinical records belong to the provider and the employee's medical file, not to the 301. Keeping the 301 to what the form asks is a sound habit, and it keeps medical records out of your injury-reporting system.

The "what happened" box is where most 301s are weakest. A supervisor's note such as "sprained wrist" does not describe the sequence of events. A useful entry states the activity, the equipment or surface involved, and the immediate cause, in plain sentences that the person completing the log can later reconcile with the 300 Log line. How to fill out the 300 Log shows how the two records line up.

Privacy cases: when the log drops a name

Some cases are sensitive enough that the employee's name does not go on the 300 Log. Section 1904.29(b) sets these out in an exclusive list. OSHA's text calls it "a complete list of all injuries and illnesses considered privacy concern cases" (29 CFR 1904.29, checked 2026).

In plain words, the categories are:

• an injury or illness to an intimate body part or the reproductive system;
• an injury or illness from a sexual assault;
• a mental illness;
• HIV infection, hepatitis or tuberculosis;
• a needlestick or cut from a sharp object contaminated with another person's blood or other potentially infectious material;
• other illnesses, but only when the employee voluntarily asks that the name be withheld.

This paraphrase is a reading aid. Check the exact wording in the eCFR before you apply it.

The rule says what to do, and you decide whether a case fits. If a case qualifies, you enter "privacy case" on the 300 Log where the name would go. You also keep a separate, confidential list that matches each case number to the employee's name, so the record can be traced to a person if the need arises.

Two details trip people up. First, the privacy handling applies to the log. You still complete the 301 for the case, and the 301 still holds the details. Second, if you have a reasonable basis to believe that the description of a privacy case could identify the employee even without the name, the regulation lets you use discretion in how you describe the injury or illness on both the 300 and the 301.

The regulation gives you the list and the mechanics. It does not decide, case by case, whether a particular injury falls inside a category. That judgment is yours, and the confidential list is how you show later what you decided.

What goes to OSHA through the ITA, and what stays with you

Most employers never send a 301 to OSHA. Electronic submission through the Injury Tracking Application (ITA) reaches different forms depending on size and industry.

Under 29 CFR 1904.41, establishments with 20–249 employees in designated higher-hazard industries (Subpart E, Appendix A) must submit 300A data electronically. Establishments with 100 or more employees in Appendix B industries must also submit 300 and 301 data (OSHA interpretation, 2024-04-16). The 301 and 300 submission requirement began in 2024, for the 2023 reporting period (OSHA 2023 summary).

For a covered establishment, the submission is due to OSHA through the ITA by March 2 of the year after the covered year. Data for calendar year 2025 was due March 2, 2026 (ITA user guide, checked 2026).

On the osha 301 privacy fields not submitted to ita question, the submission leaves out certain personally identifying fields of the 301. This article does not reprint that list. OSHA publishes the current set on the ITA page and in the user guide, and you should check it there before you build an export. Treat the ITA as the authoritative channel, because it is the one you file through. The employer files, and the employer decides whether the establishment is covered.

Access is a separate matter. When a government representative asks for Part 1904 records, the employer must provide copies within four business hours (29 CFR 1904.40, checked 2026). Employees and their representatives have access rights too, with their own timing under 1904.35. For the 300 Log, a copy is due to the requester by the end of the next business day, and the first copy is free. Confirm the 301 rules in that section before you write an internal procedure.

Keeping the 301 defensible, and where tools fit

OSHA 300 Logs, 300A summaries and 301 reports must be kept for five years following the end of the calendar year the records cover (29 CFR 1904.33, checked 2026). The retention duty is the employer's. Whatever tool you use, you stay responsible for the five years.

A defensible 301 can answer four questions without hunting: when you received the information, who completed the form, which rule applied, and what was decided about privacy handling. Email threads and spreadsheets can hold those answers. They rarely show which version of a rule was in force when the clock started.

Many readers have built careful systems from Excel and email, and for a single-state employer with a handful of cases a year that can be enough. For those readers, the OSHA 300, 300A and 301 log workbook computes the seven-calendar-day date from the date you received information, applies the recordability logic you set, and rolls the log into the 300A. It does not decide recordability, and you file. (Store checkout availability is being confirmed.)

For multi-site and multi-state employers, ClaimsIntake is being built so that one injury report will feed a pre-filled OSHA 301, a 300 log built from decided cases only, and a 300A roll-up. Each rule row will carry its agency citation and a "last verified" date. ClaimsIntake will not decide recordability, give legal advice, hold medical records, or submit anything to OSHA or any other agency. The employer decides and files.

Your next step is practical. Pull your last three recordable cases and compare the date you received information with the date each 301 was finished. Check that privacy cases have a confidential name list, and confirm the ITA fields with OSHA before the next March 2 submission. To follow the app as it takes shape, join the waitlist.

Reference material with citations, not legal advice. You decide recordability and compensability, and you file.