Employee Privacy
Are there situations where I do not put the employee's name on the forms for privacy reasons?
- Yes, if you have a "privacy concern case," you may not enter the employee's name on the OSHA 300 Log. Instead, enter "privacy case" in the space normally used for the employee's name. This will protect the privacy of the injured or ill employee when another employee, a former employee, or an authorized employee representative is provided access to the OSHA 300 Log under 1904.35(b)(2). You must keep a separate, confidential list of the case numbers and employee names for your privacy concern cases so you can update the cases and provide the information to the government if asked to do so.
How do I determine if an injury or illness is a privacy concern case?
The following is a complete list of injuries or illnesses that are considered privacy concern cases:
- an injury or illness to an intimate body part or the reproductive system;
- an injury or illness resulting from a sexual assault;
- mental illnesses;
- HIV infection, hepatitis, or tuberculosis;
- needlestick injuries and cuts from sharp objects contaminated with another person's blood or other potentially infectious material; and
- Other illnesses, only if the employee voluntarily requests that his or her name not be entered on the log.
Use discretion in privacy cases. If you reasonably believe that information describing the privacy concern case may be personally identifiable even though the employee's name is omitted, use discretion in describing the injury or illness on both the OSHA 300 and OSHA 301 Forms. Enter enough information to identify the cause of the incident and the general severity of the injury or illness, but you do not need to include details of an intimate or private nature. For example:
- describe a sexual assault case as an "injury from assault"
- an injury to a reproductive organ could be described as "lower abdominal injury"
Disclosing personal identification. If you voluntarily disclose the forms to persons other than government representatives, employees, former employees, or authorized representatives, you must remove or hide the employees' names and other personally identifying information except for in the following cases to:
- an auditor or consultant hired by the employer to evaluate the safety and health program;
- the extent necessary for processing a claim for workers' compensation or other insurance benefits; or
- a public health authority or law enforcement agency for uses and disclosures for which consent, an authorization, or opportunity to agree or object is not required under Department of Health and Human Services Standards for Privacy of Individually Identifiable Health Information, 45 CFR.164.512.
Knowledge Check Choose the best answer for the question.
3-2. What is the correct entry on the OSHA 300 Log if the name of the employee must remain confidential?
You forgot to answer the question!