2023-15091. Improve Tracking of Workplace Injuries and Illnesses

AGENCY:

Occupational Safety and Health Administration (OSHA), Labor.

ACTION:

Final rule.

SUMMARY:

OSHA is amending its occupational injury and illness recordkeeping regulation to require certain employers to electronically submit injury and illness information to OSHA that employers are already required to keep under the recordkeeping regulation. Specifically, OSHA is amending its regulation to require establishments with 100 or more employees in certain designated industries to electronically submit information from their OSHA Forms 300 and 301 to OSHA once a year. OSHA will not collect employee names or addresses, names of health care professionals, or names and addresses of facilities where treatment was provided if treatment was provided away from the worksite from the Forms 300 and 301. Establishments with 20 to 249 employees in certain industries will continue to be required to electronically submit information from their OSHA Form 300A annual summary to OSHA once a year. All establishments with 250 or more employees that are required to keep records under OSHA's injury and illness regulation will also continue to be required to electronically submit information from their Form 300A to OSHA on an annual basis. OSHA is also updating the NAICS codes used in appendix A, which designates the industries required to submit their Form 300A data, and is adding appendix B, which designates the industries required to submit Form 300 and Form 301 data. In addition, establishments will be required to include their company name when making electronic submissions to OSHA. OSHA intends to post some of the data from the annual electronic submissions on a public website after identifying and removing information that could reasonably be expected to identify individuals directly, such as individuals' names and contact information.

DATES:

This final rule becomes effective on January 1, 2024.

Collections of information: There are collections of information contained in this final rule (see Section V, OMB Review Under the Paperwork Reduction Act of 1995). Notwithstanding the general date of applicability for the requirements contained in the final rule, affected parties do not have to comply with the collections of information until the Department of Labor publishes a separate document in the Federal Register announcing that the Office of Management and Budget has approved them under the Paperwork Reduction Act.

ADDRESSES:

Electronic copies of this Federal Register document and news releases are available at OSHA's website at https://www.osha.gov.

FOR FURTHER INFORMATION CONTACT:

For press inquiries: Frank Meilinger, Director, Office of Communications, Occupational Safety and Health Administration, U.S. Department of Labor; telephone [phone]; email: [e-mail].

For general information and technical inquiries: Lee Anne Jillings, Director, Directorate of Technical Support and Emergency Management, U.S. Department of Labor; telephone [phone]; email: [e-mail].

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Background

A. References and Exhibits

B. Introduction

C. Regulatory History

D. Related Litigation

E. Injury and Illness Data Collection

II. Legal Authority

A. Statutory Authority To Promulgate the Rule

B. Fourth Amendment Issues

C. Publication of Collected Data and FOIA

D. Reasoned Explanation for Policy Change

III. Summary and Explanation of the Final Rule

A. Section 1904.41(a)(1)(i) and (ii)—Annual Electronic Submission of Information From OSHA Form 300A Summary of Work-Related Injuries and Illnesses

1. Section 1904.41(a)(1)(i)—Establishments With 20–249 employees That Are Required To Submit Information From OSHA Form 300A

2. Section 1904.41(a)(1)(ii)—Establishments With 250 or More Employees That Are Required To Submit Information From OSHA Form 300A

3. Restructuring of Previous Section 1904.41(a)(1) and (2) Into Final Section 1904.41(a)(1)(i) and (ii)

4. Updating Appendix A

B. Section 1904.41(a)(2)—Annual Electronic Submission of OSHA Form 300 Log of Work-Related Injuries and Illnesses and OSHA Form 301 Injury and Illness Incident Report by Establishments With 100 or More Employees in Designated Industries)

1. Covered Establishments and Industries

a. The Size Threshold for Submitting Information From OSHA Forms 300 and 301

b. The Criteria for Determining the Industries in Appendix B to Subpart E

c. Cut-Off Rates for Determining the Industries in Appendix B to Subpart E

d. Using the Most Current Data To Determine Designated Industries

e. Industries Included in Final Appendix B After Applying the Final Criteria, Cut-Off Rates, and Data Sources

2. Information To Be Submitted

3. Publication of Electronic Data

4. Benefits of Collecting and Publishing Data From Forms 300 and 301

a. General Benefits of Collecting and Publishing Data From Forms 300 and 301

b. Beneficial Ways That OSHA Can Use The Data From Forms 300 and 301

c. Beneficial Ways That Employers Can Use the Data From Forms 300 and 301

d. Beneficial Ways That Employees Can Use the Data From Forms 300 and 301

e. Beneficial Ways That Federal and State Agencies Can Use the Data From Forms 300 and 301

f. Beneficial Ways That Researchers Can Use the Data From Forms 300 and 301

g. Beneficial Ways That Workplace Safety Consultants Can Use the Data From Forms 300 and 301

h. Beneficial Ways That Members of the Public and Other Interested Parties Can Use the Data From Forms 300 and 301

5. The Freedom of Information Act (FOIA)

6. Safeguarding Individual Privacy (Direct Identification)

7. Indirect Identification of Individuals

8. The Experience of Other Federal Agencies

9. Risk of Cyber Attack

10. The Health Information Portability and Accountability Act (HIPAA)

11. The Americans With Disabilities Act (ADA)

12. The Privacy Act

13. Privacy Impact Assessment

14. Other Issues Related to OSHA's Proposal To Require the Submission of and Then Publish Certain Data From Establishments' Forms 300 and 301

a. Miscellaneous Comments

b. The Effect of the Rule on the Accuracy of Injury and Illness Records

c. Collecting and Processing the Data From Forms 300 and 301 Will Help OSHA Use Its Resources More Effectively

d. OSHA's Capacity To Collect and Process the Data From Forms 300 and 301

e. Data Submission

f. Tools To Make the Collected Data From Forms 300 and 301 More Useful

C. Section 1904.41(b)(1)

D. Section 1904.41(b)(9)

1. Collecting Employee Names

2. Excluding Other Specified Fields

E. Section 1904.41(b)(10)

F. Section 1904.41(c)

G. Additional Comments Which Concern More Than One Section of the Proposal

1. General Comments

2. Misunderstandings About Scope

3. Diversion of Resources

4. Lagging v. Leading Indicators

5. Employer Shaming

6. Impact on Employee Recruiting

7. Legal Disputes

8. No Fault Recordkeeping

9. Confidentiality of Business Locations

10. Employer-Vaccine-Mandate-Related Concerns

11. Constitutional Issues and OSHA's Authority To Publish Information From Forms 300 and 301

a. The First Amendment

b. The Fourth Amendment

c. The Fifth Amendment

d. OSHA's Authority To Publish Information Submitted Under This Rule

12. Administrative Issues

a. Public Hearing

b. The Advisory Committee on Construction Safety and Health (ACCSH)

c. Reasonable Alternatives Considered

IV. Final Economic Analysis and Regulatory Flexibility Certification

A. Introduction

B. Changes From the Preliminary Economic Analysis (PEA) (Reflecting Changes in the Final Rule From the Proposal)

1. Continued Submission of OSHA 300A Annual Summaries by Establishments With 250 or More Employees

2. Additional Appendix B Industries

3. Updated Data

C. Cost

1. Wages

a. Wage Estimates in the PEA

b. Comments on OSHA's Wage Estimates

c. Wage Estimates in the FEA

2. Estimated Case Counts

3. Familiarization

4. Record Submission

5. Custom Forms

6. Batch-File Submissions

7. Software/System Upgrades Needed

8. Other Costs

a. Harm to Reputation

b. Additional Time Needed To Review for PII

c. Company Name

d. Training Costs

D. Effect on Prices

E. Budget Costs to the Government

F. Total Cost

G. Benefits

H. Economic Feasibility

I. Regulatory Flexibility Certification

V. OMB Review Under the Paperwork Reduction Act of 1995

A. Overview

B. Summary of Information Collection Requirements

VI. Unfunded Mandates

VII. Federalism

VIII. State Plans

IX. National Environmental Policy Act

X. Consultation and Coordination With Indian Tribal Governments Authority and Signature

I. Background

A. References and Exhibits

In this preamble, OSHA references documents in Docket No. OSHA–2021–0006, the docket for this rulemaking. The docket is available at http://www.regulations.gov, the Federal eRulemaking Portal.

When citing exhibits in the docket, OSHA includes the term “Document ID” followed by the last four digits of the Document ID number. For example, OSHA's preliminary economic analysis is in the docket as OSHA–2021–0006–0002. Citations also include the attachment number or other attachment identifier, if applicable, page numbers (designated “p.” or “Tr.” for pages from a hearing transcript), and in a limited number of cases a footnote number (designated “Fn.”). In a citation that contains two or more Document ID numbers, the Document ID numbers are separated by semi-colons ( e.g., “Document ID 1231, Attachment 1, p. 6; 1383, Attachment 1, p. 2”).

All materials in the docket, including public comments, supporting materials, meeting transcripts, and other documents, are listed on http://www.regulations.gov. However, some exhibits ( e.g., copyrighted material) are not available to read or download from that web page. All materials in the docket, including copyrighted material, are available for inspection through the OSHA Docket Office. Contact the OSHA Docket Office at (202) 693–2350 (TTY (877) 889–5627) for assistance in locating docket submissions.

B. Introduction

OSHA's regulation at 29 CFR part 1904 requires employers with more than 10 employees in most industries to keep records of occupational injuries and illnesses at their establishments. Employers covered by the regulation must use three forms, or their equivalent, to record recordable employee injuries and illnesses:

• OSHA Form 300, the Log of Work-Related Injuries and Illnesses. This form includes information about the employee's name, job title, date of the injury or illness, where the injury or illness occurred, description of the injury or illness ( e.g., body part affected), and the outcome of the injury or illness ( e.g., death, days away from work, job transfer or restriction).

• OSHA Form 301, the Injury and Illness Incident Report. This form includes the employee's name and address, date of birth, date hired, and gender and the name and address of the health care professional that treated the employee, as well as more detailed information about where and how the injury or illness occurred.
• OSHA Form 300A, the Annual Summary of Work-Related Injuries and Illnesses. This form includes general information about an employer's workplace, such as the average number of employees and total number of hours worked by all employees during the calendar year. It does not contain information about individual employees. Employers are required to prepare this form at the end of each year and post the form in a visible location in the workplace from February 1 to April 30 of the year following the year covered by the form.

Section 1904.41 of the previous recordkeeping regulation also required two groups of establishments to electronically submit injury and illness data to OSHA once a year.

• § 1904.41(a)(1) required establishments with 250 or more employees in industries that are required to routinely keep OSHA injury and illness records to electronically submit information from the Form 300A summary to OSHA once a year.
• § 1904.41(a)(2) required establishments with 20–249 employees in certain designated industries (those listed on appendix A of part 1904 subpart E) to electronically submit information from their Form 300A summary to OSHA once a year.

Also, § 1904.41(a)(4) required each establishment that must electronically submit injury and illness information to OSHA to provide their Employer Identification Number (EIN) in their submittal.

Under this final rule, three groups of establishments will be required to electronically submit information from their injury and illness recordkeeping forms to OSHA once a year.

• Establishments with 20–249 employees in certain designated industries (listed in appendix A to subpart E) will continue to be required to electronically submit information from their Form 300A annual summary to OSHA once a year (final § 1904.41(a)(1)(i)). OSHA is also updating the NAICS codes used for appendix A to subpart E.
• Establishments with 250 or more employees in industries that are required to routinely keep OSHA injury and illness records will continue to be required to electronically submit information from the Form 300A to OSHA once a year (final § 1904.41(a)(1)(ii)).

• Establishments with 100 or more employees in certain designated industries (listed in new appendix B to subpart E) will be newly required to electronically submit information from their OSHA Forms 300 and 301 to OSHA once a year (final § 1904.41(a)(2)). The industries listed in new appendix B were chosen based on three measures of industry hazardousness.

OSHA will also require establishments to include their company name when making electronic submissions to OSHA (final § 1904.41(b)(10)).

Additionally, although publication is not part of the regulatory requirements of this final rule, OSHA intends to post the collected establishment-specific, case-specific injury and illness information online. As discussed in more detail below, the agency will seek to minimize the possibility of the release of information that could reasonably be expected to identify individuals directly, such as employee name, contact information, and name of physician or health care professional. OSHA will minimize the possibility of releasing such information in multiple ways, including by limiting the worker information collected, designing the collection system to provide extra protections for some of the information that employers will be required to submit, withholding certain fields from public disclosure, and using automated software to identify and remove information that could reasonably be expected to identify individuals directly.

OSHA has determined that the data collection will assist the agency in its statutory mission to assure safe and healthful working conditions for working people (see 29 U.S.C. 651(b)). In addition, OSHA has determined that the expanded public access to establishment-specific, case-specific injury and illness data will allow employers, employees, potential employees, employee representatives, customers, potential customers, researchers, and the general public to make more informed decisions about workplace safety and health at a given establishment. OSHA believes that this accessibility will ultimately result in the reduction of occupational injuries and illnesses.

OSHA estimates that this rule will have economic costs of $7.7 million per year, including $7.1 million per year to the private sector, with average costs of $136 per year for affected establishments with 100 or more employees, annualized over 10 years with a discount rate of seven percent. The agency believes that the annual benefits, while unquantified, significantly exceed the annual costs.

C. Regulatory History

As discussed in section II, Legal Authority, the Occupational Safety and Health Act (OSH Act or Act) requires employers to keep records of employee illnesses and injuries as prescribed by OSHA through regulation. OSHA's regulations on recording and reporting occupational injuries and illnesses (29 CFR part 1904) were first issued in 1971 (36 FR 12612 (July 2, 1971)). These regulations require the recording of work-related injuries and illnesses that involve death, loss of consciousness, days away from work, restricted work or transfer to another job, medical treatment beyond first aid, or diagnosis of a significant injury or illness by a physician or other licensed health care professional (29 CFR 1904.7).

On July 29, 1977, OSHA amended these regulations to partially exempt businesses having ten or fewer employees during the previous calendar year from the requirement to record occupational injuries and illnesses (42 FR 38568). Then, on December 28, 1982, OSHA amended the regulations again to partially exempt establishments in certain lower-hazard industries from the requirement to record occupational injuries and illnesses (47 FR 57699).^[1] OSHA also amended the recordkeeping regulations in 1994 (Reporting of Fatality or Multiple Hospitalization Incidents, 59 FR 15594) and 1997 (Reporting Occupational Injury and Illness Data to OSHA, 62 FR 6434). Under the version of § 1904.41 added by the 1997 final rule, OSHA began requiring certain employers to submit their 300A data to OSHA annually through the OSHA Data Initiative (ODI). Through the ODI, OSHA collected data on injuries and acute illnesses attributable to work-related activities in the private sector from approximately 80,000 establishments in selected high-hazard industries. The agency used these data to calculate establishment-specific injury and illness rates, and, in combination with other data sources, to target enforcement and compliance assistance activities.

On January 19, 2001, OSHA issued a final rule amending its requirements for the recording and reporting of occupational injuries and illnesses (29 CFR parts 1904 and 1952), along with the forms employers use to record those injuries and illnesses (66 FR 5916). The final rule also updated the list of industries that are partially exempt from recording occupational injuries and illnesses.

On September 18, 2014, OSHA again amended the regulations to require employers to report work-related fatalities and severe injuries—in-patient hospitalizations, amputations, and losses of an eye—to OSHA and to allow electronic reporting of these events (79 FR 56130). The final rule also revised the list of industries that are partially exempt from recording occupational injuries and illnesses.

On May 12, 2016, OSHA amended the regulations on recording and reporting occupational injuries and illnesses to require employers, on an annual basis, to submit electronically to OSHA injury and illness information that employers are already required to keep under part 1904 (81 FR 29624). Under the 2016 revisions, establishments with 250 or more employees that are routinely required to keep records were required to electronically submit information from their OSHA Forms 300, 300A, and 301 to OSHA or OSHA's designee once a year, and establishments with 20 to 249 employees in certain designated industries were required to electronically submit information from their OSHA annual summary (Form 300A) to OSHA or OSHA's designee once a year. In addition, that final rule required employers, upon notification, to electronically submit information from part 1904 recordkeeping forms to OSHA or OSHA's designee. These provisions became effective on January 1, 2017, with an initial submission deadline of July 1, 2017, for 2016 Form 300A data. That submission deadline was subsequently extended to December 15, 2017 (82 FR 55761). The initial submission deadline for electronic submission of information from OSHA Forms 300 and 301 was July 1, 2018. Because of a subsequent rulemaking, OSHA never received the data submissions from Forms 300 and 301 that the 2016 final rule anticipated.

On January 25, 2019, OSHA issued a final rule that amended the recordkeeping regulations to remove the requirement for establishments with 250 or more employees that are routinely required to keep records to electronically submit information from their OSHA Forms 300 and 301 to OSHA or OSHA's designee once a year. As a result, those establishments were required to electronically submit only information from their OSHA 300A annual summary. The 2019 final rule also added a requirement for covered employers to submit their Employer Identification Number (EIN) electronically along with their injury and illness data submission (83 FR 36494, 84 FR 380, 395–97).

On March 30, 2022, OSHA issued a notice of proposed rulemaking (NPRM or proposed rule) proposing to amend the recordkeeping regulations to require establishments with 100 or more employees in certain designated industries to electronically submit information from their OSHA Forms 300 and 301 to OSHA once a year (87 FR 18528). In addition, OSHA proposed to continue the requirement for establishments with 20 or more employees in certain designated industries to electronically submit data from their OSHA Form 300A annual summary to OSHA once a year. OSHA also proposed to update the appendices containing the designated industries covered by the electronic submission requirement and to remove the requirement for establishments with 250 or more employees not in a designated industry to electronically submit information from their Form 300A to OSHA on an annual basis. Further, OSHA expressed its intention to post the data from the proposed electronic submission requirement on a public website after identifying and removing information that could reasonably be expected to identify individuals directly, such as individuals' names and contact information. Finally, OSHA proposed to require establishments to include their company name when making electronic submissions to OSHA.

Comments on the NPRM were initially due on May 30, 2022 (87 FR18528). However, in response to requests for an extension, OSHA published a second Federal Register notice on May 25, 2022, extending the comment period until June 30, 2022 (87 FR 31793). By the end of the extended comment period, OSHA had received 87 comments on the proposed rule. The issues raised in those comments are addressed herein.

D. Related Litigation

Both the 2016 and 2019 OSHA final rules that addressed the electronic submission of injury and illness data were challenged in court. In Texo ABC/AGC, Inc., et al. v. Acosta, No. 3:16–cv–01998–L (N.D. Tex. filed July 8, 2016), and NAHB, et al. v. Acosta, No. 5:17–cv–00009–PRW (W.D. Okla. filed Jan. 4, 2017), industry groups challenged OSHA's 2016 final rule that required establishments with 250 or more employees to electronically submit data from their OSHA Forms 300 and 301 to OSHA (as well as other requirements not relevant to this rulemaking). The complaints alleged that the publication of establishment-specific injury and illness data would lead to misuse of confidential and proprietary information by the public and special interest groups. The complaints also alleged that publication of the data exceeds OSHA's authority under the OSH Act and is unconstitutional under the First Amendment to the U.S. Constitution. After OSHA published a notice in the Federal Register on June 28, 2017, noting that the agency planned to publish a proposal that would reconsider the requirements of the 2016 final rule (82 FR 29261), Texo was administratively closed. The plaintiffs in NAHB dropped their claims relating to the 300 and 301 data submission requirement after the 2019 final rule was published (and moved forward with their other claims, which are still pending in the Western District of Oklahoma).

In Public Citizen Health Research Group et al. v. Pizzella, No. 1:19–cv–00166 (D.D.C. filed Jan. 25, 2019) and State of New Jersey et al. v. Pizzella, No. 1:19–cv–00621 (D.D.C. filed Mar. 6, 2019), a group of public health organizations and a group of States filed separate lawsuits challenging OSHA's 2019 final rule rescinding the requirement for certain employers to submit the data from OSHA Forms 300 and 301 to OSHA electronically each year. The U.S. District Court for the District of Columbia resolved the two cases in a consolidated opinion and held that rescinding the provision was within the agency's discretion ( Public Citizen Health Research Group et al. v. Pizzella, No. 1:19–cv–00166–TJK (D.D.C. Jan. 11, 2021)). The court first dismissed Public Citizen's complaint for lack of subject-matter jurisdiction. Next, turning to the merits of the States' complaint, the court held that OSHA's rescission of the Form 300 and Form 301 data-submission requirements was within the agency's discretion based on its rebalancing of the “uncertain benefits” of collecting the 300 and 301 data against the diversion of OSHA's resources from other efforts and potential privacy harms to employees. The court also rejected the plaintiffs' assertion that OSHA's reasons for the 2019 final rule were internally inconsistent. Both groups of plaintiffs have appealed to the U.S. Court of Appeals for the District of Columbia Circuit (Nos. 21–5016, 21–5018).

Additionally, since 2020, the Department of Labor (DOL) has received multiple adverse decisions regarding the release of electronically submitted 300A data under the Freedom of Information Act (FOIA). In each of the cases, OSHA argued that electronically submitted 300A injury and illness data are exempt from disclosure pursuant to the confidentiality exemption in FOIA Exemption 4. Two courts, one in the U.S. District Court for the Northern District of California and another in the U.S. District Court for the District of Columbia, disagreed with OSHA's position (see Center for Investigative Reporting, et al., v. Department of Labor, No. 4:18–cv–02414–DMR, 2020 WL 2995209 (N.D. Cal. June 4, 2020); Public Citizen Foundation v. United States Department of Labor, et al., No. 1:18–cv–00117 (D.D.C. June 23, 2020)). In addition, on July 6, 2020, the Department received an adverse ruling from a magistrate judge in the Northern District of California in a FOIA case involving Amazon fulfillment centers. In that case, plaintiffs sought the release of individual 300A forms, which consisted of summaries of Amazon's work-related injuries and illnesses and which were provided to OSHA compliance officers during specific OSHA inspections of Amazon fulfillment centers in Ohio and Illinois (see Center for Investigative Reporting, et al., v. Department of Labor, No. 3:19–cv–05603–SK, 2020 WL 3639646 (N.D. Cal. July 6, 2020)).

In holding that FOIA Exemption 4 was inapplicable, the courts rejected OSHA's position that electronically submitted 300A injury and illness data are covered under the confidentiality exemption in FOIA Exemption 4. The decisions noted that the 300A form is posted in the workplace for three months and that there is no expectation that the employer must keep these data confidential or private. As a result, OSHA provided the requested 300A data to the plaintiffs, and posted collected 300A data on its public website beginning in August 2020. The data are available at https://www.osha.gov/​Establishment-Specific-Injury-and-Illness-Data and include the submissions for calendar years 2016, 2017, 2018, 2019, 2020, and 2021.

E. Injury and Illness Data Collection

Currently, two U.S. Department of Labor data collections request and compile information from the OSHA injury and illness records that certain employers are required to keep under 29 CFR part 1904: the annual collection conducted by OSHA under 29 CFR 1904.41 (Electronic Submission of Employer Identification Number (EIN) and Injury and Illness Records to OSHA), and the annual Survey of Occupational Injuries and Illnesses (SOII) conducted by the Bureau of Labor Statistics (BLS) under 29 CFR 1904.42. This final rule amends the regulation at § 1904.41. It does not change the SOII or the authority for the SOII set forth in § 1904.42.

The BLS SOII is an establishment-based survey used to estimate nationally representative incidence rates and counts of workplace injuries and illnesses. It also provides detailed case and demographic data for cases that involve one or more days away from work (DAFW) and for days of job transfer and restriction (DJTR). Each year, BLS collects data from Forms 300, 301, and 300A from a scientifically selected probability sample of about 230,000 establishments, covering nearly all private-sector industries, as well as State and local government. Title 44 U.S.C. 3572 prohibits BLS from releasing establishment-specific and case-specific data to the general public or to OSHA. However, BLS has modified its collection procedures to be able to automatically import certain Form 300A submissions from the OSHA ITA into the BLS SOII Internet Data Collection Facility (IDCF). As discussed below, the Department is continuing to evaluate opportunities to further reduce duplicative reporting.

II. Legal Authority

A. Statutory Authority To Promulgate the Rule

OSHA is issuing this final rule pursuant to authority expressly granted by several provisions of the OSH Act that address the recording and reporting of occupational injuries and illnesses. Section 2(b)(12) of the OSH Act states that one of the purposes of the OSH Act is to “assure so far as possible . . . safe and healthful working conditions . . . by providing for appropriate reporting procedures . . . which . . . will help achieve the objectives of th[e] Act and accurately describe the nature of the occupational safety and health problem” (29 U.S.C. 651(b)(12)). Section 8(c)(1) requires each employer to “make, keep and preserve, and make available to the Secretary [of Labor] . . . , such records regarding his activities relating to this Act as the Secretary . . . may prescribe by regulation as necessary or appropriate for the enforcement of this Act or for developing information regarding the causes and prevention of occupational accidents and illnesses” (29 U.S.C. 657(c)(1)). Section 8(c)(2) directs the Secretary to prescribe regulations “requiring employers to maintain accurate records of, and to make periodic reports on, work-related deaths, injuries and illnesses other than minor injuries requiring only first aid treatment and which do not involve medical treatment, loss of consciousness, restriction of work or motion, or transfer to another job” (29 U.S.C. 657(c)(2)).

Section 8(g)(1) authorizes the Secretary “to compile, analyze, and publish, whether in summary or detailed form, all reports or information obtained under this section” (29 U.S.C. 657(g)(1)). Section 8(g)(2) of the Act broadly empowers the Secretary to “prescribe such rules and regulations as he may deem necessary to carry out [his] responsibilities under th[e] Act” (29 U.S.C. 657(g)(2)).

Section 24 of the OSH Act (29 U.S.C. 673) contains a similar grant of authority. This section requires the Secretary to “develop and maintain an effective program of collection, compilation, and analysis of occupational safety and health statistics” and “compile accurate statistics on work injuries and illnesses which shall include all disabling, serious, or significant injuries and illnesses . . .” (29 U.S.C. 673(a)). Section 24 also requires employers to “file such reports with the Secretary as he shall prescribe by regulation” (29 U.S.C. 673(e)). These reports are to be based on “the records made and kept pursuant to section 8(c) of this Act” (29 U.S.C. 673(e)).

Section 20 of the Act (29 U.S.C. 669) contains additional implicit authority for collecting and disseminating data on occupational injuries and illnesses. Section 20(a) empowers the Secretaries of Labor and Health and Human Services to consult on research concerning occupational safety and health problems, and provides for the use of such research, “and other information available,” in developing criteria on toxic materials and harmful physical agents. Section 20(d) states that “[i]nformation obtained by the Secretary . . . under this section shall be disseminated by the Secretary to employers and employees and organizations thereof” (29 U.S.C. 669(d)).

The OSH Act authorizes the Secretary of Labor to issue two types of occupational safety and health rules: standards and regulations. Standards, which are authorized by Section 6 of the Act (29 U.S.C. 655), aim to correct particular identified workplace hazards, while regulations further the general enforcement and detection purposes of the OSH Act (see Workplace Health & Safety Council v. Reich, 56 F.3d 1465, 1468 (D.C. Cir. 1995) (citing La. Chem. Ass'n v. Bingham, 657 F.2d 777, 781–82 (5th Cir. 1981)); United Steelworkers of Am. v. Auchter, 763 F.2d 728, 735 (3d Cir. 1985)). Recordkeeping requirements promulgated under the Act are characterized as regulations (see 29 U.S.C. 657 (using the term “regulations” to describe recordkeeping requirements); see also Workplace Health & Safety Council v. Reich, 56 F.3d 1465, 1468 (D.C. Cir. 1995) (citing La. Chem. Ass'n. v. Bingham, 657 F.2d 777, 781–82 (5th Cir. 1981); United Steelworkers of Am. v. Auchter, 763 F.2d 728, 735 (3d Cir. 1985)).

B. Fourth Amendment Issues

This final rule does not infringe on employers' Fourth Amendment rights. The Fourth Amendment protects against searches and seizures of private property by the government, but only when a person has a “legitimate expectation of privacy” in the object of the search or seizure ( Rakas v. Illinois, 439 U.S. 128, 143–47 (1978)). There is little or no expectation of privacy in records that are required by the government to be kept and made available ( Free Speech Coalition v. Holder, 729 F. Supp. 2d 691, 747, 750–51 (E.D. Pa. 2010) (citing cases); United States v. Miller, 425 U.S. 435, 442–43 (1976); cf. Shapiro v. United States, 335 U.S. 1, 33 (1948) (no Fifth Amendment interest in required records)). Accordingly, the Fourth Circuit held, in McLaughlin v. A.B. Chance, that an employer has little expectation of privacy in the records of occupational injuries and illnesses kept pursuant to OSHA regulations and must disclose them to the agency on request (842 F.2d 724, 727–28 (4th Cir. 1988)).

Even if there were an expectation of privacy, the Fourth Amendment prohibits only unreasonable intrusions by the government ( Kentucky v. King, 131 S. Ct. 1849, 1856 (2011)). The information submission requirements in this final rule are reasonable. The requirements serve a substantial government interest in the health and safety of workers, have a strong statutory basis, and rest on reasonable, objective criteria for determining which employers must report information to OSHA (see New York v. Burger, 482 U.S. 691, 702–703 (1987)).

OSHA notes that two courts have held, contrary to A.B. Chance, that the Fourth Amendment requires prior judicial review of the reasonableness of an OSHA field inspector's demand for access to injury and illness logs before the agency could issue a citation for denial of access ( McLaughlin v. Kings Island, 849 F.2d 990 (6th Cir. 1988); Brock v. Emerson Electric Co., 834 F.2d 994 (11th Cir. 1987)). Those decisions are inapposite here. The courts based their rulings on a concern that field enforcement staff had unbridled discretion to choose the employers they would inspect and the circumstances in which they would demand access to employer records. The Emerson Electric court specifically noted that in situations where “businesses or individuals are required to report particular information to the government on a regular basis[,] a uniform statutory or regulatory reporting requirement [would] satisf[y] the Fourth Amendment concern regarding the potential for arbitrary invasions of privacy” (834 F.2d at 997, n.2). This rule, like that hypothetical, establishes general reporting requirements based on objective criteria and does not vest field staff with any discretion. The employers that are required to report data, the information they must report, and the time when they must report it are clearly identified in the text of the rule and in supplemental notices that will be published pursuant to the Paperwork Reduction Act.

C. Publication of Collected Data and FOIA

FOIA generally supports OSHA's intention to publish information on a publicly available website. FOIA provides that certain Federal agency records must be routinely made “available for public inspection in an electronic format” (see 5 U.S.C. 552(a)(2) (2016)). Subsection (a)(2)(D)(ii) provides that agencies must include any records processed and disclosed in response to a FOIA request that “the agency determines have become or are likely to become the subject of subsequent requests for substantially the same records” or “have been requested 3 or more times.”

Based on its experience, OSHA believes that the recordkeeping information from the Forms 300, 301, and 300A required to be submitted under this rule will likely be the subject of multiple FOIA requests in the future. Consequently, the agency plans to place the recordkeeping information that will be posted on the public OSHA website in its Electronic FOIA Library. Since agencies may “withhold” ( i.e., not make available) a record (or portion of such a record) if it falls within a FOIA exemption, just as they can do in response to FOIA requests, OSHA will place the published information in its FOIA Library consistent with all FOIA exemptions.

D. Reasoned Explanation for Policy Change

When a Federal agency action changes or reverses prior policy, that action is subject to the same standard of review as an action that addresses an issue for the first time or is consistent with prior policy ( F.C.C. v. Fox Television Stations, Inc., 556 U.S. 502, 514–15 (2009)). As with any other agency action, agencies must simply “provide a reasoned explanation for the change” ( Encino Motorcars, LLC v. Navarro, 579 U.S. 211, 221 (2016)). An agency that is changing policy must “display awareness that it is changing position,” but “need not demonstrate . . . that the reasons for the new policy are better than the reasons for the old one”; “it suffices that the new policy is permissible under the statute, that there are good reasons for it, and that the agency believes it to be better, which the conscious change of course adequately indicates” ( F.C.C., 556 U.S. at 515; accord DHS v. Regents of Univ. of California, 140 S. Ct. 1891 (2020); Encino Motorcars, LLC, 579 at 221; see also Advocates for Highway & Auto Safety v. FMCSA, 41 F.4th 586 (D.C. Cir. 2022) (upholding 2020 change to 2015 rule); Overdevest Nurseries, L.P. v. Walsh, 2 F. 4th 977 (D.C. Cir. 2021) (upholding 2010 change to 2008 rule)). In sum, the Administrative Procedure Act imposes “no special burden when an agency elects to change course” ( Home Care Ass'n of Am. v. Weil, 799 F.3d 1084, 1095 (D.C. Cir. 2015)).

Although agencies may need to provide more detailed explanations for changes in policy that “engendered serious reliance interests,” F.C.C. v. Fox Television Stations, Inc., 556 U.S. 502, 515 (2009), OSHA has found no such reliance interests at stake in this rulemaking. The prior policy, contained within the 2019 final recordkeeping rule, represented a return to the pre-2016 status quo wherein large employers were not required to submit their Form 300 and Form 301 information to OSHA. Essentially, the prior policy relieved employers of the requirement to incur the costs they would have had to incur to comply with the 2016 final rule. Therefore, the prior policy did not require employers to take any steps or invest any resources to comply with it. Further, OSHA made it clear in the 2019 final rule that its decision was based on a temporal weighing of the potential risks to privacy against the benefits of collecting the data ( e.g., “OSHA has determined that because it already has systems in place to use the 300A data for enforcement targeting and compliance assistance without impacting worker privacy, and because the Form 300 and 301 data would provide uncertain additional value, the Form 300A data are sufficient for enforcement targeting and compliance assistance at this time ” (84 FR 392)). Employers were therefore placed on notice that the policy announced in the 2019 rule could change based on OSHA's weighing of the relevant considerations over time, further alleviating any reliance interests the rule might have engendered. In any event, OSHA provides detailed and specific reasons for the change in prior policy throughout this preamble.^[2]

III. Summary and Explanation of the Final Rule

OSHA is amending its occupational injury and illness recordkeeping regulations at 29 CFR part 1904 to require certain employers to electronically submit injury and illness information to OSHA that employers are already required to keep. Specifically, this final rule requires establishments with 100 or more employees in certain designated industries ( i.e., the industries on appendix B to subpart E of part 1904) to electronically submit information from their OSHA Forms 300 and 301 to OSHA once a year. OSHA will not collect certain information, like employee and healthcare provider names and addresses, from the Forms 300 and 301 in order to protect the privacy of workers and other individuals identified on those forms. In addition, the final rule retains the requirements for the annual electronic submission of information from the Form 300A annual summary. Establishments with 20 to 249 employees in certain industries ( i.e., those on appendix A to subpart E of part 1904) will continue to be required to electronically submit information from their OSHA Form 300A to OSHA once a year. And, all establishments with 250 or more employees that are required to keep records under part 1904 will continue to be required to electronically submit information from their Form 300A to OSHA once a year. In addition, the final rule requires establishments to include their legal company name as part of their annual submission. OSHA intends to post some of the information from these annual electronic submissions on a public website after removing any submitted information that could reasonably be expected to identify individuals directly. OSHA received a number of comments on the proposed rule, which was published in March 2022.

Many commenters strongly support this rulemaking effort ( e.g., Docket IDs 0008, 0026, 0029, 0033, 0040, 0047, 0048, 0049, 0061, 0063, 0067, 0069, 0073, 0084, 0089), while others are strenuously opposed ( e.g., Docket IDs 0043, 0050, 0052, 0053, 0058, 0059, 0062, 0088, 0090). Several commenters requested that OSHA withdraw the proposed rule ( e.g., Docket IDs 0042, 0065, 0075). Organizations that represent employees generally advocated for OSHA to proceed with the rulemaking, arguing that collecting and publishing workplace illness and injury information will lead to improvements in worker safety and health in a number of different ways. Organizations commenting on behalf of employers argued, in many cases, that the required submission and subsequent publication of this information could harm businesses or result in violations of employees' privacy. OSHA has evaluated the public comments and other evidence in the record and agrees with commenters who believe that electronic submission of worker injury and illness information to OSHA will lead to safer workplaces. The agency has decided to move forward with a final rule requiring electronic submission of this information.

Public comments regarding the final regulatory provisions and specific issues related to the submission and publication of workplace injury and illness information are discussed throughout this preamble. The Summary and Explanation is organized by regulatory provision, with issues related to each provision discussed in the section for that provision. Comments not specifically related to a regulatory provision and comments that apply to the rulemaking in general are addressed at the end of the Summary and Explanation. OSHA's economic analysis and related issues and comments are discussed in Section IV, Final Economic Analysis, following the Summary and Explanation.

A. Section 1904.41(a)(1)(i) and (ii)—Annual Electronic Submission of Information From OSHA Form 300A Summary of Work-Related Injuries and Illnesses

The final rule requires electronic submission of Form 300A information from two categories of establishments. First, § 1904.41(a)(1)(i) requires establishments with 20–249 employees that are in an industry listed in appendix A of subpart E of part 1904 to electronically submit information from their Form 300A to OSHA. The industries included on appendix A are listed by the NAICS codes from 2017. Second, § 1904.41(a)(1)(ii) requires establishments with 250 or more employees that are required to keep records under part 1904 to electronically submit their Form 300A information to OSHA. For all establishments, the size of the establishment is determined based on how many employees the establishment had during the previous calendar year. Data must be submitted annually, for the previous calendar year, by the date specified in § 1904.41(c), which is March 2.

As discussed in more detail below, the requirements for establishment submission of Form 300A information under the final rule are substantively identical to the requirements previously found in § 1904.41(a)(1) and (a)(2). In other words, all establishments with 250 or more employees are still required to submit information from Form 300A, and establishments with 20–249 employees in industries on appendix A of subpart E are still required to submit information from their Form 300A. However, OSHA has made minor revisions to the language of final § 1904.41(a)(1)(i) and (ii), and the final regulatory text of both provisions has been restructured, with final § 1904.41(a)(1)(i) addressing the Form 300A submission requirements for establishments with 20–249 employees and final § 1904.41(a)(1)(ii) addressing the Form 300A submission requirements for establishments with 250 or more employees. As discussed elsewhere in this preamble, final § 1904.41(a)(2) addresses the submission requirements for OSHA Forms 300 and 301 by establishments with 100 or more employees in the industries listed in appendix B. The final rule's requirements in § 1904.41(a)(1) are discussed below, along with the proposed provisions and related evidence in the rulemaking record.

1. Section 1904.41(a)(1)(i)—Establishments With 20–249 Employees That Are Required To Submit Information From OSHA Form 300A

Under proposed § 1904.41(a)(1), establishments that had 20 or more employees at any time during the previous calendar year, and that are classified in an industry listed in appendix A to subpart E, would have been required to electronically submit information from their OSHA Form 300A to OSHA or OSHA's designee once a year. As OSHA explained in the preamble to the NPRM, this proposed provision was essentially the same as the previous requirements. OSHA requested comment on proposed § 1904.41(a)(1) generally.

OSHA did not receive many comments specifically about the proposed continuation of the requirement for certain establishments with 20 or more employees to submit their Form 300A data electronically. The Laborers Health and Safety Fund of North America stated that the proposal for establishments with 20 or more employees in certain high-hazard industries to electronically submit Form 300A data to OSHA “must be a requirement,” and emphasized the value of the data for numerous interested parties (Docket ID 0080). The Communications Workers of America (CWA) urged OSHA to expand the submission requirements for the 300A by requiring all establishments with at least 20 employees to submit information from the Form 300A, instead of limiting the requirement to only those industries on appendix A (Docket ID 0092). In addition, the National Federation of Independent Business (NFIB) commented on this provision, noting that “the proposed rule lowers the previous threshold that triggers a duty to file with OSHA automatically ( i.e., without any request from OSHA) from 250 or more employees to 20 or more employees, increasing the number of small and independent businesses within the appendix A industries required to submit Form 300A” (Docket ID 0036). However, NFIB's comment appears to misunderstand the previous requirements. As OSHA explained in the preamble to the proposed rule, establishments with 20–249 employees, in industries listed in appendix A, were already required to electronically submit information from their OSHA 300A to OSHA every year (87 FR18535–6). OSHA was not proposing an expansion of this requirement.

Having reviewed the evidence in the record, OSHA has decided to retain the requirement for establishments with 20–249 employees to annually submit their Form 300A data to OSHA. As noted by the Laborers Health and Safety Fund of North America and discussed further below, this requirement provides a good deal of useful data to many types of interested parties and should not be displaced. OSHA acknowledges the comments supporting expansion of the previous requirement but notes that expanding the requirement for submission of Form 300A data to all establishments with 20–249 employees that are covered by part 1904 would expand the data collection to a total of about 557,000 establishments with 20–249 employees, according to 2019 County Business Patterns data ( https://www.census.gov/​programs-surveys/​cbp/​data/​datasets.html). In contrast, OSHA estimates that about 463,000 establishments with 20–249 employees in industries that are in appendix A will be required to submit data under the final rule ( https://www.census.gov/​programs-surveys/​cbp/​data/​datasets.html). OSHA does not believe, at this time, that the benefits from the additional data collection would outweigh the disadvantages of the additional time and resources required for compliance.

In the previous regulation, this requirement was at § 1904.41(a)(2). In the final rule, it is at § 1904.41(a)(1)(i). This final rule will not impose any new requirements on establishments with 20–249 employees to electronically submit information from their Form 300A to OSHA. All establishments that will be required to electronically submit Form 300A information to OSHA on an annual basis under the final rule are already required to do so.

Additionally, as noted above, OSHA revised the language of this requirement slightly for clarity. Specifically, the previous version referred to establishments with “20 or more employees but fewer than 250 employees[,]” while final § 1904.41(a)(1)(i) refers to establishments with “20–249 employees[.]” These clarifying edits do not change the substantive requirements of the provision.

Similarly, OSHA revised the language of proposed § 1904.41(a)(1) in this final rule for clarity without adding any new requirements for employers. Specifically, proposed § 1904.41(a)(1) would have required establishments with 20 or more employees that are in an industry listed in appendix A of subpart E of part 1904 to electronically submit information from their Form 300A to OSHA. The final version of that provision, § 1904.41(a)(1)(i), addresses only establishments with 20–249 employees, because final § 1904.41(a)(1)(ii) addresses establishments with 250 or more employees. This change was made to eliminate the overlap, and potential confusion, that would have resulted if both § 1904.41(a)(1)(i) and § 1904.41(a)(1)(ii) addressed establishments with 250 or more employees.

2. Section 1904.41(a)(1)(ii)—Establishments With 250 or More Employees That Are Required To Submit Information From OSHA Form 300A

Although OSHA proposed to maintain the same Form 300A submission requirement for establishments with 20–249 employees, the agency proposed to remove the electronic submission requirement for certain establishments with 250 or more employees. Under previous § 1904.41(a)(1), all establishments of this size in industries routinely required to keep injury and illness records were required to electronically submit information from their Form 300A to OSHA once a year. The proposal would have required this submission only from those establishments with 250 or more employees in industries listed in appendix A to subpart E. As explained in the preamble to the proposed rule, OSHA had preliminarily determined that collecting Form 300A data from a relatively small number of large establishments in lower-hazard industries was not a priority for OSHA inspection targeting or compliance assistance activities. OSHA asked for comment on the proposed changes to § 1904.41(a)(1) generally, and also specifically asked the question, “Is it appropriate for OSHA to remove the requirement for establishments with 250 or more employees, in industries not included in appendix A, to submit the information from their OSHA Form 300A?” (87 FR18546).

There were no comments specifically supporting the proposal to remove the requirement for establishments with 250 or more employees, in industries not included in appendix A, to submit the information from their OSHA Form 300A. In contrast, multiple commenters opposed the proposal and urged OSHA to retain the existing requirement for establishments with 250 or more employees that are normally required to report under part 1904 to submit data from their 300As ( e.g., Docket IDs 0024, 0035, Attachment 2, 0039, 0040, 0045, 0047, 0048, 0049, 0051, 0061, 0066, 0067, 0069, 0079, 0080, 0083, 0089, 0092, 0093). Reasons for objecting to the proposed removal of the requirement for some large establishments to submit data from their Form 300As included: OSHA offered no compelling reason for removal; the need for continued oversight over large establishments in lower-hazard industries in general and certain industries in particular; the ability to use the data to protect the large number of employees employed in these establishments; and the value of the public information to employee safety and health efforts.

Some commenters argued that OSHA had not made a persuasive case for removing the requirement for large establishments in industries not listed on appendix A to submit their 300A data. For example, Hunter Cisiewski commented, “The proposed rule ultimately fails to present a compelling argument for why `lower hazard' industries should no longer be required to electronically submit Form 300A when they must still keep record of the form, present it to employees on request, and post it publicly in the workplace” (Docket ID 0024). The AFL–CIO argued, “There is no reason that these establishments should be excluded from a standard they are already subject to and have been complying with. OSHA should at minimum, maintain the requirements for large establishments in these sectors that are already in place” (Docket ID 0061; see also Docket ID 0079). Similarly, Public Citizen and the United Food and Commercial Workers International Union (UFCW) noted that there would be no significant burden on employers to maintaining the requirement because these employers are already required to keep Form 300A data and they have systems in place for submitting the data to OSHA electronically (Docket IDs 0093, 0066). The United Steelworkers Union (USW) argued that keeping industries covered helps increase the stability of the system. USW urged OSHA to “focus on expanding, not limiting, those covered by disclosure requirements, and to ensure that all employers currently covered by the reporting requirements remain covered” (Docket ID 0067; see also Docket ID 0080). The UFCW stated that “[A]ll available evidence reflects that OSHA's current requirements provide easy access to important data that is crucial to reducing and preventing workplace injuries and illnesses” (Docket ID 0066).

Other commenters, such as the National Institute for Occupational Safety and Health (NIOSH) and the International Brotherhood of Teamsters, noted that although the industries that are not listed in appendix A may have relatively low injury rates overall, “injury rates can vary greatly across employers and establishments within industries. The requirement for large establishments to submit a 300A Log annually would be a reasonable way to identify establishments that have high injury rates for their industry, and to identify subsegments of industries that may have more hazardous work processes and activities” (Docket ID 0035, Attachment 2; see also Docket ID 0083). Similarly, the Seventeen Attorneys General from New Jersey, California, Connecticut, Delaware, the District of Columbia, Hawaii, Illinois, Maryland, Massachusetts, Michigan, Minnesota, Nevada, New Mexico, New York, Oregon, Rhode Island, and Vermont (Seventeen AGs) noted their states' concern that removing the 300A submission requirement for “lower-hazard” industries would leave Federal OSHA and State occupational safety and health agencies with little way of determining whether these industries were becoming more dangerous for workers over time. This, in turn, could affect the States' outreach and enforcement efforts. “For example, if [s]tates had previously conducted enforcement and outreach in `low hazard' industries, thus keeping risks down, but deprioritize such enforcement based on a lack of reporting, any uptick of illnesses and injuries in those industries, requiring enforcement efforts, may initially go unnoticed by the [s]tates” (Docket ID 0045).

Other commenters emphasized the significant number of workers employed by the large establishments that OSHA had proposed to exclude from submitting their 300A data, and the usefulness of the data in providing them with safe work environments. Hunter Cisiewski estimated that at least 666,250 workers are employed by the approximately 2,665 establishments with 250 or more employees that were proposed to be removed from the Form 300A submission requirement (assuming that each establishment employs only 250 workers). The same commenter also noted that the workers in these large establishments already rely on the required reporting of their injuries to OSHA “to ensure compliance with workplace regulations” (Docket ID 0024). Similarly, the Council of State and Territorial Epidemiologists (CSTE) noted that even if the industries proposed for exclusion have lower injury and illness rates than the industries on appendix A, they employ a large number of people. “Numbers [of workers] as well as rates of work-related injuries or illness need to be considered in setting prevention priorities. These establishments need to provide a safe work environment, and electronic collection of summary data will allow OSHA and public health agencies to monitor their ability to do so” (Docket ID 0040). The International Brotherhood of Teamsters commented, “we think continuing to collect OSHA 300A data for the large numbers of workers employed in these establishments, would help to identify less obvious problems and implement corresponding preventive measures” (Docket ID 0083).

Various commenters pointed to known or potentially hazardous industry segments that would have been exempt from submitting 300A data under the proposal. For example, the National Council for Occupational Safety and Health (National COSH) as well as the Centro de los Derechos del Migrantes pointed to the temporary service industry and the home health care industry as industries with known hazards for which OSHA and the public should have access to injury and illness data (Docket IDs 0048, 0089; see also Docket ID 0049). The AFL–CIO pointed to home health services, an industry heavily affected by COVID–19, employment services, which includes vulnerable temporary workers, and some wholesalers with rates of cases with days away from work, restricted work activity, or job transfer (DART) above 2.0 per 10,000 workers in 2020 ( e.g., NAICS 4231, 4233, 4235, 423930, 4244, 4248, 4249) as industries containing large establishments that would be newly exempted from the 300A submission requirements The AFL–CIO argued that “limiting the data these industries provide the agency would severely limit the ability to track and identify emerging workplace hazards” (Docket ID 0061).

Some commenters argued that maintaining the existing 300A reporting requirement for all large establishments is particularly important because the industries on appendix A reflect injury and illness data from the BLS SOII that is not current. Therefore, exempting industries not on appendix A could result in missing information from industries that may have become more dangerous since publication of the SOII data for 2011 to 2013. The United Steelworkers Union (USW) commented, “By tying the proposed rule to outdated and underreported injury and illness data, many employers with 250 or more employees in potentially high-hazard industries would be exempted, limiting workers' ability to make informed decisions about a workplace's safety and health. . . . These industries are currently covered by reporting requirements and many, like home health, have seen a rise in injuries and illnesses since the COVID–19 pandemic began” (Docket ID 0067). Public Citizen echoed this comment, stating that past injury rates, which are used to designate industries required to submit data, may not reflect more recent safety conditions. Public Citizen noted, in addition, that the pandemic served as a reminder “that even seemingly `low-hazard' workplaces can be the epicenter of deadly outbreaks” (Docket ID 0093).

Finally, a number of commenters underscored the value of the 300A data that is being collected from large establishments. The UFCW urged OSHA to retain the requirement for collection from all large establishments because it would allow many types of users (the public, employers, workers, researchers, and the government) to use the data “in the very positive ways that the UFCW has used it” already. The UFCW described, in its comment, the many specific ways in which UFCW has used published and union-collected illness and injury data from the OSHA Form 300A, among other information, to increase safety and health at large union-represented facilities (Docket ID 0066). Public Citizen commented that “the value of continuing to collect the information from these employers outweighs any supposed burden . . . data collected from electronic submission of injury and illness information can help identify broad patterns from small injury and illness numbers per establishment. Having this additional data from Form 300A summaries would assist with research into specific types of injuries and illnesses” (Docket ID 0093).

In addition to supporting maintenance of the requirement for submission of 300A data by large establishments, several commenters supported expanding the submission requirements for large establishments even further. For example, the National Employment Law Project (NELP) supported requiring all employers with 250 or more employees to submit information from the Form 300 Log in addition to the Form 300A. NELP argued that certain industries, such as home health care and employment services, contain very large employers that have Total Case Rates (TCRs) that are well above the private sector average. NELP therefore urged OSHA to retain as well as expand electronic submission requirements for large establishments with 250 or more employees in industries that are required to keep records under part 1904 so that researchers and other organizations could more effectively track and monitor occupational health and safety trends in home health care, employment services, and other sectors (Docket ID 0049; see also Docket ID 0089).

The Laborers' Health and Safety Fund of North America argued that OSHA should require all establishments with 250 or more employees to submit the Form 300 and Form 301, in addition to the Form 300A: “Establishments with 250 or more employees account for large contractors that work on larger construction sites that can be considered high-risk. For these reasons, establishments should be required to submit electronic OSHA 300, 300A and 301 forms to not only track injury and illness, but prove to OSHA that they are taking the steps to mitigate and prevent them from happening” (Docket ID 0080).

Having reviewed the information in the record on this issue, OSHA has decided not to make the proposed change of restricting the universe of large establishments that are required to submit data from Form 300A. Instead, the agency will maintain the requirement for all establishments with 250 or more employees that are covered by part 1904 to submit the information from their OSHA Form 300A to OSHA, or its designee, once a year. As explained by commenters, these establishments are already submitting this information, so there is no new burden for employers. Furthermore, access to the information provides multiple benefits for workers, Federal and State occupational safety and health agencies, and other interested parties. For example, continuing to collect and make this data available to the public will allow tracking of industry hazards over time, even for industries that are not on appendix A. Commenters noted that this type of tracking was particularly critical for industry segments and establishments that have injury rates higher than the rate for their 4-digit NAICS industry overall. They also noted that requiring information to be submitted from all large establishments will help blunt the effect of using SOII data that is several years old in determining which NAICS will be included on appendix A. OSHA agrees with these rationales.

Although OSHA stated in the proposal that collecting Form 300A data from this relatively small number of large establishments in lower-hazard industries is not a priority for OSHA inspection targeting or compliance assistance, OSHA is persuaded by commenters who see the value in providing such data to the public; this includes the UFCW, which has been using this data to make positive safety and health changes in large establishments. In addition, OSHA recognizes the large number of workers represented by the relatively small number of establishments that would have been affected by the proposed change and does not wish to remove resources that could be used to improve their safety and health.

OSHA acknowledges the comments supporting expansion of the final requirement by requiring submission of information from Forms 300 and 301 by all large establishments (250 or more employees) required to keep records under part 1904. However, this change would expand the universe of large establishments required to submit Form 300 and Form 301 data from about 22,000 (establishments with at least 250 employees that are in NAICS listed on appendix B) to about 40,000 (establishments with at least 250 employees that are required to keep records under part 1904), an increase of 80 percent (data are as of 2019; see https://www.census.gov/​programs-surveys/​cbp/​data/​datasets.html). OSHA does not believe, at this time, that the benefits from the additional data collection would outweigh the disadvantages of the additional time and resources that employers would have to expend to comply. OSHA also values the stability provided to employers by keeping the universe of establishments required to submit 300A data the same, in light of the multiple recent changes to OSHA's data submission requirements.

In the previous regulation, this requirement was at § 1904.41(a)(1). In the final rule, it is at § 1904.41(a)(1)(ii). This final rule will not impose any new requirements on establishments to electronically submit information from their Form 300A to OSHA. All establishments that will be required to electronically submit Form 300A information to OSHA on an annual basis under the final rule were already required to do so under the previous regulation. OSHA made only one non-substantive change in the final regulatory text; whereas the previous regulatory text at § 1904.41(a)(1) contained an example stating that data for calendar year 2018 would be submitted by the month and day listed in § 1904.41(c) of calendar year 2019, that example has been removed from the final regulatory provision at § 1904.41(a)(1)(ii). A similar, updated example is included in final § 1904.41(b)(1).

3. Restructuring of Previous Section 1904.41(a)(1) and (2) Into Final Section 1904.41(a)(1)(i) and (ii)

In the preamble to the proposed rule, OSHA asked the following question about the structure of the regulatory text containing the requirements to submit data from OSHA injury and illness recordkeeping forms: “The proposed regulatory text is structured as follows: § 1904.41(a)(1) Annual electronic submission of information from OSHA Form 300A Summary of Work-Related Injuries and Illnesses by establishments with 20 or more employees in designated industries; § 1904.41(a)(2) Annual electronic submission of information from OSHA Form 300 Log of Work-Related Injuries and Illnesses, OSHA Form 301 Injury and Illness Incident Report, and OSHA Form 300A Summary of Work-Related Injuries and Illnesses by establishments with 100 or more employees in designated industries. This is the structure used by the 2016 and 2019 rulemakings. An alternative structure would be as follows: § 1904.41(a)(1) Annual electronic submission of information from OSHA Form 300A Summary of Work-Related Injuries and Illnesses by establishments with 20 or more employees in designated industries; § 1904.41(a)(2) Annual electronic submission of information from OSHA Form 300 Log of Work-Related Injuries and Illnesses and OSHA Form 301 Injury and Illness Incident Report by establishments with 100 or more employees in designated industries. Which structure would result in better understanding of the requirements by employers?” (87 FR 18547).

OSHA did not receive many comments on this proposed alternative structure for the regulatory text. However, NIOSH noted that it preferred the second option. “NIOSH finds the second alternative . . . to be somewhat preferable. That alternative focuses first on which establishments are required to submit OSHA Form 300A, and then focuses on which establishments are required to submit OSHA Forms 300 and 301. This structure may help employers to more directly answer their questions about what forms to submit” (Docket ID 0035, Attachment 2).

OSHA agrees that the proposed alternative structure, which separates the provisions by recordkeeping form, may help employers better understand the regulatory requirements for their establishments. Based on this reasoning, as well as on OSHA's decision to retain the requirement for all establishments with 250 or more employees in industries covered by part 1904 to submit information from their Form 300A annual summary (discussed above), OSHA has decided to restructure the final regulation by recordkeeping form, rather than establishment size and industry. Therefore, in the final rule, § 1904.41(a)(1) covers the requirement to submit the OSHA Form 300A, with § 1904.41(a)(1)(i) for establishments with 20–249 employees in appendix A industries, and § 1904.41(a)(1)(ii) for establishments with 250 or more employees in industries covered by part 1904. Final § 1904.41(a)(2) covers the requirement to submit the OSHA Forms 300 and 301, as discussed below.

4. Updating Appendix A

Additionally, OSHA proposed to revise appendix A to subpart E to update the list of designated industries to conform with the 2017 version of the North American Industry Classification System (NAICS). Since OSHA revised § 1904.41 in 2016, the Office of Management and Budget has issued two updates to the NAICS codes, in 2017 and 2022. As explained in the preamble to the proposed rule, OSHA believed that the proposed update from 2012 NAICS to 2017 NAICS would have the benefits of using more current NAICS codes, ensuring that both proposed appendix A and proposed appendix B used the same version of NAICS, aligning with the version currently used by BLS for the SOII data that OSHA used for this rulemaking, and increasing the likelihood that employers were familiar with the industry codes.

As OSHA explained, this revision would not affect which industries were required to provide their data, but rather simply reflect the updated 2017 NAICS codes. For appendix A, OSHA limited the scope of this rulemaking to the proposed update from the 2012 version of NAICS to the 2017 version of NAICS. The change from the 2012 NAICS to the 2017 NAICS would affect only a few industry groups at the 4-digit NAICS level. Specifically, the 2012 NAICS industry group 4521 (Department Stores) is split between the 2017 NAICS industry groups 4522 (Department Stores) and 4523 (General Merchandise Stores, including Warehouse Clubs and Supercenters). Also, the 2012 NAICS industry group 4529 (Other General Merchandise Stores) is included in 2017 NAICS industry group 4523 (General Merchandise Stores, including Warehouse Clubs and Supercenters). As noted above, however, the establishments in these industries were already covered by the previous record submission requirements, so this would not represent a substantive change in those requirements.

The Phylmar Regulatory Roundtable (PRR) supported the proposed update from the 2012 version of NAICS to the 2017 version of NAICS for appendix A, commenting, “It is both practical and logical to align with the most recent codes from an accuracy standpoint” (Docket ID 0094). The Coalition for Workplace Safety (CWS), on the other hand, commented that using the 2017 NAICS codes for Appendices A and B when the 2022 codes have already been released by OMB will lead to confusion and mistakes, unduly complicating the proposed requirements (Docket ID 0058).

While OSHA did not propose modifications to appendix A other than the update from 2012 NAICS to 2017 NAICS, OSHA did discuss one alternative in the proposal that would affect the industries on appendix A: updating appendix A to reflect the 2017–2019 injury rates from the SOII. Appendix A is based on the SOII's injury rates from 2011–2013. This alternative would have resulted in the addition of one industry to appendix A (NAICS 4831 (Deep sea, coastal, and great lakes water transportation)) and the removal of 13 industries (4421 Furniture Stores, 4452 Specialty Food Stores, 4853 Taxi and Limousine Service, 4855 Charter Bus Industry, 5152 Cable and Other Subscription Programming, 5311 Lessors of Real Estate, 5321 Automotive Equipment Rental and Leasing, 5323 General Rental Centers, 6242 Community Food and Housing, and Emergency and Other Relief Services, 7132 Gambling Industries, 7212 RV (Recreational Vehicle) Parks and Recreational Camps, 7223 Special Food Services, and 8113 Commercial and Industrial Machinery and Equipment (except Automotive and Electronic) Repair and Maintenance).

OSHA did not receive many comments in response to this alternative. The AFL–CIO stated that the use of “outdated” SOII data to determine the industries on appendix A would lead to missing information from industries that might have become (or might become in the future) more hazardous since the time period used as the basis for appendix A (2011–2013). However, this statement was made in the context of the AFL–CIO's argument that OSHA should not restrict the large establishments required to submit 300A data to those in industries on appendix A, as OSHA proposed. Because OSHA is not adopting that approach, and instead is requiring all large establishments covered by part 1904 to continue submitting data from Form 300A, OSHA believes this concern will be minimized under the final regulatory requirements.

Having reviewed the record, OSHA has decided to update appendix A to subpart E from the 2012 version of NAICS to the 2017 version of NAICS. As the PRR commented, it is practical and logical to align the industry list in appendix A with the more recent NAICS codes (see Docket ID 0094). Indeed, employers are likely more familiar with the 2017 codes than the 2012 codes. This change would also ensure that appendices A and B use the same version of NAICS. Finally, the 2017 NAICS codes are used by BLS for the SOII data that OSHA is using for this rulemaking. While CWS stated that using the 2017 codes when the 2022 codes have already been released will cause confusion (Docket ID 0058), OSHA notes that both appendices are based on SOII data from BLS, and that no SOII data using the 2022 NAICS codes are currently available. SOII data for 2022 will not be available until November 2023. Thus, it is not possible for OSHA to base appendix A or B on SOII data that use the 2022 NAICS codes, even though the 2022 codes are the most recent ones available.

OSHA has also decided not to update appendix A using more recent SOII data. As discussed in the preamble to the proposed rule, it took several years for the regulated community to understand which industries were and were not required to submit information, and such misunderstandings could result in both underreporting and overreporting. OSHA has determined that changing the covered industries, by changing the data that forms the basis for the NAICS on appendix A, would result in additional confusion for the regulated community that is not warranted at this time. Moreover, three of the industries that would be removed from appendix A if OSHA based that appendix on updated data are also listed in appendix B, indicating that they remain hazardous under other measures. Finally, as noted above, OSHA agrees with interested parties who commented that requiring information to be submitted from all large establishments will help blunt the effect of using the older SOII data in determining which NAICS will be included on appendix A.

The final appendix A to subpart E of part 1904 (Designated industries for § 1904.41(a)(1)(i) Annual electronic submission of information from OSHA Form 300A Summary of Work-Related Injuries and Illnesses by establishments with 20–249 employees in designated industries) is as follows: ^[3]

NAICS	Industry
11	Agriculture, Forestry, Fishing and Hunting.
22	Utilities.
23	Construction.
31–33	Manufacturing.
42	Wholesale Trade.
4413	Automotive Parts, Accessories, and Tire Stores.
4421	Furniture Stores.
4422	Home Furnishings Stores.
4441	Building Material and Supplies Dealers.
4442	Lawn and Garden Equipment and Supplies Stores.
4451	Grocery Stores.
4452	Specialty Food Stores.
4522	Department Stores.
4523	General Merchandise Stores, including Warehouse Clubs and Supercenters.
4533	Used Merchandise Stores.
4542	Vending Machine Operators.
4543	Direct Selling Establishments.
4811	Scheduled Air Transportation.
4841	General Freight Trucking.
4842	Specialized Freight Trucking.
4851	Urban Transit Systems.
4852	Interurban and Rural Bus Transportation.
4853	Taxi and Limousine Service.
4854	School and Employee Bus Transportation.
4855	Charter Bus Industry.
4859	Other Transit and Ground Passenger Transportation.
4871	Scenic and Sightseeing Transportation, Land.
4881	Support Activities for Air Transportation.
4882	Support Activities for Rail Transportation.
4883	Support Activities for Water Transportation.
4884	Support Activities for Road Transportation.
4889	Other Support Activities for Transportation.
4911	Postal Service.
4921	Couriers and Express Delivery Services.
4922	Local Messengers and Local Delivery.
4931	Warehousing and Storage.
5152	Cable and Other Subscription Programming.
5311	Lessors of Real Estate.
5321	Automotive Equipment Rental and Leasing.
5322	Consumer Goods Rental.
5323	General Rental Centers.
5617	Services to Buildings and Dwellings.
5621	Waste Collection.
5622	Waste Treatment and Disposal.
5629	Remediation and Other Waste Management Services.
6219	Other Ambulatory Health Care Services.
6221	General Medical and Surgical Hospitals.
6222	Psychiatric and Substance Abuse Hospitals.
6223	Specialty (except Psychiatric and Substance Abuse) Hospitals.
6231	Nursing Care Facilities (Skilled Nursing Facilities).
6232	Residential Intellectual and Developmental Disability, Mental Health, and Substance Abuse Facilities.
6233	Continuing Care Retirement Communities and Assisted Living Facilities for the Elderly.
6239	Other Residential Care Facilities.
6242	Community Food and Housing, and Emergency and Other Relief Services.
6243	Vocational Rehabilitation Services.
7111	Performing Arts Companies.
7112	Spectator Sports.
7121	Museums, Historical Sites, and Similar Institutions.
7131	Amusement Parks and Arcades.
7132	Gambling Industries.
7211	Traveler Accommodation.
7212	RV (Recreational Vehicle) Parks and Recreational Camps.
7223	Special Food Services.
8113	Commercial and Industrial Machinery and Equipment (except Automotive and Electronic) Repair and Maintenance.
8123	Drycleaning and Laundry Services.

B. Section 1904.41(a)(2)—Annual Electronic Submission of OSHA Form 300 Log of Work-Related Injuries and Illnesses and OSHA Form 301 Injury and Illness Incident Report by Establishments With 100 or More Employees in Designated Industries

Section 1904.41(a)(2) of the final rule requires establishments that (1) had 100 or more employees at any point during the previous calendar year and (2) are classified in one of the industries listed in appendix B to subpart E of part 1904 to electronically submit certain information from their Forms 300 and 301 to OSHA or OSHA's designee. Data from the 300 and 301 forms must be submitted annually, for the previous calendar year, by March 2 (§ 1904.41(c)). The only change from the proposed rule is the deletion of the proposed rule's reference to Form 300A. That reference has been deleted from this provision because the requirements for establishments to submit Form 300A are contained in § 1904.41(a)(1)(i) and (ii) in this final rule. Comments related to the submission of Form 300A are discussed in that section. Appendix B has also changed from the proposal. Specifically, OSHA has added six industries to appendix B. All six of the industries added to appendix B have been part of appendix A since appendix A's creation in 2016.

As discussed in Section I.C, Regulatory History, in 2016, OSHA issued a final rule that required establishments with 250 or more employees that are routinely required to keep injury and illness records under part 1904 to electronically submit information from their 300 and 301 forms to OSHA once a year. However, OSHA never collected that Form 300 and 301 data, and in 2019, it issued a final rule that removed the requirement for these establishments to electronically submit that information to OSHA.

As noted above, in this rulemaking, OSHA re-proposed a requirement for certain establishments to submit information from their 300 and 301 forms to OSHA annually. The proposed provision in this rulemaking differed from the 2016 final rule in that the proposed provision would apply to establishments that (1) had 100 or more employees (rather than 250 or more employees, as in the 2016 final rule) and (2) are classified in an industry listed in appendix B to subpart E of part 1904 (rather than all industries which are required by part 1904 to keep records, as in the 2016 rule). OSHA received a wide range of comments on the proposed provision. The issues related to these comments are addressed below.

1. Covered Establishments and Industries

Like the proposed rule, § 1904.41(a)(2) of the final rule requires establishments that had 100 or more employees at any time during the previous calendar year, and that are in an industry listed in final appendix B to subpart E, to electronically submit certain information from their Form 300 and 301 to OSHA or OSHA's designee once a year. As discussed in more detail below, under final paragraph 1904.41(c), employers subject to the reporting requirement in § 1904.41(a)(2) must submit all of the required information to OSHA or OSHA's designee by March 2 of the year after the calendar year covered by the forms.

As discussed above, in 2016, OSHA issued a final rule that required all establishments with 250 or more employees in all industries routinely required to keep part 1904 injury and illness records to electronically submit information from their 300 and 301 forms to OSHA once a year. In that rulemaking, OSHA estimated that establishments with 250 or more employees covered by the submission requirement would report 713,397 injury and illness cases each year. However, the 300 and 301 data submission requirements from the 2016 final rule were never fully implemented, and OSHA never collected 300 and 301 data electronically from covered employers. In 2019, OSHA issued a final rule that removed the requirement for the annual electronic submission of 300 and 301 data to OSHA.

In the NPRM in this rulemaking, OSHA explained that in developing the requirement for establishments with 100 or more employees to electronically submit data from their OSHA Form 300 and 301, OSHA sought to balance the utility of the information collection for enforcement, outreach, and research, on the one hand, and the burden on employers to provide the information to OSHA, on the other hand (see 87 FR 18543). To achieve this balance in the proposed rule, OSHA analyzed five years of injury and illness Form 300A summary data collected through OSHA's ITA. OSHA examined combinations of establishment size and industry hazardousness that, like the 2016 final rule, would provide the agency with information on roughly 750,000 cases of injuries and illnesses per year—roughly the same burden as the case-specific requirement in the 2016 final rule. Based on this analysis, OSHA proposed a reporting requirement for establishments with 100 or more employees in 4-digit NAICS (2017) industries that:

1. had a 3-year-average Total Case Rate (TCR) in the BLS SOII for 2017, 2018, and 2019, of at least 3.5 cases per 100 full-time-equivalent employees, and

2. were included in proposed appendix A to subpart E. (All of the industries in proposed appendix B were also in appendix A).

The proposed rule listed the designated industries in proposed appendix B to subpart E.

OSHA proposed one exception to the above criteria, for the United States Postal Service (USPS), which is the only employer in NAICS 4911 Postal Services. Under the Postal Employees Safety Enhancement Act (Pub. L. 105–241), OSHA treats USPS as a private sector employer for purposes of occupational safety and health, and USPS establishments with 20 or more employees have been required to electronically submit 300A information to OSHA. However, BLS does not include USPS in the SOII. Using the 2017, 2018, and 2019 data submitted by USPS to the ITA, OSHA was able to calculate a TCR of 7.5 for NAICS 4911. Therefore, OSHA included NAICS 4911 in proposed appendix B to subpart E.

Also, in the preamble to the proposed rule, OSHA explained that the agency believed TCR, which represents the number of work-related injuries and illnesses per 100 full-time-employees during a one-year period, was the appropriate rate to use for determining the list of industries in proposed appendix B to subpart E because covered establishments would be required to electronically submit information to OSHA on all of their recordable cases, not just cases that resulted in days away from work, job restriction, or transfer. OSHA explained in the preamble that, in 2020, OSHA received submissions to the ITA of Form 300A data for 2019 from 46,911 establishments that had 100 or more employees and were in one of the industries listed in proposed appendix B to subpart E, accounting for 680,930 total recordable cases and a TCR of 3.6.

The designated industries in proposed appendix B to subpart E were as follows:

Proposed Appendix B

2017 NAICS code	2017 NAICS title
1111	Oilseed and grain farming.
1112	Vegetable and melon farming.
1113	Fruit and tree nut farming.
1114	Greenhouse, nursery, and floriculture production.
1119	Other crop farming.
1121	Cattle ranching and farming.
1122	Hog and pig farming.
1123	Poultry and egg production.
1129	Other animal production.
1141	Fishing.
1151	Support activities for crop production.
1152	Support activities for animal production.
1153	Support activities for forestry.
2213	Water, sewage and other systems.
2381	Foundation, structure, and building exterior contractors.
3111	Animal food manufacturing.
3113	Sugar and confectionery product manufacturing.
3114	Fruit and vegetable preserving and specialty food manufacturing.
3115	Dairy product manufacturing.
3116	Animal slaughtering and processing.
3117	Seafood product preparation and packaging.
3118	Bakeries and tortilla manufacturing.
3119	Other food manufacturing.
3121	Beverage manufacturing.
3161	Leather and hide tanning and finishing.
3162	Footwear manufacturing.
3211	Sawmills and wood preservation.
3212	Veneer, plywood, and engineered wood product manufacturing.
3219	Other wood product manufacturing.
3261	Plastics product manufacturing.
3262	Rubber product manufacturing.
3271	Clay product and refractory manufacturing.
3272	Glass and glass product manufacturing.
3273	Cement and concrete product manufacturing.
3279	Other nonmetallic mineral product manufacturing.
3312	Steel product manufacturing from purchased steel.
3314	Nonferrous metal production and processing.
3315	Foundries.
3321	Forging and stamping.
3323	Architectural and structural metals manufacturing.
3324	Boiler, tank, and shipping container manufacturing.
3325	Hardware manufacturing.
3326	Spring and wire product manufacturing.
3327	Machine shops; turned product; and screw, nut, and bolt manufacturing.
3328	Coating, engraving, heat treating, and allied activities.
3331	Agriculture, construction, and mining machinery manufacturing.
3335	Metalworking machinery manufacturing.
3361	Motor vehicle manufacturing.
3362	Motor vehicle body and trailer manufacturing.
3363	Motor vehicle parts manufacturing.
3366	Ship and boat building.
3371	Household and institutional furniture and kitchen cabinet manufacturing.
3372	Office furniture manufacturing.
4231	Motor vehicle and motor vehicle parts and supplies merchant wholesalers.
4233	Lumber and other construction materials merchant wholesalers.
4235	Metal and mineral merchant wholesalers.
4244	Grocery and related product merchant wholesalers.
4248	Beer, wine, and distilled alcoholic beverage merchant wholesalers.
4413	Automotive parts, accessories, and tire stores.
4422	Home furnishings stores.
4441	Building material and supplies dealers.
4442	Lawn and garden equipment and supplies stores.
4451	Grocery stores.
4522	Department stores.
4523	General merchandise stores, including warehouse clubs and supercenters.
4533	Used merchandise stores.
4543	Direct selling establishments.
4811	Scheduled air transportation.
4841	General freight trucking.
4842	Specialized freight trucking.
4851	Urban transit systems.
4852	Interurban and rural bus transportation.
4854	School and employee bus transportation.
4859	Other transit and ground passenger transportation.
4871	Scenic and sightseeing transportation, land.
4881	Support activities for air transportation.
4883	Support activities for water transportation.
4911	Postal Service.
4921	Couriers and express delivery services.
4931	Warehousing and storage.
5322	Consumer goods rental.
5621	Waste collection.
5622	Waste treatment and disposal.
6219	Other ambulatory health care services.
6221	General medical and surgical hospitals.
6222	Psychiatric and substance abuse hospitals.
6223	Specialty hospitals.
6231	Nursing care facilities.
6232	Residential intellectual and developmental disability, mental health, and substance abuse facilities.
6233	Continuing care retirement communities and assisted living facilities for the elderly.
6239	Other residential care facilities.
6243	Vocational rehabilitation services.
7111	Performing arts companies.
7112	Spectator sports.
7131	Amusement parks and arcades.
7211	Traveler accommodation.
7212	RV parks and recreational camps.
7223	Special food services.
6239	Other residential care facilities.
6243	Vocational rehabilitation services
7111	Performing arts companies.
7112	Spectator sports.
7131	Amusement parks and arcades.
7211	Traveler accommodation.
7212	RV parks and recreational camps.
7223	Special food services.

a. The Size Threshold for Submitting Information From OSHA Forms 300 and 301

Like the proposed rule, § 1904.41(a)(2) of the final rule requires establishments in industries listed in appendix B to subpart E with 100 or more employees to electronically submit certain information from their 300 and 301 forms to OSHA once a year. The size criterion of 100 or more employees is based on the total number of employees at an establishment during the previous calendar year. All individuals who are “employees” under the OSH Act are counted in the total. The count includes all full-time, part-time, temporary, and seasonal employees. For businesses that are sole proprietorships or partnerships, the owners and partners would not be considered employees and would not be counted. Other examples of individuals who are not considered to be employees under the OSH Act are unpaid volunteers and family members of farm employers (see 66 FR 5916, 6038).

In the preamble to the proposed rule, OSHA specifically requested comment on whether the threshold of 100 or more employees was the appropriate size criterion for the requirement to electronically submit data from the OSHA Form 300, 301, and 300A. OSHA also asked whether a different size criterion would be more appropriate (see 87 FR 18546).

OSHA received a number of comments on the 100-or-more-employee criterion as to the submission of OSHA Forms 300 and 301. Some commenters supported the 100-or-more threshold ( e.g., Docket IDs 0040, 0048, 0049, 0051, 0054, 0064, 0067, 0073, 0080, 0083, 0089, 0092, 0093). For example, the Council of State and Territorial Epidemiologists stated that setting the threshold at 100 employees will allow OSHA to receive more detailed information from the 300/301 forms on the nature and circumstances of injuries and illnesses (Docket ID 0040). Also, the International Union of Painters and Allied Trades/AFL–CIO commented that while they would have preferred to see the threshold for large establishments dropped even further, they recognized that the reduction from 250 to 100 from the 2016 final rule is significant and will assist their industry and others in capturing additional data (Docket ID 0073).

The National Nurses Union commented, “An OSHA rule requiring reporting from establishments with 100 or more employees is a superior threshold to the 250-employee threshold. As an example, if the establishment threshold was 250 employees, 299 hospitals in California would have had to comply with electronic reporting requirements in 2021, covering over 378,000 hospital employees. Applying a reporting rule to establishments with 100 or more employees would add an additional 73 hospitals and protect nearly 12,017 additional hospital employees in California alone. This is a significant increase in the data available on workplace hazards” (Docket ID 0064). Additionally, the Communication Workers of America commented, “We support OSHA's proposal to be inclusive of more workplaces by changing the definition of a “large” establishment to those with 100 or more employees, rather than 250 employees. We support large establishments submitting certain information from all three recordkeeping forms. . . .” (Docket ID 0092).

Other commenters opposed or questioned the 100-or-more employee threshold ( e.g., Docket IDs 0030, 0050, 0071, 0076, 0087, 0094). Of those commenters who opposed the proposed threshold, most argued that OSHA should set the threshold higher than 100 employees. For example, the Employers E-Recordkeeping Coalition (Coalition) commented that, to the extent employers in industries designated in appendix B are required to submit information from their OSHA Form 300, 301, and 300A, such a requirement should apply to employers with 250 or more employees, not employers with 100 or more employees. The Coalition asserted that, “OSHA does not appear to provide any rationale for lowering the threshold of what it considers to be “larger employers” from those with 250 or more” (Docket ID 0087). Similarly, the National Propane and Gas Association (NPGA) commented that OSHA does not explain its rationale for lowering the size threshold to 100 employees (Docket ID 0050).

OSHA agrees with commenters who supported the proposed 100-or-more-employee threshold and disagrees with commenters who stated that the employee threshold should be higher than 100 or more employees ( e.g., 250 or more employees). Increasing the threshold would reduce the number of establishments required to electronically submit information from their 300 and 301 forms, as well as decrease the number of injury and illness case reports collected by the agency. For example, increasing the size threshold from 100 or more employees to 250 or more employees would reduce the number of establishments required to electronically submit 300/301 data by 67 percent ( i.e., from 52,092 establishments to 17,106 establishments). Likewise, raising the threshold from 100 or more employees to 250 or more employees would reduce the number of reported injury and illness cases by 32 percent ( i.e., from 766,257 cases to 523,562 cases). This reduction in the amount of collected information would significantly limit OSHA's ability to identify and target hazardous occupations and workplaces. Also, a reduction in the amount of collected information would adversely impact the benefits (discussed elsewhere) of making this information available to employees, the public, and other interested parties. OSHA is concerned that an increase in the employee threshold, along with the corresponding reduction in publicly available injury and illness information, will hinder efforts to prevent occupational injuries and illnesses in the future.

Moreover, the question is more complex than merely whether to “increase” or “decrease” the establishment-size threshold, because the scope of industries required to submit the Form 300 and 301 data has also changed between the 2016 rule and this one. Under the 2016 final rule, all establishments that (1) had 250 or more employees at any time during the previous calendar year, and (2) were required to keep records pursuant to part 1904 were required to submit Forms 300 and 301. In contrast, in this rulemaking, OSHA proposed requiring establishments with 100-or-more employees to submit only if they are classified in one of the high-hazard industries listed in appendix B. This approach—lowering the establishment-size threshold to capture enough workplaces and cases to allow appropriate targeting and analysis while focusing in on particularly hazardous industries—is fully distinguishable from the agency's approach in 2016. OSHA's approach in this rulemaking focuses on higher hazard industries and provides the agency with information on more establishments, as compared to the number of establishments which would have been required to submit their Forms 300 and 301 information under the 2016 final rule. The increase in the number of establishments required to submit information, relative to the 2016 final rule, will allow OSHA to identify more places where intervention will be beneficial, including targeting its compliance assistance efforts.

Other interested parties recommended that OSHA conduct additional analysis to determine which establishments should be required to electronically submit Form 300/301 data to OSHA. For example, the American Industrial Hygiene Association (AIHA) commented, “There should be an analysis of the impact of any company size selected to report electronically. There are at least two considerations here: (1) The number of responses that will be received if the threshold is lowered to 100 (there is also a question of whether OSHA can manage an associated increase in reports); and (2) Most companies in the U.S. are small businesses and new regulations such as this can have an indirect impact on them. Will companies of this size have the capability and IT expertise to participate in electronic reporting? OSHA should conduct a thorough analysis before imposing new reporting requirements on small businesses.” (Docket ID 0030). The Sheet Metal & Air Conditioning Contractors' National Association submitted similar comments (Docket ID 0046).

OSHA agrees with AIHA that these factors are important in determining the appropriate threshold for data submission and considered them in setting the threshold. As to the first consideration noted by AIHA, the number of responses, as noted above, OSHA estimates that 52,092 establishments will be required to electronically submit Form 300/301 data each year pursuant to § 1904.41(a)(2) of the final rule. OSHA further estimates that those establishments would annually submit 766,257 injury and illness cases. In choosing the proposed threshold, OSHA sought to balance the utility of the information collection for enforcement, outreach, and research, on the one hand, and the burden on employers to provide the information to OSHA, on the other hand. And OSHA expects that the 100-employee threshold will be an easy threshold for employers to understand and keep track of. Further, as discussed in Section III.B. of this Summary and Explanation, OSHA has determined that it is capable of managing, analyzing, and utilizing the data it will receive pursuant to this requirement.

As to AIHA's second factor, whether establishments with 100 or more but fewer than 250 employees have the capability and IT expertise to participate in electronic reporting, OSHA has also determined that such establishments are capable of submitting these reports to OSHA. Significantly, because the industries that appear in appendix B are a subset of those in appendix A and the previous version of § 1904.41(a)(2) required all establishments with 20–249 employees which are classified in an industry listed in appendix A to submit information from their Form 300A annually to OSHA, all of the establishments which would be required to submit information from their Forms 300 and 301 to OSHA under the proposal were already required to submit information from their Forms 300A. In other words, the establishments covered under the proposal (and this final rule) already have experience submitting (and thus the ability to submit) such data to OSHA electronically. For more details on this issue, see Section IV, Final Economic Analysis.

OSHA also received comments questioning its preliminary decision to use establishment size as a threshold criterion. For example, the National Safety Council (NSC) supported a risk-based approach, commenting that larger operations are not inherently less safe and that OSHA should move to a risk- based approach to protect workers. It argued, “OSHA should evaluate factors like the degree of the hazard, the magnitude of exposure (number of workers exposed and duration of exposure), and the relative risk at the site (likelihood of an incident based on current hazards and the level of controls being applied to those hazards and past experience). These data points should govern reporting requirements and guide OSHA inspections, consulting and compliance resources.” (Docket ID 0041).

OSHA agrees that using a risk-based approach to collecting data can be valuable. Indeed, as discussed in Section III.B.14.c in this Summary and Explanation, OSHA anticipates this to be one of the benefits of the data collection for the agency. That is, the data collection will provide OSHA with establishment-specific, case-specific information the agency can use to evaluate risk factors and guide OSHA activities based on risk factors. However, in order to obtain this information, OSHA must first set the criteria for collecting the information, through this final rule. Risk is one of the reasons the agency proposed using a Forms 300 and 301 data collection criteria based on industry hazard level as well as establishment size, i.e., it is reasonable to assume that establishments in industries with higher injury/illness rates are higher-hazard industries with higher risks. As discussed elsewhere in this preamble, the list of higher-hazard industries in final appendix B to subpart E is based on several criteria, including the analysis of average injury and illness rates over several years. OSHA believes this approach represents a practical way of evaluating risks and hazards in specific industries. OSHA also believes it would be difficult to calculate an appropriate employee threshold based on the degree of hazard or the magnitude of exposure at individual establishments, especially when such case-specific data are not now available to the agency. Moreover, OSHA expects that including a numerical threshold of 100 or more employees is easier for employers to understand and provides certainty for the regulated community. The inclusion of a numerical threshold with or without an additional industry criterion is a familiar part of OSHA's recordkeeping regulations (see, e.g.,29 CFR 1904.1(a)(1); previous 29 CFR 1904.41(a)(1)–(2)). Further, OSHA believes that the 100-employee threshold balances the burden on employers with the benefits to worker safety and health.

Other commenters questioned OSHA's proposed 100-employee threshold because the agency did not choose that threshold in the 2016 rulemaking. For example, the Coalition pointed out that “OSHA considered a lower threshold of 100 or more employees, and expressly denied that approach in the 2016 rulemaking” (Docket ID 0087). In response to this comment, OSHA notes that the alternative (Alternative E) in the 2013 NPRM (the NPRM which lead to the 2016 final rule) to which the Coalition refers differs from the requirement OSHA proposed in this rulemaking. Specifically, with regard to Forms 300 and 301, Alternative E would have required all establishments which were required to keep records and had 100 or more employees at any time during the previous calendar year to submit Form 300 and 301 data to OSHA annually (see 78 FR 67264, 67281). However, in this rulemaking, OSHA proposed for only a subset of establishments with 100 or more employees ( i.e., those whose industries appear on appendix B) to submit the data. OSHA estimated that it would receive 1,170,000 injury and illness cases with incident report (OSHA Form 301) and Log (OSHA Form 300) data under Alternative E (81 FR 29636). OSHA further estimated that 120,000 establishments would have been required to submit data under the alternative (81 FR 29636). Ultimately, in 2016, OSHA agreed with commenters who stated that reducing the size criterion to 100 would increase the burden on employers with diminishing benefit.

OSHA's 2016 decision to reject Alternative E was based on the employer burden and benefits under that alternative. As discussed above, under this rule, OSHA estimates that only 52,092 establishments will be required to electronically submit Form 300/301 data each year and those establishments would annually submit only 766,257 injury and illness cases. Thus, an estimated 67,908 fewer establishments will be required to submit data under this rule, as compared to the estimate of those that would have been required to submit under Alternative E in the 2016 final rule, and approximately 403,000 fewer cases are estimated to be submitted than were estimated to have been submitted under that alternative. The number of cases estimated to be submitted under this final rule is similar to that which was estimated to have been required to be submitted under the 2016 final rule (720,000 in 2016). Consequently, OSHA finds that its rejection of Alternative E in the 2016 rulemaking has no bearing on its decision to use a 100-employee threshold in this rulemaking. In fact, the agency's finding that it could handle data from 720,000 cases in 2016 actually supports its finding that it can handle a similar number of records in this rulemaking.

The Phylmar Regulatory Roundtable (PRR) objected to OSHA's proposed 100-or-more-employee threshold for a different reason than the above commenters. Specifically, it maintained that the requirement for establishments with 100 or more employees in certain industries could result in inaccurate or misleading information. In support of this point, it stated that “an establishment with few employees may have a high case rate purely based on numbers which is not reflective of workplace hazards or employer commitment. High injury and illness rates are not an automatic indication that the company or establishment is operating an unsafe environment” (Docket ID 0094).

OSHA disagrees with PRR's assertion about the 100-or-more employee threshold resulting in misleading information. While a small number of injuries or illnesses could have a disproportionate effect on incidence rates in an establishment with a small number of employees, this is unlikely in larger establishments with 100 or more employees. Incidence rate of injuries and illnesses are computed from the following formula: Incidence rate per 100 full-time employees = (Number of injuries and illnesses × 200,000)/Employee hours worked. The 200,000 figure in the formula represents the number of hours 100 employees working 40 hours per week, 50 weeks per year would work, and provides the standard base for calculating incidence rate for an entire year. Mathematically, the effect of a small change in the numerator (number of injuries and illnesses × 200,000) on the incidence rate becomes smaller as the denominator (employee hours worked) becomes larger, and the more employees there are, the larger the denominator will tend to be. Two recordable injuries or illnesses instead of one, at an establishment with 20 full-time employees, would increase the TCR from 5.0 to 10.0; in contrast, at an establishment with 100 full-time employees, the TCR would only increase from 1.0 to 2.0. As discussed above, the TCR threshold for industry inclusion in Appendix B is 3.5; an establishment with 100 full-time employees would have to have at least 4 recordable injuries in a year to exceed this threshold. In addition, as discussed elsewhere, OSHA plans to publish narrative information from the Form 300 and 301 (after identifying and removing information that could reasonably be expected to identify individuals directly), which will enable the users of the data to determine the relevance of the data. In fact, OSHA believes that the inclusion of more information about the specific cases (rather than the summary information from Forms 300A) will mitigate against potential misunderstandings, because the public can use that information to determine the circumstances that led to the injury or illness ( e.g., through showing that a particular injury or illness occurred for a reason other than a hazard in the work environment). This is further discussed below in Section III.B.4 of this Summary and Explanation, which also explains additional steps OSHA plans to take to provide information to the public to aid their understanding of the data.

OSHA also received a comment from NPGA opposing the proposed 100-or-more employee threshold because it is not included in any other portion of OSHA's recordkeeping regulations (Docket ID 0050). NPGA's statement is accurate: OSHA's proposal in this rulemaking is the first time OSHA has specifically tied a part 1904 recordkeeping requirement to a 100-or-more-employee threshold. However, OSHA does not think the presence of a new threshold is problematic. As stated above, a 100-employee threshold is easy for establishments to understand and balances OSHA's need for the data with the burden on establishments. Moreover, OSHA expects that establishments are familiar with this threshold from their experience with other Federal standards. For example, private sector employers with 100 or more employees are required to file an EEO–1 Component 1 Report with the Equal Employment Opportunity Commission (EEOC) and the Office of Federal Contract Compliance Programs (OFCCP), U.S. Department of Labor, every year (see 42 U.S.C. 2000e–8(c); 29 CFR 1602.7–.14; 41 CFR 60–1.7(a)).

Other commenters maintained that the 100-employee threshold was not inclusive enough. For example, the AFL–CIO commented that if OSHA did not adopt its recommendation to require all establishments with 100 or more employees to submit data from all their recordkeeping forms (rather than establishments with 100 or more employees which are also classified in an industry listed in appendix B) (comment and OSHA's response discussed below), then OSHA should adopt the provisions contained in the 2016 final rule ( i.e., require all establishments with 250 or more employees to submit data from Forms 300A, 300, and 301). It argued that “[a]t a minimum” OSHA should require establishments with 250 or more employees to submit data from the Forms 300A and 300 (Docket ID 0061). The United Food and Commercial Workers International Union submitted a similar comment (Docket ID 0066).

OSHA disagrees with commenters who suggested that OSHA should adopt a threshold below 100 or more employees or eliminate the threshold completely. OSHA acknowledges commenters who stated that a lower threshold would result in an increase in the amount of injury and illness data collected by the agency. However, the agency notes that any reduction in the employee size threshold would increase the number of establishments required to electronically submit Form 300 and 301 data, and this would result in an increased burden to smaller employers. Again, the agency chose the 100-employee threshold by balancing the utility of the information collection for enforcement, outreach, and research, on the one hand, and the burden on employers to provide the information to OSHA, on the other hand. The 100-employee threshold will provide enough case-specific information, about enough establishments, for wide-spread targeted outreach and enforcement while minimizing the burden on employers, especially smaller employers, as required by Section 8(d) of the OSH Act. In addition, OSHA notes that the 100-or-more-employee threshold is appropriate since larger establishments typically have more resources to support electronic submission of case-specific injury and illness information to OSHA. OSHA also finds that the 100-or-employee threshold is appropriate because there is a lesser risk of employee reidentification from information published regarding larger establishments. (For more information on this issue, see the discussion of indirect identification in Section III.B of this Summary and Explanation.)

In summary, after considering the entire record on the issue of the size threshold for submitting OSHA Form 300 and 301 data, OSHA agrees with commenters who supported the 100-or-more-employee threshold for determining which establishments must electronically submit information from their 300 and 301 forms. The 100-or-more-employee threshold will allow OSHA to strike an appropriate balance between the total number of establishments required to submit case-specific data to OSHA and the total number of injury and illness cases collected, on the one hand, with burden on employers (especially smaller employers) on the other. As discussed above, as well as in Section IV, Final Economic Analysis, OSHA believes that establishments with 100 or more employees have the necessary personnel and IT resources to comply with the electronic submission requirement in final § 1904.41(a)(2). By setting the threshold at 100 or more employees and limiting the covered industries to the higher hazard industries listed in final appendix B to subpart E, the agency is focusing its data collection efforts in a more targeted manner. This approach is consistent with OSHA's stated intention in the preamble to the proposed rule to balance the utility of the information collection for enforcement, outreach, and research, on the one hand, and the burden on employers to provide the information to OSHA, on the other hand.

Accordingly, like the proposed rule, final § 1904.41(a)(2) requires establishments with 100 or more employees that are in the designated industries listed in appendix B to subpart E to electronically submit data from their 300 and 301 forms to OSHA once a year.

b. The Criteria for Determining the Industries in Appendix B to Subpart E

As stated above, OSHA proposed to require establishments with 100 or more employees at any time during the previous calendar year to annually submit their Form 300 and 301 if they are in an industry listed in proposed appendix B to subpart E. The criteria for including the designated industries in proposed appendix B to subpart E was based on a three-year average rate of Total Case Rate (TCR) in the BLS SOII for 2017, 2018, and 2019, of at least 3.5 cases per 100 full-time-employees. In the preamble to the proposed rule, OSHA requested comment on whether TCR is the appropriate method for determining the list of industries in proposed appendix B to subpart E. In addition, OSHA specifically asked, “Is Total Case Rate (TCR) the most appropriate incidence rate to use for proposed appendix B to subpart E, or would the Days Away Restricted or Transferred (DART) rate be more appropriate?” (87 FR 18546).

The TCR represents the number of work-related injuries and illnesses per 100 full-time-employees during a one-year period. It is based on all work-related injuries and illnesses recorded on the OSHA 300 Log resulting in death, days away from work, work restriction or transfer to another job, and other recorded cases ( e.g., cases resulting in medical treatment beyond first aid). On the other hand, the DART rate is based only on the number of work-related injuries and illnesses recorded on the OSHA 300 Log resulting in days away from work, restricted work activity or transfer to another job.

A number of commenters opined on the appropriate criteria for determining the industries designated in appendix B to Subpart E. Many of these commenters supported the proposed use of the TCR ( e.g., Docket IDs 0030, 0040, 0047, 0048, 0054, 0064, 0066, 0084, 0089). For example, AIHA indicated its support for using the TCR in the final rule, adding that, “All incident rate metrics suffer from inaccuracy due to a lack of understanding of complex and intricately nuanced recording rules. The TCR is the most widely used and least misunderstood of these measures in the United States” (Docket ID 0030). Also, the National Nurses Union stated that TCR is a more appropriate metric than a DART-rate-only metric because it includes all types of recorded injuries and illnesses, not just those where an employer gave an injured or ill employee “time to rest and recover” (Docket ID 0064).

Other commenters argued against OSHA's proposed use of the TCR and for the use of a DART-rate metric. For example, the International Bottled Water Association (IBWA) and the Coalition asserted that, per OSHA's preamble, “[a]ppendix B is meant to reflect employers in higher hazard industries. While a higher DART may reflect such industries to some extent, a higher TCR does not. This is because the TCR captures relatively minor incidents—those that do not result in days away from work, job restriction, or transfer” (Docket IDs 0076, 0087). Both of these commenters expressed concern that “for example, under the proposal, employers in industries with very few or no 'major' incidents ( i.e., those that result in days away from work, job restriction, or transfer), but a larger number of 'minor' incidents will unfairly be included in [a]ppendix B” (Docket IDs 0076, 0087). On the other hand, other commenters, such as AIHA, argued against the use of the DART rate (Docket ID 0030).

Other commenters suggested other possible metrics in their comments. For example, NIOSH commented, “TCR may be the most appropriate single criterion for selection of industries; however, NIOSH believes that DART (Days Away, Restricted, or Transferred) and fatality rates are also valuable for determining the magnitude of injury risks in specific industries. There are two basic reasons why some industries would rank differently based on TCR than they would on DART or fatality rate. First, the nature of work differs among industries and can result in different ratios of mild to severe injuries. While the TCR represents mostly relatively mild injuries, the severest injuries are the most important targets of prevention and account for a very large share of the costs of injuries in the workers' compensation system. Second, some industries may more fully report injuries than others and so tend to have a higher ratio of TCR to DART or fatality rate.” (Docket ID 0035, Attachment 2). The International Brotherhood of Teamsters concurred with NIOSH's comment (Docket ID 0083). AIHA offered a fourth possible metric: cases with days away, observing, “One other candidate, cases with days away, is perhaps the most intuitive metric and most closely (though not exactly) aligned with workers' compensation systems” (Docket ID 0030).

Finally, AFL–CIO “urge[d] OSHA to require all large establishments with 100 or more employees, currently subject to recordkeeping standards, to electronically report detailed injury and illness information . . . as the value of these data has been thoroughly explained by the agency and record of evidence in the 2016 final rule” (Docket ID 0061). In other words, AFL–CIO asked OSHA to revise the proposed provision to eliminate the requirement that only those establishments in industries listed in appendix B would be required to report. In AFL–CIO's recommendation, the only limitations would be establishment size and being routinely required to keep injury and illness records under part 1904.

Having reviewed the information in the record, OSHA rejects AFL–CIO's suggestion to require all large establishments with 100 or more employees (without regard to industry hazardousness) to submit information. In the provisions related to the electronic submission of Forms 300 and 301, OSHA has decided that it is appropriate to focus on the most hazardous industries. Such a focus is a regular feature of OSHA's recordkeeping regulations. For example, since 1982, OSHA has exempted some low-hazard industries from maintaining injury and illness records on a regular basis (see https://www.osha.gov/​enforcement/​directives/​cpl-02-00-135). This partial exemption for low-hazard industries currently appears in 29 CFR 1904.2. Similarly, since the 2016 final rule, OSHA has only required establishments with 20 or more employees but fewer than 250 employees to submit information from Form 300A if those establishments are classified in an industry listed in appendix A to subpart E to part 1904, i.e., if they are higher hazard industries.

Focusing some recordkeeping requirements on higher hazard industries has the benefit of enabling OSHA to better focus its attention where it might have the highest impact, and lessens the burden on less hazardous industries. OSHA finds that such a balance is appropriate. Moreover, the agency will continue receiving information from Form 300A from all recordkeeping establishments with 250 or more employees. If the information from submitting establishments' Forms 300A, or from the BLS SOII and/or Census of Fatal Occupational Injuries (CFOI), were to indicate that industries not listed on appendix B were becoming more hazardous, OSHA could consider engaging in notice-and-comment rulemaking to update appendix B. Further discussion on the possibility of updating appendix B appears below in this section of the Summary and Explanation.

As to the appropriate criteria, OSHA has decided to use several data sources to populate the list of higher hazard industries in final appendix B to subpart E. Specifically, OSHA finds that the TCR, the DART rate, and the fatality rate are all important methods of identifying higher hazard industries. As noted by some commenters, while it is widely used in the United States and includes all types of recorded injuries and illnesses, the TCR also includes data concerning less severe injuries and illnesses ( i.e., cases that resulted in medical treatment beyond first aid but did not involve loss of consciousness and/or did not result in restricted work or transfer to another job, days away from work, or death). OSHA still considers the TCR to be an appropriate rate to use for determining the list of industries in appendix B to subpart E, especially since covered establishments will be required to electronically submit information to OSHA on all their recordable cases ( i.e., total cases). However, OSHA also agrees with commenters who suggested that information specifically about severe injuries and illnesses is a reliable indication of whether a specific industry is a high hazard industry. As NIOSH noted, the nature of work differs among industries, and this can result in different ratios of less severe and more severe injuries and illnesses.

Accordingly, OSHA has decided to use the DART rate and the fatality rate in the BLS CFOI in addition to the TCR. Adding the DART rate, which measures severe injuries and illnesses resulting in days away from work, restricted work activity, or transfer to another job, will ensure that industries with higher rates of severe injuries are included, while using the TCR will ensure that OSHA is capturing industries with higher injury and illness rates overall (including less severe injuries and illnesses and, as discussed by NNU, more serious injuries and illnesses in establishments where an employer does not give the injured or ill employee “time to rest and recover”) (see Docket ID 0084).

Adding the fatality rate will also be helpful because fatalities are more consistently reported than other injuries and illnesses. CFOI produces comprehensive counts of workplace fatalities in the United States. It is a Federal-State cooperative program that has been implemented in all 50 States and the District of Columbia since 1992. To compile counts that are as complete and accurate as possible, the census uses multiple sources to identify, verify, and profile fatal worker injuries. CFOI includes specific information about each workplace fatality, including information about occupation and other worker characteristics, equipment involved, and circumstances of the event. All of the information in the CFOI is obtained by cross-referencing the source records, such as death certificates, workers' compensation reports, and Federal and State agency administrative reports. To ensure that fatalities are work-related, cases are substantiated with two or more independent source documents, or a source document and a follow-up questionnaire. The CFOI fatality rate is based on the number of deaths per 100,000 full-time-or-equivalent employees. Adding the fatality rate from CFOI to the metrics used to determine which industries should report in this final rule allows OSHA to obtain data from industries with low non-fatal injury and illness rates but high fatality rates.

OSHA does not think that the metric offered by AIHA (cases with days away, or DAFW) is appropriate for this rulemaking. The DAFW rate is a subset of the DART rate. It does not include cases in which an ill or injured employee continues to work but is engaged in restricted activities or job transfer. This is obviously more possible in some establishments and industries than in others. For example, there might be no alternative for restricted work or job transfer at a nursing care facility for a patient-care worker who is unable to perform their regular job duties due to an injury; thus, the injury would result in a DAFW case. In contrast, it might be possible to temporarily reassign an injured production-line worker to a different job on the production line that accounts for the restrictions due to the injury; thus, the injury would not result in a DAFW case. However, both injuries—the days away from work case, as well as the restricted activities/job transfer case—would be DART cases. Thus, the DART rate is a better indicator of hazardousness across establishments and industries.

Given the concerns raised by commenters about specific injury and illness rates, and in order to accurately identify higher hazard industries, OSHA decided to use several factors in determining the list of industries in final appendix B to subpart E. In addition to using the TCR, OSHA analyzed industry hazardousness based on the DART rate and the fatality rate. OSHA believes that using this approach more comprehensively identifies higher hazard industries. The agency also finds that this combination of factors furthers the agency's intention of balancing the number of establishments covered and injury and illness cases reported with the burden on employers, as well as not expanding the submission requirement beyond establishments that are already required to report information from the Form 300A. OSHA again notes that all of the industries in final appendix B to subpart E are also included in final appendix A to subpart E.

c. Cut-Off Rates for Determining the Industries in Appendix B to Subpart E

Having determined the appropriate metrics (TCR, DART, and fatality rates), OSHA now turns to the appropriate cut-off rates for selecting the designated industries in appendix B to subpart E using the chosen metrics. As discussed above, OSHA proposed including those industries which had a 3-year-average rate of total recordable cases (Total Case Rate, or TCR) in the BLS SOII for 2017, 2018, and 2019, of at least 3.5 cases per 100 full-time-equivalent employees. Some commenters argued that the proposed cut-off (3.5 per 100 workers) was too low ( e.g., Docket IDs 0054, 0076, 0087). For example, the Employers E-Recordkeeping Coalition (“Coalition”) argued that, whether the DART or TCR rate is used, “OSHA should establish a higher threshold value than it proposes.” The Coalition explained that the proposed threshold TCR value of 3.5 was based on BLS SOII data for 2017, 2018, and 2019, but that “BLS data—specifically data representing the highest rates for cases with days away from work, restricted work activity, or job transfer (DART)—from the same time period (2017, 2018, 2019) demonstrates that the lowest incidence rate was 4.2.” It further observed, “Similarly, even if use of the TCR for purposes of determining those industries that should be included in [a]ppendix B is maintained in the final rule, a higher threshold value should be used. According to BLS data representing highest rates for total cases from the same time period (2017, 2018, 2019), the lowest incidence rate was 6.8. . . Accordingly, to the extent the TCR is used for purposes of determining those industries that should be included in [a]ppendix B, the threshold value should be set at no less than 6.8. ” (Docket ID 0087). IBWA submitted a similar comment (Docket ID 0076). Additionally, Dow Chemical Company argued that OSHA should use a TCR “triggering” rate that is substantially higher than the private industry average for full time equivalent workers (which was 2.8 in 2019 and 2.7 in 2020). Dow explained, “This will reduce the burden on industry sectors who have a TCR at or below private industry average” (Docket ID 0054).

Other commenters suggested that the proposed cut-off of 3.5 was too high ( e.g., Docket IDs 0037, 0047, 0048, 0049, 0066, 0069, 0079, 0084). Several commenters urged OSHA to include more industries in appendix B by lowering the cut-off to the three-year national average for private industry. These commenters expressed concern about many hazardous workplaces and high-risk occupations in industries that are above the national average for private industry but below the proposed 3.5 cut-off, including many industries with establishments operated by the nation's major employers (Docket IDs 0030, 0047, 0048, 0049, 0066, 0069, 0084). For example, the Strategic Organizing Center (SOC) “applaud[ed] OSHA's decision to lower the employment threshold for report[ing] the 300/301 data . . . [but] urge[d] OSHA to reject the use of such a high rate threshold for the inclusion of the specific industry codes” (Docket ID0079). In support of this recommendation, SOC argued that OSHA had not justified the proposed TCR level other than projecting that it would result in a volume of cases (roughly 750,000) similar to the 2016 rule (Docket ID 0079).

With regard to the appropriate value for triggering the inclusion of industries in appendix B to subpart E, the final rule, like the proposed rule, has a cut-off of 3.5 cases per 100 employees. As reflected in the comments, the 3.5 cut-off value, which OSHA proposed, represents a balance between more information and more employer burden with a lower cut-off, and less information and less employer burden with a higher cut-off. For example, the cut-offs suggested by the Employers E-Recordkeeping Coalition in their comment (Docket ID 0087) would only result in the submission of an estimated 90,395 cases from 3,087 establishments (using the 6.8 TCR rate taken from BLS table 19SNR01 “Highest incidence rates of total nonfatal occupational injury and illness cases”, 2019) or an estimated 72,143 cases from 3,946 establishments (using the 4.2 DART rate taken from BLS table 19SNR02 “Highest incidence rates of nonfatal occupational injury and illness cases with days away from work, restricted work activity, or job transfer”, 2019).^[4] The Coalition's proposal would severely restrict the list of industries which would be required to submit data pursuant to this rulemaking, which would, in turn, restrict OSHA's ability to target its enforcement and compliance assistance efforts beyond that small subset of industries. It would also limit the information available to interested parties for occupational safety and health purposes, e.g., to evaluate occupational safety and health trends and patterns. Consequently, it would drastically decrease the benefits of the rule.

In addition, for this final rule, OSHA has chosen to use a DART rate of 2.25 per 100 employees and CFOI fatality rate of 5.7 deaths per 100,000 full-time-or-equivalent employees) to identify higher hazard industries. Both represent 1.5 times the national average for private industry for the respective rates. OSHA believes that these thresholds, which are well above the national averages for private industry, represent an appropriate cut-off for determining whether a given industry is a higher hazard industry. As discussed below, adding the DART criterion and the CFOI fatality criterion adds 6 industries to Appendix B (3 per criterion) that are below the TCR threshold; this addresses, to some degree, the concerns expressed by commenters about hazardous workplaces that are below the TCR threshold.

Moreover, OSHA projects that the use of these cutoffs will enable it to receive Form 300 and 301 data on approximately 750,000 cases of injuries and illnesses per year. Based on the record of the 2016 rulemaking, OSHA determined that roughly this amount of cases would provide OSHA and others with sufficient information to make workplaces safer, while not overburdening employers (see 87 FR 18543). Nothing in the record of this rulemaking, or the comments OSHA had received in the 2019 rulemaking, has convinced OSHA that a different balance should be struck in this rule. However, as discussed above, the agency has tailored the collection to industries and establishments where the information would be most useful for improving workplace safety and health.

OSHA only proposed including industries in appendix B if they also appeared in appendix A; establishments with 20 or more employees in industries in appendix A have already been required to electronically submit information from their Form 300A since 2017. OSHA did not receive any comments objecting to this part of the proposal and has decided to retain this requirement in the final rule. However, several interested parties argued that additional appendix A industries should be listed in appendix B.

For example, the AFL–CIO commented that the proposed exclusion for large establishments in certain industries from appendix B, “which further limits the ability to identify trends among workplace hazards in high risk industries,” means that a significant number of industries will not be required to electronically submit OSHA Form 300 and 301 data to OSHA, including all of the utility sectors and almost all of the construction industry[,]” as well as a number of other industries with large establishments (Docket ID 0061). The Communications Workers of America commented that appendix B, like appendix A, should include all industries in the manufacturing sector (Docket ID 0092). SOC similarly characterized OSHA's proposal to limit the requirement to submit Forms 300 and 301 to industries with a TCR of at least 3.5 as a decision to “arbitrarily exclude entire hazardous industries from the revised reporting requirement.” In particular, SOC objected to the exclusion of the hotel industry, which, based on an analysis by the National Employment Law Project, SOC believes is a high hazard industry (Docket ID 0079).

The AFL–CIO also commented that the industry exclusions from appendix B should not be based on BLS SOII data, because the data are an inadequate measure of industry hazardousness. It argued that SOII data, even recent three-year averages, is not an effective way to ensure that high-hazard industries are captured consistently in the data. The AFL–CIO further asserted that, “[R]elying on these data to create exclusion criteria ignores the known limitations of current workplace injury and illnesses data. Over the last decade, studies have documented that the BLS injury and illness survey fails to capture an estimated 33–69% of work-related injuries. Some of the undercount has been attributed to injuries and illnesses excluded from the BLS survey's scope and the design of the survey.” (Docket ID 0061).

In response, OSHA notes that there is no express exemption for specific industries in appendix B to subpart E. The list of industries in final appendix B is based on objective injury and illness data indicating that a specific industry is a higher hazard industry. Any exclusion or omission from the list of designated industries in final appendix B is solely the result of a given industry not meeting the higher hazard industry criteria specified above, criteria which have been expanded under this final rule based on public comments. Moreover, OSHA disagrees with SOC's characterization of its preliminary decisions regarding the industries included on appendix B as “arbitrar[y]” (Docket ID 0079). As stated throughout the preamble to this final rule, in proposing a higher hazard cut-off level, the agency was seeking to balance the utility of the information collection for enforcement, outreach, and research, on the one hand, with the burden on establishments on the other. That is not to say that the agency found that it would be economically infeasible for industries other than those listed on proposed or final appendix B to submit their Form 300 or 301 data. Indeed, no such finding is required here. Rather, OSHA looked to see what amount of information would be useful, considering the number of establishments that would be reporting under the final rule, the number of cases that would be submitted, the agency's capacity to review such information, and the benefits that would stem from the collection. The agency has determined that at the current time, requiring larger, high hazard establishments to submit their data can make a substantial impact on worker safety and health, and the benefits of making other employers do so as well is less certain. OSHA has decided to focus the rule on the establishments in industries in which additional information has the most promise of addressing serious workplace hazards. Further, OSHA notes that it will continue to receive 300A data from very large establishments (those with 250 or more employees) in all industries required to keep records under part 1904 and can continue to use those data for targeting purposes as well. OSHA will monitor the data it receives, and in the future, it may consider new notice-and-comment rulemaking to adjust its approach in light of its experience with the data collected under this final rule.

In addition, OSHA disagrees with the comment from the AFL–CIO that BLS SOII data are not a reliable method for measuring industry hazardousness. While BLS and its research partners have conducted multiple studies which indicate that SOII fails to capture some cases, the BLS SOII is an important indicator of occupational safety and health and is the only source of national-level data on nonfatal injuries and illnesses that spans the private sector and State and local governments. Accordingly, OSHA is not making any adjustments to the proposed appendix B industries based on these comments. However, as discussed in more detail below, OSHA notes that the application of the updated criteria for inclusion on appendix B has led to six new industries being added to appendix B. These industries include NAICS 1133, Logging, NAICS 4853, Taxi and Limousine Services, and NAICS 4889, Other Support Activities for Transportation—all industries that AFL–CIO identified as industries with large establishments not included in proposed appendix B that “should be required to submit the injury and illness data they are already required to collect” (Docket ID 0061). Consequently, the final rule responds to AFL–CIO's comment in part by adding three additional NAICS codes based on the objective criteria in this final rule.

d. Using the Most Current Data To Determine Designated Industries

In the preamble to the proposed rule, OSHA stated that the agency anticipated that more current industry-level injury and illness data from BLS, as well as more establishment-specific injury and illness information from the ITA, would become available. OSHA therefore explained that the agency may rely on the most current data available, as appropriate, for determining the list of industries in appendix B to subpart E. OSHA sought comment from the public on whether the agency should use the most current data when developing the final rule (see 87 FR 18543).

The Phylmar Regulatory Roundtable (PRR) Occupational Safety and Health, OSH Forum commented that while it agrees with the concept that the most up-to-date information is the most accurate and should determine the list of industries, OSHA should not include any new industries in appendix B to subpart E in the final rule. According to this commenter, doing so would not allow impacted industries the opportunity to comment on such significant changes. Also, PRR recommended that any additions to the list of industries (or sub-sets of industries) in appendix B that result from OSHA analyzing updated data should be conducted through notice and comment rulemaking (Docket ID 0094).

In response, OSHA agrees with PRR that the list of higher hazard industries in appendix B to subpart E should be based on data that was available at the time of the proposed rule. OSHA notes that, although the criteria used for determining the list of higher hazard industries in appendix B has been modified for the final rule, all of the data used to develop those criteria were available at the time of the proposed rule. Specifically, the cut-off threshold used for the TCR rate is based on a 3-year-average from 2017, 2018, and 2019, the cut-off threshold for the DART rate is based on a 3-year-average from 2017, 2018, and 2019, and the cut-off threshold for the fatality rate is based on data from 2019.

Additionally, in the preamble to the proposed rule, OSHA stated that during the 2016 rulemaking, the agency agreed with commenters who stated that the list of designated industries (listed in appendix A at that time) should not be updated each year. OSHA explained that moving industries in and out of the appendix each year would be confusing. OSHA also stated that keeping the same industries in the appendix each year would increase the stability of the system and reduce uncertainty for employers. Accordingly, OSHA did not, as part of the 2016 rulemaking, include a requirement to annually or periodically adjust the list of designated industries to reflect more recent BLS injury and illness data. OSHA also committed that any such revision to the list of designated industries in the future would require additional notice and comment rulemaking (see 87 FR 29641). However, OSHA again raised the issue of periodic updating of the designated industries in appendix B to subpart E in the preamble to the proposed rule in this rulemaking (see 87 FR 18543). Specifically, in Alternative #2, OSHA explained the above information regarding its decision in the 2016 rulemaking, explained that it “could regularly update the list of designated industries in proposed appendix B (industries where establishments with 100 or more employees must submit information from the Form 300 and 301 as well as the 300A)—for example, every 6 years, to align with the PRA approval periods,” and then welcomed comment on this issue (87 FR 18543).

OSHA received several comments on this issue. In its comments, Dow stated that it did not support the regular updating of the list of designated industries proposed in appendix B. Dow argued, “Revising this list and moving employers in and out would be extremely confusing and introduce unneeded instability into the data collection process. If the list of designated industries in appendix B were to be revised, OSHA must provide notice and a rulemaking comment period” (Docket ID 0054). In contrast, PRR commented that, if OSHA's assumption that the collection of establishment-specific data will reduce injury and illness rates, then the agency should be able to analyze data for the designated industries and consider updating and removing industries from the appendices (Docket ID 0094).

OSHA agrees with the comments stating that the list of designated industries in appendix B to subpart E should not be updated on a regular basis. As in the 2016 rulemaking, OSHA finds that moving industries in and out of appendix B to subpart E on a periodic basis would be confusing for employers. Employers are less likely to encounter confusion when trying to determine whether their establishments are required to electronically submit data to OSHA if the list of industries in appendix B remains stable; appropriate future adjustments, if any, would be accomplished through notice and comment rulemaking. OSHA also believes that keeping the same industries in appendix B to subpart E will increase the stability of the electronic submission system and increase compliance with the submission requirement. Accordingly, OSHA will not, as part of this rulemaking, include a provision for the regular or periodic updating of the list of industries in appendix B to subpart E.

In making this decision, OSHA acknowledges that industries' injury and illness rates may change. As PRR commented, OSHA expects that this rulemaking will aid in the decrease in such rates. If OSHA's ongoing analyses of injury and illness rates show a decrease in injuries and illnesses in particular industries included on appendix B, then OSHA may consider removing those industries from appendix B. Similarly, if OSHA learns that injury and illness rates in industries that are not included on appendix B are rising, then OSHA may consider adding those industries to appendix B. However, in either case, OSHA would propose any such change via notice-and-comment rulemaking, in part to obviate the confusion mentioned above.

e. Industries Included in Final Appendix B After Applying the Final Criteria, Cut-Off Rates, and Data Sources

Based on the above decisions, final appendix B to subpart E of part 1904 includes industries that:

1. had a 3-year-average rate of total recordable cases (Total Case Rate, or TCR) in the BLS SOII for 2017, 2018, and 2019, of at least 3.5 cases per 100 full-time-equivalent employees, OR

2. had a 3-year-average DART rate in the BLS SOII for 2017, 2018, and 2019 of at least 2.25 cases per 100 full-time-equivalent employees, OR

3. had a fatality rate in the BLS Census of Fatal Occupational Injuries (CFOI) of at least 5.7 deaths per 100,000 full-time-equivalent employees, AND

4. are included in appendix A to subpart E. (All of the industries in appendix B are also in appendix A.)

No industries were removed from appendix B based on these criteria. However, six new industries have been added to appendix B. The new industries are:

• NAICS 1133—Logging (2019 fatality rate of 47.6),
• NAICS 1142—Hunting and Trapping (three-year average DART rate of 3.1),
• NAICS 3379—Other Furniture Related Product Manufacturing (three-year average DART rate of 2.27),
• NAICS 4239—Miscellaneous Durable Goods Merchant Wholesalers (2019 fatality rate of 15.6),
• NAICS 4853—Taxi and Limousine Service (2019 fatality rate of 6.9), and
• NAICS 4889—Other Support Activities for Transportation (three-year average DART rate of 2.4).

The application of the criteria and cut-offs to each industry that was added to appendix B is summarized in the following table:

New Industries in Final Appendix B

2017 NAICS 4-digit	Industry	High TCR	High DART	High fatality rate
1133	Logging	No		Yes.
1142	Hunting and Trapping	No	Yes.
3379	Other Furniture Related Product Manufacturing	No	Yes.
4239	Miscellaneous Durable Goods Merchant Wholesalers	No		Yes.
4853	Taxi and Limousine Service	No		Yes.
4889	Other Support Activities for Transportation	No	Yes.

All of the establishments with 100 or more employees in these newly included industries are also included in appendix A to subpart E, and, therefore, have been required to electronically submit data from their 300A to OSHA once a year since January 1, 2017. Because of their inclusion in appendix A, OSHA finds that each of these newly included industries should have been aware of this rulemaking. Moreover, in the preamble to the proposed rule, OSHA specifically indicated that the criteria for determining higher hazard industries might be modified for the final rule (indeed, OSHA asked for comment on this issue (see, e.g.,87 FR 18543, 18546)). Consequently, OSHA finds that the proposal placed all six of the newly added industries on notice that they could be included in appendix B in this final rule and, thus, these industries had an opportunity to comment on issues related to that determination.

In the proposed rule, OSHA stated that it was proposing one exception to these criteria, for the United States Postal Service (USPS), which is the only employer in NAICS 4911 Postal Service. OSHA explained BLS does not include USPS in the SOII. However, under the Postal Employees Safety Enhancement Act (Pub. L. 105–241), OSHA treats the USPS as a private sector employer for purposes of occupational safety and health, and establishments in NAICS 4911 ( i.e., USPS establishments) with 20 or more employees are currently required to electronically submit Form 300A information to OSHA. Using the 2017, 2018, and 2019 data submitted by USPS, OSHA calculated a TCR of 7.5 for NAICS 4911. Because this TCR is greater than the proposed 3.5 criterion for designated industries in proposed appendix B, OSHA included NAICS 4911 in proposed appendix B to subpart E. In so doing, OSHA noted that NAICS 4911 was also included in both current and proposed appendix A to subpart E (87 FR 18543).

OSHA did not receive any comments from interested parties regarding the proposed inclusion of USPS in appendix B. Due to the lack of an objection to its inclusion and USPS's high TCR level (as calculated by OSHA), the agency has decided to include USPS in the final version of appendix B.

The final appendix B to subpart E is as follows:

NAICS	Industry
1111	Oilseed and Grain Farming.
1112	Vegetable and Melon Farming.
1113	Fruit and Tree Nut Farming.
1114	Greenhouse, Nursery, and Floriculture Production.
1119	Other Crop Farming.
1121	Cattle Ranching and Farming.
1122	Hog and Pig Farming.
1123	Poultry and Egg Production.
1129	Other Animal Production.
1133	Logging.
1141	Fishing.
1142	Hunting and Trapping.
1151	Support Activities for Crop Production.
1152	Support Activities for Animal Production.
1153	Support Activities for Forestry.
2213	Water, Sewage and Other Systems.
2381	Foundation, Structure, and Building Exterior Contractors.
3111	Animal Food Manufacturing.
3113	Sugar and Confectionery Product Manufacturing.
3114	Fruit and Vegetable Preserving and Specialty Food Manufacturing.
3115	Dairy Product Manufacturing.
3116	Animal Slaughtering and Processing.
3117	Seafood Product Preparation and Packaging.
3118	Bakeries and Tortilla Manufacturing.
3119	Other Food Manufacturing.
3121	Beverage Manufacturing.
3161	Leather and Hide Tanning and Finishing.
3162	Footwear Manufacturing.
3211	Sawmills and Wood Preservation.
3212	Veneer, Plywood, and Engineered Wood Product Manufacturing.
3219	Other Wood Product Manufacturing.
3261	Plastics Product Manufacturing.
3262	Rubber Product Manufacturing.
3271	Clay Product and Refractory Manufacturing.
3272	Glass and Glass Product Manufacturing.
3273	Cement and Concrete Product Manufacturing.
3279	Other Nonmetallic Mineral Product Manufacturing.
3312	Steel Product Manufacturing from Purchased Steel.
3314	Nonferrous Metal (except Aluminum) Production and Processing.
3315	Foundries.
3321	Forging and Stamping.
3323	Architectural and Structural Metals Manufacturing.
3324	Boiler, Tank, and Shipping Container Manufacturing.
3325	Hardware Manufacturing.
3326	Spring and Wire Product Manufacturing.
3327	Machine Shops; Turned Product; and Screw, Nut, and Bolt Manufacturing.
3328	Coating, Engraving, Heat Treating, and Allied Activities.
3331	Agriculture, Construction, and Mining Machinery Manufacturing.
3335	Metalworking Machinery Manufacturing.
3361	Motor Vehicle Manufacturing.
3362	Motor Vehicle Body and Trailer Manufacturing.
3363	Motor Vehicle Parts Manufacturing.
3366	Ship and Boat Building.
3371	Household and Institutional Furniture and Kitchen Cabinet Manufacturing.
3372	Office Furniture (including Fixtures) Manufacturing.
3379	Other Furniture Related Product Manufacturing.
4231	Motor Vehicle and Motor Vehicle Parts and Supplies Merchant Wholesalers.
4233	Lumber and Other Construction Materials Merchant Wholesalers.
4235	Metal and Mineral (except Petroleum) Merchant Wholesalers.
4239	Miscellaneous Durable Goods Merchant Wholesalers.
4244	Grocery and Related Product Merchant Wholesalers.
4248	Beer, Wine, and Distilled Alcoholic Beverage Merchant Wholesalers.
4413	Automotive Parts, Accessories, and Tire Stores.
4422	Home Furnishings Stores.
4441	Building Material and Supplies Dealers.
4442	Lawn and Garden Equipment and Supplies Stores.
4451	Grocery Stores.
4522	Department Stores.
4523	General Merchandise Stores, including Warehouse Clubs and Supercenters.
4533	Used Merchandise Stores.
4543	Direct Selling Establishments.
4811	Scheduled Air Transportation.
4841	General Freight Trucking.
4842	Specialized Freight Trucking.
4851	Urban Transit Systems.
4852	Interurban and Rural Bus Transportation.
4853	Taxi and Limousine Service.
4854	School and Employee Bus Transportation.
4859	Other Transit and Ground Passenger Transportation.
4871	Scenic and Sightseeing Transportation, Land.
4881	Support Activities for Air Transportation.
4883	Support Activities for Water Transportation.
4889	Other Support Activities for Transportation.
4911	Postal Service.
4921	Couriers and Express Delivery Services.
4931	Warehousing and Storage.
5322	Consumer Goods Rental.
5621	Waste Collection.
5622	Waste Treatment and Disposal.
6219	Other Ambulatory Health Care Services.
6221	General Medical and Surgical Hospitals.
6222	Psychiatric and Substance Abuse Hospitals.
6223	Specialty (except Psychiatric and Substance Abuse) Hospitals.
6231	Nursing Care Facilities (Skilled Nursing Facilities).
6232	Residential Intellectual and Developmental Disability, Mental Health, and Substance Abuse Facilities.
6233	Continuing Care Retirement Communities and Assisted Living Facilities for the Elderly.
6239	Other Residential Care Facilities.
6243	Vocational Rehabilitation Services.
7111	Performing Arts Companies.
7112	Spectator Sports.
7131	Amusement Parks and Arcades.
7211	Traveler Accommodation.
7212	RV (Recreational Vehicle) Parks and Recreational Camps.
7223	Special Food Services.

2. Information To Be Submitted

Section 1904.41(b)(9) of the final rule specifies which information must be submitted under § 1904.41(a)(2). Consequently, comments on the proposed information to be submitted and OSHA's responses to those comments are discussed in Section III.D of this Summary and Explanation, on § 1904.41(b)(9). However, because this summary and explanation section covers comments on issues that relate to the information that establishments must submit under § 1904.41(a)(2), OSHA is briefly previewing those requirements here. Specifically, as laid out in question-and-answer format in § 1904.41(b)(9), establishments that are required to submit information under § 1904.41(a)(2) of this section must submit all the information from the OSHA Forms 300 and 301 except for the following case-specific information:

• Employee name (column B), from the Log of Work-Related Injuries and Illnesses (OSHA Form 300).
• Employee name (Field 1), employee address (Field 2), name of physician or other health care professional (Field 6), and facility name and address if treatment was given away from the worksite (Field 7) from the Injury and Illness Incident Report (OSHA Form 301).

Section 1904.41(b)(9) of the final rule is identical to proposed § 1904.41(b)(9).

3. Publication of Electronic Data

As discussed above, OSHA intends to make some of the data it collects public. The publication of specific data elements will in part be restricted by applicable Federal law, including provisions of the Freedom of Information Act (FOIA), as well as specific provisions within part 1904. OSHA will make the following data from Forms 300 and 301 available in a searchable online database:

• Form 300 (the Log)—All collected data fields on the 300 Log will generally be made available on OSHA's website. As specified in § 1904.41(b)(9), employee names will not be collected. OSHA notes that it often collects copies of establishments' Forms 300 during inspections and includes them as part of the enforcement case file. Prior to this rulemaking, OSHA has not conducted a systematic collection of the information on the 300 Log. However, OSHA releases the Forms 300 that it does have (in case files) in response to FOIA requests, subject to application of the FOIA exemptions. In those responses, OSHA redacts employee names pursuant to FOIA Exemptions.
• Form 301 (Incident Report)—All collected data fields on the right-hand side of the form (Fields 10 through 18) will generally be made available. As specified in § 1904.41(b)(9), employee name (Field 1), employee address (Field 2), name of physician or other health care professional (Field 6), and facility name and address if treatment was given away from the worksite (Field 7) will not be collected. OSHA notes that it often collects copies of establishments' Forms 301 during inspections and includes them as part of the enforcement case file. Prior to this rulemaking, OSHA has not conducted a systematic collection of the information on the 301 Incident Report. However, OSHA releases the forms that it does have in response to FOIA requests, subject to application of the FOIA exemptions. Section 1904.35(b)(2)(v)(B) prohibits employers from releasing the information in Fields 1 through 9 (the left-hand side of the form) to individuals other than the employee or former employee who suffered the injury or illness and his or her personal representatives, and OSHA does not release this information under FOIA. Similarly, OSHA will not publish establishment-specific data from the left side of Form 301.

OSHA intends to publish information from the Forms 300 and 301 as both text-based and coded data. An example of text-based data would be, “Second degree burns on right forearm from acetylene torch” in Field F (“Describe injury or illness, parts of body affected, and object/substance that directly injured or made person ill”) on the Form 300. An example of coded data for this case, using the Occupational Injury and Illness Classification System (OIICS) Manual, would be:

• Nature of injury: 1,520 (heat (thermal) burns, unspecified)

• Part of body affected: 423 (forearm)

• Source of injury or illness: 7,261 (welding, cutting, and blow torches)

• Event or exposure: 533 (contact with hot objects or substances)

For text-based data, as discussed below, OSHA plans to use automated de-identification technology, supplemented with some manual review of the data, to identify and remove information that could reasonably be expected to identify individuals directly from the fields the agency intends to publish (as discussed above); the agency will not publish text-based data until such information, if any, has been identified and removed. For coded data, also as discussed below, OSHA plans to use an automated coding system to code the collected data; until the autocoding system has been tested and is in place, OSHA intends to only use and publish uncoded data. The coded data by its nature will not include any information which could reasonably be expected to identify employees directly, and thus there will be no need to use automated de-identification technology or manual de-identification before publishing coded data.

4. Benefits of Collecting and Publishing Data From Forms 300 and 301

As discussed in more detail below, OSHA has determined that this final rule will improve worker safety and health because the collection of, and expanded public access to, establishment-specific, case-specific, injury and illness data from Forms 300 and 301 will allow OSHA, employers, employees, researchers, safety consultants, and the general public to use the data in ways that will ultimately result in the reduction of occupational injuries and illnesses.

In the preamble to the 2019 final rule, OSHA stated that, because the agency “already has systems in place to use the 300A data for enforcement targeting and compliance assistance without impacting worker privacy, and because the Form 300 and 301 data would provide uncertain additional value, the Form 300A data are sufficient for enforcement targeting and compliance assistance at this time” (84 FR 392). The uncertainty regarding the extent of the benefits was based, in part, on the determination that “[b]ecause . . . publishing the data would do more harm than good for reasons described more fully below and in the privacy discussion above, OSHA would not make the data public even if collected” (84 FR 390). In addition, at the time of the 2019 final rule, “OSHA ha[d] already taken the position that data from Form 300A is exempt from disclosure under FOIA and that OSHA will not make such data public for at least the approximately four years after its receipt that OSHA intends to use the data for enforcement purposes” (84 FR 391).

Since publication of the 2019 final rule, however, OSHA is now better able to collect, analyze, and publish data from Forms 300 and 301, and advances in technology have reduced the risk that information that could reasonably be expected to identify individuals directly will be disclosed to the public. Also, improvements in technology have reduced the manual resources needed to identify and remove sensitive worker information from 300 and 301 forms. These developments will allow OSHA to more effectively review and analyze the collected 300 and 301 data and ensure that information which could reasonably be expected to identify employees directly is removed prior to publication. For example, as discussed below, more advanced autocoding technology will allow OSHA to more efficiently review and analyze the data, allowing the agency to focus its enforcement targeting and compliance assistance resources on specific hazards at establishments with safety and health problems, resulting in a reduction of work-related injuries and illnesses. Similarly, advances in technology to identify and remove information which could reasonably be expected to identify employees directly will reduce the resources needed to publish text-based information while adequately protecting worker privacy. In addition, OSHA plans to publish the coded data produced by the more advanced autocoding technology, which by its nature will not include any information which could reasonably be expected to identify employees directly.^[5]

Additionally, as explained above, since 2020, there have been multiple court decisions adverse to the Department of Labor's position that electronically submitted Form 300A data are exempt from public disclosure under the FOIA. In these decisions, courts have rejected the Department of Labor's position that electronically submitted 300A injury and illness data was covered under the confidentiality exemption in FOIA Exemption 4. As a result, in August 2020, OSHA initiated a policy to post collected 300A data on its public website at https://www.osha.gov/​Establishment-Specific-Injury-and-Illness-Data, with submissions for calendar years 2016, 2017, 2018, 2019, 2020, and 2021.

Accordingly, based on the recent developments described above, and the additional information included in the record for this rulemaking, OSHA now believes there are significant benefits resulting from the collection and publication of establishment-specific, case-specific, injury and illness data from Forms 300 and 301. In addition, as explained below, OSHA concludes that the significant benefits associated with the collection and publication of Forms 300 and 301 data outweigh the slight risk to employee privacy. Indeed, the benefits of collection alone would outweigh the slight risk to employee privacy.

As explained in more detail below, after considering the record as a whole, including commenters' responses to specific questions in the NPRM on this topic, OSHA finds that the collection of, and expanded public access to, establishment-specific, case-specific, injury and illness data will allow OSHA, employers, employees, potential customers, employee representatives, researchers, safety consultants, and the general public to use the data in ways that will ultimately result in the reduction of occupational injuries and illnesses (see 87 FR 18547).

a. General Benefits of Collecting and Publishing Data From Forms 300 and 301

OSHA received several comments on the general benefits of collecting and publishing data from Forms 300 and 301. For example, Miranda Ames commented, “The more data we have about workplace safety, the better we can do at protecting workers. Collection of information like this by OSHA will enable better statistical analysis of workplace injuries across industries, and incentivize employers to keep more thorough records of workplace incidents and accidents” (Docket ID 0011).

Similarly, Cal/OSHA commented, “Complete and accurate surveillance of occupational injury and illness is essential and holds significant value for informed policy decisions and for effective intervention and prevention programs. The policy of requiring submission of detailed information from larger employers specifically helps identify and abate workplace hazards by improving the surveillance of occupational injury and illness.” (Docket ID 0084). This commenter also explained that the proposed requirements for reporting detailed information, and the transparency that it creates, encourage and support accurate occupational injury and illness reporting (Docket ID 0084). Similarly, Centro de los Derechos del Migrante, Inc. commented that making the data publicly available will increase the accuracy of such records and address underreporting by employers (Docket ID 0089).

In addition, commenters suggested that the collection and publication of Forms 300 and 301 data will allow the agency to receive more detailed information on the nature and circumstances of work-related injuries and illnesses, and target its limited enforcement and compliance assistance resources to protect the greatest number of workers (Docket IDs 0040, 0064). Commenters also noted that this rule may particularly benefit low-income and minority workers (Docket IDs 0045, 0048). For example, National COSH stated that Latino and Black workers are at greater risk of dying on the job than other workers, and this rule “is critical to improving worker safety and health, especially for workers at elevated risk of injury, illness and death” (Docket ID 0048).

On the other hand, some commenters questioned whether OSHA had adequately justified the benefits of collecting and publishing data in the proposed rule. For example, NFIB stated that many of the reasons that OSHA gives in the preamble to the proposed rule to justify the collection and publication of information are “rather flimsy” (Docket ID 0036). Some commenters stated that the collected data would not benefit workplace safety and health, concluding that OSHA recordkeeping data are not useful. For example, an anonymous commenter stated that data collection is reactive, and that taxpayer money would be much better spent on proactive programs that improve safety and health in the workplace. This commenter also asked, “How do employers know that OSHA will not start targeting them due to injuries that are reported?” (Docket ID 0014). The U.S. Poultry & Egg Association commented that the existing reporting rules are adequate to allow employers to identify risks and allow OSHA to direct its enforcement activities, and stated that a reduction in injury and illness rates in poultry processing and general manufacturing from 1994 to 2020 is evidence that OSHA's proposed changes are unnecessary (Docket ID 0053).

Mid Valley Agricultural Services commented, “It is unclear how the proposed rule will result in reductions to injuries/illnesses in the workplace or the frequency and severity of instances. Aggregating more data on workplace injuries/illnesses does nothing in and of itself to reduce the possibility of workplace injuries/illnesses” (Docket ID 0019). The Plastics Industry Association (Docket ID 0086) and Angela Rodriguez (Docket ID 0052) submitted similar comments. In addition, the U.S. Chamber of Commerce resubmitted a comment from the 2016 rulemaking that argued that OSHA's collection of injury and illness data would not lead to effective targeting of workplaces “because information about an establishment's incidences of workplace injuries and illnesses does not accurately or reliably correlate with an establishment that is hazardous or that has failed to take OSHA-compliant steps to prevent injuries” (Docket ID 0088, Attachment 2). The comment asserted that a study by the RAND Corporation “found that no research supports the preconception that the goal of reducing workplace injuries and illnesses can be most effectively reached by focusing on workplaces with the highest number of incidents of injuries or illnesses” and that “there appears to be little relationship between the injury rate and the likelihood of violations at inspected establishments.” The comment concluded that “this proposed database will provide raw data subject to so many caveats, complexities, and assumptions as to be meaningless.”

In response, OSHA agrees with commenters who generally stated that there are benefits resulting from the collection and publication of establishment-specific, case-specific, injury and illness data from Forms 300 and 301. As discussed in more detail below, the primary purpose of the requirement in the final rule for the electronic submission of 300 and 301 data, and the subsequent publication of certain data, is to prevent occupational injuries and illnesses through the use of timely, establishment-specific injury and illness data by OSHA, employers, employees, other Federal agencies and States, researchers, workplace safety consultants, and the public. The collection and publication of data from Forms 300 and 301 will not only increase the amount of information available for analysis, but will also result in more accurate statistics regarding work-related injuries and illnesses, including more detailed statistics on injuries and illnesses for specific occupations and industries. In other words, the increase in collected injury and illness data will necessarily result in more accurate statistics. In turn, more accurate statistics will enhance interested parties' knowledge regarding specific workplace hazards.

Relatedly, OSHA agrees with commenters that said making the data publicly available will increase the accuracy of occupational injury and illness reporting. To the extent that underreporting is a problem, the public availability of case-specific data will allow employees to assess whether their personally experienced injuries and illnesses have been accurately recorded on their employers' Forms 300 and 301. Although others would not be able to identify that a specific employee suffered a particular injury or illness, OSHA expects that the injured or ill worker would be able to determine whether their particular injury or illness was recorded. This check would work in tandem with employees' ability to check such things in an employer's Forms 300 and 301 and would address employees' fear that asking to view those forms could result in retaliation. OSHA has also discussed these issues in further detail in Section III.B.4.d of the Summary and Explanation.

The requirement to submit establishment-specific, case-specific data will also assist OSHA in encouraging employers to prevent occupational injuries and illnesses by expanding OSHA's access to the information that employers are already required to keep under part 1904. As noted elsewhere, OSHA typically only has access to establishment-specific, case-specific, injury and illness information when it conducts an onsite safety and health inspection at an individual establishment. However, the electronic submission of 300 and 301 data will allow OSHA to obtain a much larger data set of information about work-related injuries and illnesses and will enable the agency to use its enforcement and compliance assistance resources more effectively. OSHA intends to use the collected data to identify establishments with recognized workplace hazards where workers face a high risk of sustaining occupational injuries and illnesses.

The collection of establishment-specific, case-specific information will also provide data for analyses that are not currently possible. OSHA plans to use the data collected from this final rule to assess changes in the types and rates of specific injuries and illnesses in a given industry over a long period of time. In addition, the data collection will allow OSHA to better evaluate the effectiveness and efficiency of its various safety and health programs, initiatives, and interventions in different industries and geographic areas. Additionally, for these reasons, OSHA disagrees with commenters that suggest current reporting requirements are adequate to protect worker safety and health.

OSHA disagrees with commenters that stated that part 1904 injury and illness data are not useful in improving occupational safety and health, and that taxpayer funds would be better spent on more proactive measures. As noted above, OSHA's injury and illness recordkeeping regulation has been in place since 1971. The information recorded on the OSHA forms is recognized by safety and health professionals as an essential tool for identifying and preventing workplace injuries and illnesses. Historically, employers, employees, and OSHA have used part 1904 information to identify injury and illness trends and to evaluate the effectiveness of abatement methods at an individual establishment. The collection and publication of certain data from the 300 and 301 forms required by this final rule will enable interested parties and OSHA to have access to a much larger data set, resulting in increased knowledge of workplace hazards, and a reduction in occupational injuries and illnesses. In addition, implementation of the collection and publication of establishment-specific, case-specific, injury and illness data is a cost-effective measure used to improve workplace safety and health. OSHA estimates that the total cost for implementing the requirements of this final rule will have an annual cost to the government of approximately $554,000 per year. However, the agency expects that the increased knowledge of workplace hazards and injury and illness trends, as well as the expected improved accuracy of part 1904 records, will result in decreased workers' compensation costs for employers and decreased healthcare costs for injured or ill employees by virtue of the reduction in workplaces injuries and illnesses that OSHA expects to result from this final rule. OSHA also notes, as discussed below, that the agency's collection of this information will allow it to more effectively prioritize its compliance assistance resources, which will help employers better protect their employees.

OSHA agrees that the injury and illness data collected as a result of this final rule may be used to target certain establishments for safety and health inspection or compliance assistance. The agency considers the use of the collected data for possible targeting of specific establishments for enforcement or compliance assistance intervention as a benefit of this final rule. Again, as noted above, OSHA expects the accuracy and quality of occupational injury and illness data to improve as a result of this final rule. The increased amount of data collected by the agency, along with the expected improvement in data accuracy, will enable OSHA to better analyze and evaluate workplace safety and health hazards. Accordingly, the overall improvement in the data collected by the agency will allow OSHA to more accurately and objectively target specific establishments where workers are at high risk and thereby reduce the overall occurrence of workplace injuries and illnesses.

With regard to the Chamber's comment on the 2013 RAND Corporation study, OSHA notes that the study focuses primarily on the effectiveness of various types of Cal/OSHA inspections ( e.g., programed, planned, and complaint) rather than on issues related to workplace injury and illness rates. Indeed, similar to how OSHA intends to use the collected data from this final rule, one of the recommendations included in the study states, “Workplaces in high-injury-rate industries that have not been inspected at all or not for many years should be identified and deserve some priority in programmed inspections” (see Inspection Targeting Issues for the California Department of Industrial Relations Division of Occupational Safety and Health (John Mendeloff & Seth A. Seabury) (Docket ID 0099) at 13). Finally, as noted above, Cal/OSHA itself commented in this rulemaking that injury and illness surveillance is essential for informed policy decisions and in the identification, prevention, and abatement of workplace hazards (Docket ID 0084).

Additionally, the National Propane Gas Association stated that OSHA “does not provide any details as to how publicly available information could improve workplace safety” (Docket ID 0050). In response, as the agency explained in the NPRM (87 FR 18538), by that point in time, OSHA had successfully collected reference year 2016 through 2020 Form 300A data through the OSHA Injury Tracking Application. (Since publication of the NPRM, OSHA has completed collection of reference year 2021 Form 300A data and has begun collecting 2022 data.) Approximately 300,000 records have been submitted to the agency each year. OSHA has successfully analyzed these data to identify establishments with elevated injury and illness rates and has focused both its enforcement and outreach resources towards these establishments. This experience demonstrates OSHA's ability to collect, analyze, and use large volumes of data to interact with establishments where workers are being injured or becoming ill. However, this same experience has demonstrated the limits of the 300A data currently collected. As explained in more detail below, the collection and publication of establishment-specific, case-specific, injury and illness data from Forms 300 and 301 will result in significant benefits for the agency.

The International Bottled Water Association (IBWA) commented, from an enforcement standpoint, “by the time the data could be evaluated for use in selecting OSHA's enforcement targets, the data would surely be stale and provide no useful basis for the agency to initiate enforcement against employers within the six-month statute of limitations set forth in the OSH Act.” This commenter also stated that, “[b]ecause the data is insufficient in and of itself as a targeting tool, and because OSHA would be able to rely on such data only when it likely no longer reflects current conditions at a particular worksite, OSHA's enforcement program is better served by continuing to use 300A summary data to target enforcement resources,” and then obtaining a copy employer's current Forms 300 and 301 at the time of an inspection (Docket ID 0076). IBWA added, “[u]sing the more detailed 300 and 301 data in the context of an individual inspection, as the agency has historically done, is a better and more effective use of this data than OSHA's proposed new plan” (Docket ID 0076).

In response, for purposes of enforcement inspection and compliance assistance targeting, the agency intends to use the collected data from this final rule in two ways. First, OSHA plans to continue to use administrative plans based on neutral criteria to target individual establishments with high injury and illness rates based on submitted Form 300A summary data. Second, OSHA intends to use administrative plans based on neutral criteria to target individual establishments based on submitted case-specific, establishment-specific, injury and illness data from the Forms 300 and 301.

OSHA agrees with IBWA that relying on Form 300A summary data is an effective source of information for targeting the agency's enforcement resources. For example, the Site-Specific Targeting (SST) plan is OSHA's main site-specific programmed inspection initiative for non-construction workplaces that have 20 or more employees. Currently, the SST program targets individual establishments based on 300A injury and illness data that employers are already required to electronically submit to OSHA under 29 CFR 1904.41. OSHA uses submitted 300A data to calculate injury and illness rates for individual establishments. The SST program helps OSHA achieve the goal of ensuring that employers provide safe and healthful workplaces by directing enforcement resources to those workplaces with the highest rates of injuries and illnesses. Moving forward, OSHA intends to continue to use the 300A data submitted under 1904.41(a)(1) of this final rule to calculate injury and illness rates and target individual establishments for inspection under the SST.

OSHA also intends to use collected case-specific, establishment-specific data from the Forms 300 and 301 to identify individual establishments for enforcement inspection and compliance assistance outreach. OSHA believes that reviewing and analyzing specific data from the Forms 300 and 301 is an effective method for the agency to identify individual establishments for enforcement inspection or compliance assistance targeting. For example, OSHA will be able to use 300 and 301 data to identify specific hazards at a given establishment. In turn, the agency will be able to more effectively deploy its enforcement and compliance assistance resources to eliminate identified hazards and enhance worker safety and health. Of course, and as discussed elsewhere, OSHA enforcement targeting based on the data submitted as a result of this final rule will be conducted in accordance with a neutral-based scheme for identifying workplaces for closer inspection.

OSHA disagrees with IBWA's comment that the collected injury and illness data the agency intends to use for its enforcement inspection and compliance assistance targeting is stale. OSHA acknowledges that the Forms 300 and 301 data are based on injuries and illnesses that occurred during the previous calendar year. However, OSHA's current SST inspection targeting program is also based on Form 300A summary data from the previous calendar year. Even though the injuries and illnesses occurred during the previous calendar year, the information is helpful to OSHA in determining whether a hazard is an ongoing problem at a specific establishment. For example, although a heat-related illness may have occurred more than six months before the submission deadline, it may be reasonable for OSHA to conclude that multiple entries of this illness on the OSHA forms represent an ongoing hazard at that establishment. In addition, research indicates that high injury and illness rates are persistent over time until there is some type of safety and health intervention at the facility (see Evaluation of OSHA's Impact on Workplace Injuries and Illnesses in Manufacturing Using Establishment-Specific Targeting of Interventions: Programmed Inspections and High Hazard Notification Letters, FINAL REPORT. Prepared by: ERG, Lexington, MA, July 16, 2004 (Docket ID 0098)). By identifying an establishment with ongoing hazards, the agency has the opportunity to use its enforcement and compliance assistance resources to conduct an intervention and improve workplace safety and health.

b. Beneficial Ways That OSHA Can Use the Data From Forms 300 and 301

OSHA expects to use the collected data in many ways to improve worker safety and health. Most importantly, having this information will provide OSHA with a much fuller and more detailed understanding of the kinds of injuries and illnesses experienced by workers doing different jobs in a range of industries.

The data available from the 300A forms currently collected by OSHA show primarily only how many “injuries” and “illnesses” occur. (The 300A ITA data also provide information on the number of cases of illnesses involving hearing loss, poisonings, skin disorders, and respiratory disorders, but even for those, knowing that they occurred at a particular workplace provides little if any useful information about how the workers developed them.) The data provide no meaningful information about the kinds of injuries or illnesses suffered by workers, the kind of work they do, or the hazards present at their workplaces. The establishment-wide scope of the 300A data currently available to OSHA also tends to obscure particular types of injuries and illnesses that may affect only certain classes of workers at large establishments. For example, nursing aides at hospitals may be exposed to very different hazards than those facing other hospital staff who do not perform the same kind of physical work. Yet, looking at hospital-wide generalized data will give no hint of the circumstances giving rise to particular exposures or which workers are affected.

By having access to more precise information about the kinds of injuries and illnesses affecting workers performing different kinds of operations at different kinds of workplaces, OSHA can deploy its resources in ways more calculated to address the specific hazards that actually exist in specific workplaces. It is obvious that the broad categories of “injury” and “illness” provide little useful information about the specific kinds of hazards that exist at a workplace. And even a narrower category of illness like “respiratory conditions” does not indicate whether the respiratory condition is related to a chemical exposure, COVID–19, valley fever (coccidioidomycosis), hantavirus, Legionnaires' disease (Legionellosis), or tuberculosis. In contrast, the collection and analysis of case-specific data from the Forms 300 and 301 would allow OSHA to determine the prevalence of particular respiratory hazards and respond appropriately, whether that response is in the form of targeted enforcement efforts or compliance assistance, general guidance materials or regulatory solutions, or cooperation with local public health authorities.

Having access to case-specific data will also allow OSHA to determine whether workers in particular demographics are being sickened or injured disproportionately. These may be younger or older workers, temporary workers, or workers new to a particular assignment. If OSHA has this information, it will be able to develop strategies to address the particular demographic factors that lead to these disproportionate outcomes.

Many of the comments questioning the utility of the data for OSHA seemed to be premised on the erroneous belief that OSHA's primary use of the data would be to target enforcement efforts at workplaces with higher injury and illness rates. But the utility of case-specific data is much broader. While the data certainly can be used to help target enforcement, as well as compliance assistance efforts, it is also valuable to OSHA in that it allows for the types of analyses that can make all of OSHA's work more effective.

As noted above, OSHA can analyze the data to identify the specific conditions that are injuring workers as well as the specific classes of workers who are being injured. OSHA can identify trends in the types of injuries and illnesses that are occurring and, as noted by the AFL–CIO, the agency can identify and assess emerging hazards (Docket ID 0061). Being able to make these identifications allows OSHA to promote safer workplaces in myriad ways. OSHA can disseminate information about trends in injuries and illnesses and emerging hazards to the public so that both workers and employers can take steps to prevent similar injuries and illnesses at their own facilities. For example, the AFL–CIO noted that the data could have been utilized in the first years of the COVID–19 pandemic to identify where effective mitigation measures were necessary to reduce exposures, and could have been incorporated into agency guidance, enforceable standards, and enforcement initiatives, and used to inform employer and union COVID–19 safety plans (Docket ID 0061). OSHA can also prioritize use of its own limited resources to have the greatest impact. This may mean providing more useful compliance assistance or guidance, considering development of new standards, or revising enforcement programs to focus on workplaces where OSHA has determined that hazards are more likely to be found. As noted by the Laborers' Health and Safety Fund of North America, this also means that OSHA can “become more data driven in its compliance and enforcement efforts” and, “[i]n being a more online and easily accessible agency, OSHA can push its consulting efforts and services” (Docket ID 0080).

One example of how OSHA can use the information in Forms 300 and 301 relates to OSHA's efforts to address indoor and outdoor heat-related hazards. As climate change has accelerated, heat hazards have become more prevalent, sickening and killing more workers every year (see https://www.osha.gov/​sites/​default/​files/​enforcement/​directives/​CPL_​03-00-024.pdf). OSHA's efforts to address these hazards are multi-pronged, with ongoing enforcement, compliance assistance, and guidance efforts, as well as a regulatory component. Without case-specific injury and illness data, OSHA's understanding of the scope of the problem and its ability to identify specific operations and types of establishments where workers are most at risk, are limited, impeding its ability to intervene at an early enough stage to prevent worker illnesses and deaths. Currently, OSHA most often learns of these hazards after an employer reports a worker hospitalization or death (pursuant to 29 CFR 1904.39). The Form 300A listing of the number of illnesses at various establishments gives no sense of how many of those illnesses are heat-related. In contrast, Forms 300 and 301 data will allow OSHA to identify patterns and trends in the occurrence of heat-related illness, and not only focus its enforcement and compliance assistance resources appropriately, but also inform OSHA's efforts to develop a permanent standard addressing heat hazards. These types of longer-term strategic activities can help make OSHA a more effective agency overall, and in doing so, make all workers safer.

c. Beneficial Ways That Employers Can Use the Data From Forms 300 and 301

In the preamble to the proposed rule, OSHA asked, “What are some ways that employers could use the collected data to improve the safety and health of their workplaces?” Multiple commenters provided comments on employers' use of the collected data to improve the safety and health of their workplaces, including information about benchmarking and incentives. (Docket IDs 0030, 0035, 0046, 0061, 0063, 0093). For example, AIHA commented, “Benchmarking against other employers is an important management tool for understanding and improving occupational safety and health programs” (Docket ID 0030). Similarly, the AFL–CIO commented that the collected data would provide employers direct access to detailed injury and illness information to compare their injury and illness records and experience with others in the same industry (Docket ID 0061). NIOSH made similar comments and added that, currently, employers may compare their injury rates to those of their industry as reported in the SOII, but because of the large number of injury and illness records that will be collected under this rulemaking, employers will be able to compare their injury and illness rates to those of many more specific groups of establishments and employers. This commenter also stated, “Benchmarking safety performance to more comparable establishments and employers instead of large, anonymous aggregates would provide more accurate as well as more compelling metrics for guiding and motivating improvement of safety programs” (Docket ID 0035).

More generally, the Sheet Metal and Air Conditioning National Association (SMACNA) commented, “SMACNA members believe that any additional data that is collected should be used in tandem with Bureau of Labor Statistics (BLS) data so our industry can better understand loss trends and use the information accordingly. SMACNA members provide a unique service and would like the data to be broken down by the specific North American Industry Classification System (NACIS) codes. Such as detailed OSHA incident rate information for NACIS code 238220—Plumbing, Heating, and Air-Conditioning Contractors.” (Docket ID 0046).

Additionally, Worksafe commented that access to more electronic data will allow businesses to compare their safety performance to other firms and enable competition for improved safety. Also, this commenter explained that suppliers, contractors, and purchasers of a firm's goods or services could also consider the information in their business decisions, such as whether to support a business with a poor safety record. In addition, regarding the issue of incentives for employers, this commenter stated, “When employers know that injury or illness incidents will be published online, the risk of social stigma will encourage them to take appropriate precautions and avoid violations” (Docket ID 0063).

Similarly, Public Citizen commented, “Bringing performance information out into the open is an effective form of behavioral economics impacting employer decision-making. It serves as a strong incentive for employers to improve their safety records and support their reputations. It would encourage employers to implement systems, protocols, education and workplace alterations, resulting in less worker injuries and illnesses. Employers can also use establishment-specific, case-specific injury and illness information to compare their safety record to similar establishments and set benchmarks for improvement of their own safety and health performance. Negative publicity has been shown to improve not just the behavior of the highlighted employer, but also other employers. This general deterrence effect has been demonstrated by improved compliance with safety standards by employers after OSHA issued press releases on OSHA violations uncovered during inspections. The impact was so powerful that press releases led to 73 percent fewer safety violations identified during programmed inspections at neighboring enterprises and a drop in injury reports from the same enterprises.” (Docket ID 0093).

On the other hand, several commenters stated that employers would not be able to use the collected data to improve the safety and health of their workplaces (Docket IDs 0086, 0090, 0094). For example, the Plastics Industry Association commented, “The rule will not assist employers in managing workplace safety as it does not provide information that is not already available to them and their employees. When companies publish incident reports internal to all employees, all personal information is removed, and no medical information is provided.” This commenter also stated that companies track different types of information and that some companies already benchmark with others (Docket ID 0086).

The Phylmar Regulatory Roundtable OSH Forum also commented that there is already benchmarking by employers, saying, “Many employers, such as PRR members are part of trade organizations and already participate in formal benchmarking on injury and illness data. PRR members also review BLS data. Therefore, we believe that OSHA's posting of establishment specific data will be of NO additional benefit to the resources already available to employers who actively pursue these methods.” (Docket ID 0094).

In addition, a few commenters stated that the data would harm employers. For example, Angela Rodriguez commented, “There is a perceived risk of business competitors using the establishment-level data to gain an advantage by comparing/contrasting results in a negative context. E.g., `Company X lets their employees get seriously injured 3x more than us' ” (Docket ID 0052). Similarly, the National Retail Federation commented, “Given President Biden's expressed desire to lead the “most pro-union Administration in American history,” it is likely that the true motivation of this rulemaking is to weaponize injury and illness data for labor union leaders' benefit. Labor unions will likely use this data to gain support for their organizing efforts, claiming the data proves an employer is not protecting its workers.” (Docket ID 0090). This commenter also stated that unions may use the data to pressure employers in negotiations over collective bargaining agreements, and competitors may use the information for anticompetitive purposes, such as poaching top workers or hurting the reporting entity's standing in the community (Docket ID 0090). Likewise, the Phylmar Regulatory Roundtable OSH forum commented, “This type of risk profile and data tool could also be used by insurance companies when determining policies and rates for a company's worker compensation insurance plan. In addition, an insurance company could use the risk profile and data tool to deny issuance of disability, long-term, and other types of insurance.” (Docket ID 0094).

In response, OSHA agrees with commenters who stated that employers will be able to use the published establishment-specific, case-specific, injury and illness data to improve their workplace safety and health. Specifically, employers will be able to use the data to compare case-specific injury and illness data at their establishment with that of comparable establishments and set safety and health goals benchmarked to the establishments they consider most comparable. OSHA also plans to include information regarding establishments' NAICS codes. As SMACNA suggests, interested parties can use that information to better understand loss trends, which will help them make improvements in worker safety and health.

Since employers will have access to a much larger data set, OSHA disagrees with commenters who suggested that employers already have access to enough information from trade associations to conduct benchmarking with injury and illness data. OSHA notes that employers will be able to access data from the entire range of establishments covered by the electronic submission requirements in this final rule. Thus, employers will have the opportunity to compare and benchmark their injury and illness data with not only the safest establishments in their industry, but with the safest establishments in all industries covered by the final rule. In addition, OSHA anticipates that employers will be able to review the establishment-specific injury and illness data, identify safer establishments in their industry, and potentially develop and establish similarly effective safety and health programs at their own facilities.

OSHA also agrees with commenters who stated that the publication of establishment-specific, case-specific, injury and illness data will incentivize employers to minimize the number of occupational injuries and illnesses at their workplace. For example, the publication of the data will encourage potential customers or business partners to evaluate the full range of injury and illness cases at a specific establishment. In turn, employers will work to improve the occupational safety and health at their facility, which will result in reduced work-related injuries and illnesses, thereby enhancing the employer's standing with potential customers and business partners.

In addition, OSHA disagrees with commenters who stated that the collection and publication of establishment-specific, case-specific, injury and illness data will harm employers or that labor unions will “weaponize” the data. Again, as noted above, the only purpose for the collection and publication of injury and illness data required by this final rule is to improve occupational safety and health and to reduce injuries and illnesses to workers. At the same time, OSHA considers the publication of an establishment's injury and illness data, which can be a valid measure of a company's overall safety culture, to be an effective incentive for employers to improve occupational safety and health. As a result, OSHA concludes that the collection and publication of this data will encourage employers with more hazardous workplaces to make improvements in safety and health to reduce the number of occupational injuries and illnesses at their workplaces. Such changes will also be of benefit to employers, in that workplace illnesses and injuries impose costs on employers beyond the cost to the injured or ill employee.

In response to the Phylmar Group's comment that insurance companies may use the collected data to calculate insurance rates or deny insurance coverage to companies based on the data, OSHA notes that insurance companies could engage in these practices using the 300A data OSHA has been collecting and publishing for several years now if they wanted to. The Phylmar Group does not identify any reason why the collection of data from Forms 300 and 301 would make these practices more likely or widespread, nor does it provide any evidence that insurance companies are or are not already doing this. Moreover, the possibility that insurance companies may raise rates or deny insurance coverage based on an employer's higher-than-average rates of occupational injuries and illnesses would provide further incentive for employers to improve workplace safety and health at their establishments.

Finally, and as discussed below, access to the collected data will improve the workings of the labor market by providing more complete information to job seekers. Using data newly accessible under this final rule, potential employees will be able to examine case-specific information to help them make more informed decisions about future employment and, in turn, could encourage employers to make improvements in workplace safety and health in order to attract potential employees. In addition, this would help address the problem of information asymmetry in the labor market, where the businesses with the greatest problems have the lowest incentive to self-disclose.

Accordingly, after consideration of the rulemaking record, OSHA has determined that employers will be able to use the collected and published data to improve workplace safety and health and reduce occupational injuries and illnesses.

d. Beneficial Ways That Employees Can Use the Data From Forms 300 and 301

In the preamble to the proposed rule, OSHA asked “What are some ways that employees could use the collected data to improve the safety and health of their workplaces?” 87 FR 18547.

OSHA received many comments on how employees will benefit from increased access to information from the 300 and 301 forms and on how employees will use the collected data to improve safety and health at their workplaces. Several commenters provided information on how employees will generally be able to use the collected data from Forms 300 and 301 (Docket IDs 0035, 0061, 0063, 0065, 0066, 0078). For example, AIHA commented, “Under a Total Worker Health model, injury data about specific tasks, operations, job titles, and industries could be used for worker training and education” (Docket ID 0030). Similarly, NIOSH commented, “While the BLS Annual Survey data provide good metrics for injury risks by industry, they are not ideal for engaging workers and helping them to understand the risks that they may face in their own jobs.” This commenter also explained that the narrative case-specific data that would be collected under the rule could provide employees with concrete, real-world, accounts on how injuries and illnesses occur and instruct them on how they can be prevented (Docket ID 0035). The AFL– CIO submitted similar comments (Docket ID 0061).

The National Nurses Union commented, “Public posting of this data would enable workers and their representatives to better understand the scope of injuries and illnesses in particular work sites and to do so in a more timely and efficient manner. While workers and their representatives can access logs at their own workplace, they currently cannot compare those logs to other workplaces in the industry. For nurses, patterns of injury and illness could be identified, compliance with existing standards could be more efficiently examined, and emerging occupational risks could be better evaluated. When action to correct workplace safety and health hazards is inefficient or delayed, workers are unnecessarily exposed to predictable and preventable hazards. Delays in correcting a workplace hazard pointlessly cost the lives, limbs, and livelihoods of NNU members and other workers.” (Docket ID 0064).

Additionally, Worksafe commented that unions and worker advocacy groups will be able to use case-specific information to seek safety improvements, “Currently, these groups can access Form 300 logs only by requesting them from employers, and the information may be provided in an inefficient manner such as in PDF files or on paper. As detailed below, unions and worker advocacy groups have the expertise to analyze this information to identify necessary workplace fixes. Electronic publication of more granular data will make it possible for them to better identify the cause of worker injuries and illnesses, more efficiently analyze large quantities of information, and appropriately direct their efforts.” (Docket ID 0063). Worksafe also provided several examples of how establishment-specific, case-specific, injury and illness data has been used by employees and their representatives to reduce workplace injuries and illnesses. For example, it included a narrative from a meatpacking labor organization:, “In 2008, leaders from the UFCW Tyson meatpacking locals union accessed Form 300 logs collected from one meatpacking plant for a one-month period. They analyzed injuries that could be related to ergonomic hazards and then placed red “sticky dots” on a hand-drawn map of a human body, depicting injury areas. The resulting body map looked as though the hands were dripping blood because so many red dots were placed in that area. The leaders were able to confirm that, despite known under-reporting, a lot of hand-specific injuries occurred amongst their members. The leaders later presented the body map in a meeting with Tyson management, where it became a powerful tool. This meeting included an individual who had been in charge of the company's ergonomics program some years earlier and who had recently returned as a top-level manager. Seeing the map, he agreed with the union to start a series of efforts to revitalize the ergonomics program.” (Docket ID 0063).

In contrast, some commenters stated that the collection and publication of certain data from Forms 300 and 301 could potentially harm employees, including harm to employee privacy and employability. For example, R. Savage commented, “I have concerns with organizations uploading their OSHA Forms 300 and 301 because both forms contain identifiable personal information. My concern is the privacy of the injured employee. Government agencies have accidentally released personal information in the past. Removing the employee's name in OSHA form 300 and removing sections 1–9 of OSHA form 301 does not guarantee that the employee will not be identifiable.” (Docket ID 0018). Also, an anonymous commenter stated, “This would seem to make employees feel like they need to share even more private information to their employers than they already do” (Docket ID 0044). However, this last comment seems to be based on a misunderstanding. This rulemaking does not amend the type of information that employers must enter on their recordkeeping forms, nor does it amend the recordkeeping forms used to track injuries and illnesses. Instead, this rulemaking addresses the electronic submission to OSHA of certain information on the recordkeeping forms that employers are already required to keep.

In response to the comments above, OSHA agrees that employees will be able to use the collected and published data from Forms 300 and 301 to improve workplace safety and health. The collection and subsequent publication of this data will allow employees to analyze injury and illness data that is not currently available. The online availability of such data will allow employees to compare their own workplaces to other workplaces in their industries. Also, with access to establishment-specific, case-specific data, employees will be better able to identify emerging injury and illness trends in their industries and push for changes in safety and health policies to better protect workers. In addition, employees and their representatives will be able to use the large amount of newly available case-specific information to develop effective education and training programs to identify and reduce workplace hazards.

With regard to the comments expressing concern about employee privacy, as discussed elsewhere, OSHA is confident that the agency will be able to protect information that could reasonably be expected to identify individuals directly. The combination of not requiring employers to submit certain information, and the improved technology used to identify and remove personal information in the collected data, greatly reduces the risk that reasonably identifiable employee information will be disclosed to the public. Again, OSHA believes the significant benefits to improved workplace safety and health outweigh the slight risk of information that could reasonably be expected to identify individuals directly being disclosed to the public.

Other commenters stated that, currently, employees and their representatives only have online access to general data from the Form 300A or aggregate data from the BLS SOII (Docket IDs 0063, 0078). Worksafe commented, “electronic publication of case-specific information on injuries, illnesses, and even fatalities will allow firms' own employees to access timely information that they can use to improve their own workplaces” (Docket ID 0063). Also, Unidos US, Farmworker Justice, and Texas RioGrande Legal Aid commented that, using currently available BLS data, it is impossible to know how many farmworkers specifically suffer from heat-related illnesses. These commenters explained that with access to case-specific Forms 300 and 301 data, employees and their representatives will be able to search information online to identify specific workplace hazards and direct their resources to those hazards (Docket ID 0078).

On the other hand, some commenters stated that employees already have access to the information they need. The National Propane Gas Association commented, “Potential employees or the general public can assess an entire industry through the Bureau of Labor Statistics data that OSHA referred to in the proposal” (Docket ID 0050).

In response, OSHA disagrees with the National Propane Gas Association that potential employees only need access the aggregate industry information though the SOII. As discussed above, aggregate data from the SOII, as well as the general summary data from the Form 300A, do not provide employees with access to case-specific information at individual establishments. As explained by other commenters, online access to the establishment-specific, case-specific, injury and illness data will allow employees to search and identify other establishments and occupations in their industries and compare the injury and illness data at their establishments with the safest workplaces. Also, both current and potential employees will have better access to health and safety information about specific occupations and workplaces and will be able to better identify and understand the specific risks they face in their own jobs. Importantly, and as noted by commenters, access to Forms 300 and 301 data will enable employees to track specific injuries and illnesses, such as heat-related illnesses, throughout their industries.

Some commenters stated that, even though employees have a right of access to the OSHA recordkeeping forms under 29 CFR 1904.35, some workers may fear retaliation from their employer if they request access to information from the 300 and 301 forms at their workplace ( e.g., Docket IDs 0049, 0061, 0063, 0089, 0093). National COSH commented, “Making the case specific data publicly available as proposed in the standard will also increase worker safety for the employees in the establishments with 100 or more employees. Workers are too often scared of retaliation if they request this information, even though employers are required to provide access to the full 300 logs to employees upon request. This information will allow employees in these establishments access to this data without fear of retribution and it will help them better identify patterns of injuries and hazards and to take actions to have the hazards abated.” (Docket ID 0048). NELP submitted a similar comment (Docket ID 0049). Additionally, Centro del Derecho del Migrante commented, “Public access to these data will also improve worker safety by allowing workers and their advocates to better identify patterns of injuries and hazards in workplaces and across industries . . . Publishing this information will allow employees in these establishments access to this data without fear of retribution, and to demand abatement of hazards in their own workplaces and industries.” (Docket ID 0089).

There were also comments stating that, despite the access requirements in 29 CFR 1904.35, many employers either deny or delay access to case-specific information to employees and their representatives. The United Food and Commercial Workers Union (UFCW) commented, “The public access provisions of this rule allow workers to get important information through the OSHA website, rather than navigate these hurdles with employers” (Docket ID 0066). UCFW added that it has had success in monitoring injury and illness data and working with employers to apply the data to injury and illness prevention efforts, but noted that workers in non-union workplaces do not have the same ability to access the data, and that this rule would help “bridge that gap” by providing all workers with access (Docket ID 0066). Another commenter explained that, even when injury and illness information is provided to employees, the information is not in a usable format. The Strategic Organizing Center commented that, even when workers request access to part 1904 information, “they do not have any specific right to receive them in a way which achieves the goal of facilitating the analysis. This is especially important for workers at the larger employers covered by the proposed reporting requirement for the 300/301 data” (Docket ID 0079).

In response, and as discussed above, OSHA's recordkeeping regulation at 29 CFR 1904.35 already provides employees and their representatives with access to the three OSHA recordkeeping forms kept by their employers, with some limitations. Under § 1904.35, when an employee, former employee, or employee representative requests access to certain information on Forms 300 or 301, the employer must provide the requester with one free copy of the information by the end of the next business day. Any delay or obstruction by an employer in providing the required information to employees or their representatives would be a violation of the recordkeeping regulation. And, retaliation against an employee for requesting this information would violate Section 11(c) of the OSH Act.

OSHA agrees with commenters who stated that making establishment-specific, case-specific, injury and illness information available online will enhance worker safety and health, particularly where employees are reluctant to request access to such information. If workers fear possible retaliation from their employer, employees will easily be able to access the case-specific data for their own workplace online, thus avoiding the need to request the information from their employer. This uninhibited access will allow employees to better identify and address hazards within their own workplaces.

In addition, since certain case-specific injury and illness data will be posted online, employees will easily be able to search the collected information to identify specific hazards at their workplaces. Online posting also eliminates the problem noted by some commenters that, in some cases, when employees request injury and illness information from their employer, the information is provided on paper or in a format that is not searchable. Also, the online posting of data allows employees to conduct searches at any time to identify injury and illness trends at their workplaces.

Public Citizen commented, “[P]otential employees will benefit from the availability of injury and illness data from establishments as they make informed decisions about employment. Workers can compare injury rates between potential employers and choose to work for the safer employer. This puts power in the hands of labor, incentivizing employers to improve safety given the competition for workers.” (Docket ID 0093).

On the other hand, the Phylmar Regulatory Roundtable OSH Forum expressed concern that the Form 300 and 301 data could be used to build worker profiles that result in hiring decisions based on an employee's injury and illness history and a high number of days away from work (Docket ID 0094). Similarly, Brian Evans commented, “Since this data is public record, future employers would have access to this information and could potentially discriminated against future hires based on injured parties being listed in a work place related injury. It could also lead to retaliation if the employee who was injured on the job choses to stay employed in their current role. Leadership, management, administration could view them as unsafe employees and limit their growth potential at their organization, or seek ways to terminate their employment due to the filing of a work place injury.” (Docket ID 0080).

In response, OSHA agrees with the comment from Public Citizen that the published Form 300 and 301 data will assist potential employees in researching establishments where the risk to workers' safety and health is low. At this time, potential employees only have access to the limited injury and illness data that is currently available to the public as discussed above. Access to Form 300 and 301 data not only provides job seekers with an opportunity to review information about individual workplaces, but also allows them to analyze the injury and illness history of specific job titles within a given industry or workplace. Potential employees can also identify trends among and between occupations, and at specific sites within one workplace. Also, as noted by Public Citizen, access to this information by potential employees should provide an incentive to employers to improve workplace safety and health. Specifically, the publication of Form 300 and 301 data will encourage employers with more hazardous workplaces in a given industry to make improvements in workplace safety and health to prevent injuries and illnesses from occurring, because potential employees, especially the ones whose skills are more in demand, might be reluctant to work at more hazardous establishments. OSHA disagrees that employers will use the published data from this final rule to discriminate against current or potential employees. With regard to potential employees, and as discussed in more detail in Sections III.B.6 and III.D of this Summary and Explanation, because OSHA is not requiring the electronic submission of information that could reasonably be expected to identify individuals directly ( e.g., name, contact information), and because the agency is using improved technology to identify and redact such information before publication, it is extremely unlikely that employers will be able to use the published data to identify specific individuals and determine their injury and illness history. As for current employees, OSHA notes that employers are already required under part 1904 to include certain potentially identifiable information about an employee when they sustain a work-related injury or illness ( e.g., employers must enter the injured or ill employee's name on the OSHA 300 log). As a result, the publication of case-specific de-identified injury and illness data under this final rule will have no impact on an employer's ability to identify their own injured or ill employees.

After consideration of these comments, OSHA has determined that employees, potential employees, and employee representatives will be able to use the collected data from Forms 300 and 301 to improve workplace safety and health, including through better access to the data in usable formats and without fear of retaliation. OSHA notes the many examples in the rulemaking record provided by commenters on not only how employees and their representatives currently use establishment-specific, case-specific, injury and illness data, but also on how they will be able to use the greater access to such information provided by this final rule to reduce occupational injuries and illnesses.

e. Beneficial Ways That Federal and State Agencies Can Use the Data From Forms 300 and 301

OSHA received a number of comments in response to the question in the NPRM about the ways in which Federal (besides Federal OSHA, which is addressed above) and State agencies will be able to use the data collected under this final rule to improve workplace safety and health. Multiple commenters, including the National Employment Law Project, the Centro de los Derechos del Migrante, and Richard Rabin, noted generally that the centralized collection of and access to case-specific data will benefit the worker safety and health efforts of NIOSH, State agencies, and the public health community ( e.g., Docket IDs 0040, 0045, 0048, 0049, 0051, 0064, 0084, 0089). AIHA stated that “With the limited resources available to most federal and state worker health and safety programs, targeted programs will provide the most benefit for workers and companies. These data will provide information so that priorities can be set and outcome trends monitored” (Docket ID 0030).

There were also comments from Federal entities about their intended uses of the data. For example, NIOSH commented, “As potential end users of the data, NIOSH supports the improvements that are being proposed by OSHA. NIOSH believes that the increased coverage of employers within identified industries and the collection of the additional detailed information that is not currently electronically captured will offer greater potential for detailed and comprehensive data analyses compared with the current data. NIOSH uses occupational injury data to monitor injury trends, identify emerging areas of concern, and propose research intervention strategies and programs. Current OSHA data reflect a smaller proportion of select industries and offer limited details. This new rule would offer greater coverage of select industries and more detailed data, which would increase the value and utility of these occupational injury data to NIOSH.” (Docket ID 0035, Attachment 2; see also Docket ID 0089).

In addition, NIOSH's comment listed more specific purposes for which it can use the collected data, including:

• Using the narrative data from Forms 300 and 301 for learning the particular ways in which injuries occur in specific work tasks and industries (citing work NIOSH has done with narrative data from individual workers' compensation claims in Ohio).
• Using the coded OSHA Log case data with narratives as a very large training data set that could be used to improve the autocoding of workers' compensation claims. As NIOSH stated, “[a]utocoding workers' compensation claim narratives is critical to producing injury rate statistics that can guide prevention efforts by identifying high and increasing rates of specific types of injuries in specific industries and employers.”
• Improving the effectiveness and efficiency of workplace inspections through the evaluation of more complete, detailed data on certain types of injuries at specific workplaces. As an example, NIOSH noted a series of studies supported by NIOSH where amputation cases at specific workplaces were identified based on hospital records and workers' compensation claims; the information was then provided to Michigan OSHA, which used it to target inspections.
• Linking workers' compensation data to OSHA logs in order to provide a more complete set of information than either data set provides separately. This effort has the potential to improve identification and prevention of injuries, especially among temporary employment agency workers, who constitute a vulnerable population of workers with a disproportionate burden of workplace injuries.
• Collaborating with National Occupational Research Agenda Councils and OSHA to “improve dissemination and use of the published data to improve identification, mitigation, and prevention of workplace injuries and illnesses” (Docket ID 0035, Attachment 2).

National COSH agreed with NIOSH, noting that making these data publicly available will assure that researchers and other agencies, like NIOSH, can use the data for surveillance, evaluation, and research purposes (Docket ID 0048).

In addition to the benefits of the data at the Federal level, multiple commenters addressed the value of the final rule's data collections to the States and to State occupational safety and health efforts. In the preamble to the 2019 final rule, OSHA acknowledged “that systems to collect this volume of data would be costly for States to implement. Centralized collection might be more efficient and cost-effective than state-by-state collection . . .” At that time, OSHA stated that it had “doubts about the usefulness of the data and concerns about the costs of collection,” but reiterated that States were nonetheless “empowered to do as OSHA ha[d] and weigh the substantial costs of collection against the likely utility of the data” (84 FR 394). In response to the NPRM in the current rulemaking, many commenters made it clear that State efforts to improve workplace safety and health will benefit from the data that is made available by this rule, and that a national collection system is a far more efficient means of achieving these benefits than individual State efforts. National COSH noted similar benefits at the State level as at the Federal level, stating that State and community public health agencies will be able to use the data to better understand the hazards in high-risk establishments and then target those establishments for assistance and information regarding best practices (Docket ID 0048). Likewise, the Council of State and Territorial Epidemiologists (CSTE) commented, “Access to these data would also facilitate public health agency efforts to reduce work-related injuries and illnesses in the States and significantly increase the potential for more timely identification of emerging hazards. Electronic collection of existing records is in line with 21st century advances in health data collection made possible by advances in information technology that involve centralized collection, analysis, and dissemination of existing data from multiple entities. These include, for example, collection at the State level of data on all hospitalizations, all emergency room visits, and all ambulance runs, and in over 20 States, data on all public and private insurance claims (excluding workers' compensation claim data). . . . Making this information broadly available is consistent with the growing recognition, predominant in the patient safety field, that transparency—sharing of information, including information about hazards—is a critical aspect of safety culture.” (Docket ID 0040).

In addition, CSTE provided specific examples of ways in which the electronic reporting of case-level workplace injury and illness data can enhance State health department and others' efforts to reduce work-related injuries and illnesses and hazards in States and communities. These examples included:

• Identification of emerging problems: “The ability to search file level data not only in the establishment where the index case is/was employed but also other establishments in the industry to identify similar cases has the potential to facilitate timely identification of emerging hazards” that are “both new and newly recognized.” CSTE discussed an example from Michigan, where a State agency identified several deaths associated with bathtub refinishing, raising new concerns about the hazards of chemical strippers used in this process. Subsequent review of OSHA IMIS data identified 13 deaths associated with bathtub refinishing in a 12-year period.^[6] These findings from the State and Federal databases together led to the development of educational information about the hazards associated with tub refinishing and approaches to reducing risks; this material was disseminated nationwide to companies and workers in the industry.

• Targeting establishments for preventive outreach in our communities: “Public health investigations of work-related incidents result not only in prevention recommendations to those involved in the incident, but in case studies which allow us to then take lessons learned and disseminate these lessons broadly to other stakeholders. The availability of information on high-risk establishments will allow for more targeted and efficient information dissemination. The ability to identify lower risk establishments may also provide new opportunities to learn from employers who are implementing best practices—and potentially to help identify under-reporters. The availability of establishment specific information offers the opportunity to incorporate occupational health concerns in community health planning, which is increasingly providing the basis for setting community health and prevention priorities.”

• Improvement of data quality and use of the data: “Observations from interviews with OSHA record-keepers in Washington State suggest that incomplete OSHA records arise in part from lack of knowledge or confusion on the part of some employers about how to accurately and consistently record OSHA reportable cases and from poor employer prioritization of this task. . . . Electronic data collection and the subsequent public release of the data are means to improve data quality, knowledge, and compliance with OSHA recordkeeping requirements. Electronic collection of data offers the opportunity to provide employers with electronic tools ( e.g., prompts, definitions, consistency edits, and industry-specific drop-down lists) to improve the quality of the data reported. Standardized feedback to establishments and potential reports of establishment-specific data would promote the use of the data by employers and workers to set health and safety priorities and monitor progress in reducing workplace risks.”

• Improvements in Medical Care: “This record keeping rule, by facilitating the diagnosis of work-related conditions, will allow for better diagnosis and management of workplace illnesses by health care providers in the community, thereby contributing to a reduction in morbidity, absenteeism, and health care costs.” CSTE described an example from Massachusetts, which has a sharps injury prevention control program. This program supplements OSHA's bloodborne pathogens standard by requiring hospitals to report select data from the OSHA-required log of sharps injuries annually to the Massachusetts Department of Public Health (MDPH). In recent years, data from all hospitals, which range in size from less than 150 to over 20,000 employees, have been submitted through a secure electronic transmission. Annual hospital-specific data and statewide reports prepared by MDPH provide information on patterns of sharps injuries and sharps injury rates for use by hospitals and hospital workers as well as MDPH. As CSTE stated, this experience in Massachusetts “indicates the utility of electronic reporting of person level occupational injury data for targeting prevention efforts at multiple levels” (Docket ID 0040).

The International Brotherhood of Teamsters noted that they agreed with these comments from CSTE (Docket ID 0083).

Similarly, the Strategic Organizing Center commented that States can use the collected data to compare injury and illness rates at specific establishments to the rates for that industry in general. The SOC also emphasized that “OSHA's collection and distribution of . . . key metrics will finally provide a measure of transparency to workers, OSHA and its state partner agencies, the media and the public about the nature of the serious injuries afflicting workers at large employers in hazardous industries across the nation” (Docket ID 0079).

OSHA also received comments from the States themselves ( e.g., Docket IDs 0045, 0069, 0084). One comment that was strongly supportive of the rule came from the Seventeen AGs. These State officials represented nine States with OSHA-approved State Plans that cover both private and State and local government workers (California, Hawaii, Maryland, Michigan, Minnesota, Nevada, New Mexico, Oregon, and Vermont), four States that have OSHA-approved State Plans that cover State and local government workers only (Connecticut, Illinois, New Jersey, and New York) and four States without a State Plan (Delaware, the District of Columbia, Massachusetts, Rhode Island). Their comment cited increased transparency regarding workplace safety, as well as benefits to key interested parties (including employees, consumers, employers, researchers, and the States themselves) (Docket ID 0045).

The Seventeen AGs commented that States planned to use the collected data for multiple specific purposes, including to: improve targeting and outreach (New Jersey); develop the next strategic inspection plan (Connecticut); ease administrative burden (Hawaii); target recordkeeping inaccuracies (Illinois); prioritize and increase efficiency of enforcement efforts (Maryland); improve the ability of a State advisory board on occupational safety and health to develop effective workplace injury prevention programming (Massachusetts); discern patterns in the frequency and severity of injuries (Minnesota); and inform future enforcement plans (Nevada). With the data that will become available to them, States will also be able to institute or improve targeted training and outreach programs, identify and investigate incidents in particular categories of concern (such as those that lead to ongoing disability and require accommodations under the Americans with Disabilities Act), compare the data to other data sources (such as workers' compensation data), identify workplace injury and illness underreporting, improve their ability to consider companies' workplace safety and health records when making contracting decisions, and increase the specific workplace injury and illness information available to State health agencies (Docket ID 0045). The AFL–CIO touted the prevention index created by Washington State, which operates both an OSHA State plan and the State workers' compensation program. The State “utilizes the detailed injury and illness data collected through its workers' compensation system, similar to the data contained in the Form 300 and Form 301, to develop a prevention index. The index identifies the most common and costly injuries and illnesses and the industry sectors with the greatest potential for prevention” (Docket ID OSHA–2013–0023–2088, Attachment 1).

In addition, the Seventeen AGs noted, “[T]hese benefits will only accrue if OSHA collects and publishes such data. Not all states have the resources to create and manage their own databases, and, in any event, it is costlier and more inefficient for individual states to create separate databases. Data from a single jurisdiction is also much less likely to reveal patterns in workplace health and safety. Uniform national data collection efforts, by contrast, will also allow states to benchmark their performance—overall or in specific industries—against peer states in ways that might encourage or promote reforms, interventions, or legislation to address workplace safety issues. Moreover, even if the [s]tates are not able to engage in targeted enforcement now, it is nonetheless important to begin collecting and publishing more detailed data now. . . . And when the [s]tates implement targeting in the future, having a larger database of historic data on which to `train' targeting algorithms will ensure that these algorithms are more accurate.”(Docket ID 0045). The International Brotherhood of Teamsters commented with support for “the benefits touted by the letter [from the Seventeen AGs] on the need for public reporting of detailed injury and illness information to the [s]tates' enforcement and regulatory agencies” (Docket ID 0083).

The California Department of Industrial Relations (DIR), Division of Occupational Safety and Health (Cal/OSHA), and the Connecticut Council on Occupational Safety and Health (ConnectiCOSH) also provided separate comments in support of the proposed rule, citing benefits to worker safety (Docket IDs 0069, 0084). Cal/OSHA stated that the availability of the additional data would aid in “identifying patterns that are currently masked by the aggregation of injury/illness data by industry in existing data sources.” Furthermore: “[D]etailed case level data could be used when proposing new prevention-oriented regulations to California's Occupational Safety & Health Standards Board (OSHSB), when responding to petitions to OSHSB for new or amended standards, and in the creation of specific compliance assistance materials oriented to existing or emerging workplace safety problems.” Cal/OSHA also emphasized that centralized data collection by OSHA “is the most efficient and cost-effective way to compile and utilize the data for prevention purposes,” and the cost to States of “setting up parallel systems . . . would be significant” (Docket ID 0084; see also Docket ID OSHA–2013–0023–2088, Attachment 1).

After consideration of these comments and others in the record, OSHA has determined that the expected benefits to Federal and State agencies overcome any doubts the agency expressed in the 2019 final rule related to the usefulness of the data and the costs of collection. OSHA has determined that Federal and State agencies will be able to use the collected data to improve workplace safety and health. The agency especially notes the benefits for States, which may not have the resources to create and manage their own data collections; the inefficiency of multiple State-specific databases versus a single national database; and the advantages of a uniform national data collection requirement. OSHA finds particularly convincing the examples of State and Federal entities' past and planned future uses of the data to monitor, target, and prevent occupational injuries and illnesses.

f. Beneficial Ways That Researchers Can Use the Data From Forms 300 and 301

Multiple commenters provided examples of ways that researchers could use the collected data to improve workplace safety and health. Most generally, AIHA commented, “Researchers require a stable data source to conduct studies that depend on unbiased, complete data sets. By collecting and making the data available to researchers, stratified analyses with sufficient power can be conducted that will make the results more generalizable to specific workers and industries.” (Docket ID 0030). Similarly, Centro del Derecho del Migrante commented, “Public access to these data will better allow organizations like CDM to identify patterns of injuries and hazardous conditions in workplaces and advance worker safety and health” (Docket ID 0089).

Numerous commenters pointed out the limitations of currently available data from BLS, and the need for more data to produce statistically significant, robust results for more detailed categories of injuries, establishments, and employers. NIOSH commented that the release of summary injury data for all establishments of 20 or more employees in certain industries and of individual injury case data for injuries in establishments of 100 or more employees in certain industries would produce more accurate and statistically meaningful data than the BLS Annual Survey can provide “because the number of included injury records would be much greater than that included in the BLS sample of establishments of this size in these industries.” NIOSH stated that “the proposed data collection in higher risk industries would enable more detailed and accurate statistics on the state as well as the national level.” In addition, the new data collection OSHA plans to make available “would provide establishment-specific, case-specific injury and illness data for analyses that are not currently possible.” NIOSH also stated that the release of the data collected by OSHA should make it possible to produce meaningful statistics and perform more in-depth analysis by combining records across several years by industry, employer, or establishment, which is not possible with the BLS SOII data that is currently available (Docket ID 0035). The International Brotherhood of Teamsters concurred with this comment (Docket ID 0083).

The National Employment Law Project (NELP) commented on the need for expanded, more detailed data: “NELP recently used the currently available establishment-level Injury Tracking Application data to conduct state-specific analyses on injury and illness rates in the warehousing sector. However, with access only to electronically submitted data from Form 300A and not from Forms 300 and 301, we were limited by an inability to disaggregate by the types of serious injuries and serious illnesses. In addition, having access to case-specific injury and illness data as reported in 300 and 301 forms would have allowed NELP to identify specific injury and illness trends, and correlate these with job titles, in order to more directly address and prevent hazards that put workers at risk.” (Docket ID 0049).

The AFL–CIO commented that access to more detailed data would provide researchers with an invaluable source of information on workplace safety and health hazards (Docket ID 0061). The AFL–CIO also pointed to the limitations for researchers of the BLS SOII data: “Studies have shown that the SOII data have significant limitations and that consistent and representative mandatory reporting would provide a more accurate data source for research on causes of injuries and illnesses and prevention methods to track improvements and emerging issues.” (Docket ID 0061).

Commenters also provided examples of how researchers have used data to improve workplace safety and health. For example, The Strategic Organizing Center described its analysis of ITA data to prepare reports on occupational injury rates among warehouse workers. It stated: “This example, we believe, completely vindicates OSHA's original intent in establishing the Injury Tracking Application, including the public release of the data received from employers. Absent the easy availability of these data, it would be difficult if not impossible for those outside the management structure of major employers to understand the basic details of the worker safety and health situation at these companies, much less to force employers with deficient performance to change their practices. It is vital that employers who attempt to misrepresent the failures of their worker safety and health systems understand that they are subject to the independent oversight and review that can only be offered by broadly-available distribution of key metrics, such as the numbers, rates and characteristics of worker injuries and illnesses.” (Docket ID 0079).

The Strategic Organizing Center also pointed to injury research in the hotel industry as an example of the value of OSHA's providing the 300 and 301 data for further analysis: “In the mid-2000's, as the hotel industry was rapidly introducing heavier mattresses and increased workloads for housekeepers, the hotel union UNITE HERE undertook an analysis of the 300 logs and employee personnel demographic data to determine injury trends by injury type, job title, gender and race/ethnicity. We published [a] study by Buchanan et al in 2010, the value of which OSHA recognized in the preamble to the 2016 Final Injury Tracking Rule (81 FR 29685, Col. 3). It revealed that the rates of different injury types varied greatly across the study population of 55,327 person-years over a 3-year period at 50 hotels in five of the largest US hotel chains. We found that MSD's were highest among housekeepers, and acute traumatic injuries highest among cooks/kitchen workers, and injury rates higher among women than men. Much of the various increased risks was driven by the exceptionally high risks endured by hotel housekeepers (7.9 injuries/100 person-years).” (Docket ID 0079).

The Communication Workers of America (CWA) commented on the value of access to large datasets of workplace injury and illness information. It gave examples of data analyses it has conducted to address safety and health issues:

• CWA has analyzed large quantities of OSHA Log data for certain regions from some large telecommunications employers. It was able to compare aggregate worksite data from two different regions for the same employer for the same year. Its comparison of aggregate OSHA 300 Log data from two different regions for the same employer shows a large discrepancy in work-related COVID cases recorded on the OSHA 300 Logs and also demonstrates the value of the Cal/OSHA COVID standard's reporting requirements given the increased reporting for sites in California.
• Recent and past analyses by a telecommunications employer of its OSHA Log data for work locations in NY has shown the toll of injuries and lost work days related to manhole cover lifting. The employer, the union and union members worked together to conduct ergonomic assessments using biometric sensors to evaluate the strain of manhole cover lifting using different designs of manhole cover lifters. The biometric assessments combined with worker feedback led to design of a new, vehicle mounted manhole lifting device. The employer will likely use the newly-approved manhole cover lifters in other areas of the country where it operates. Aggregate OSHA 300 Log data will aid in evaluating the effectiveness of this intervention in reducing and preventing manhole cover lifting injuries.
• An analysis by one employer of OSHA recordable injury/illness data for the previous year from all worksites on Long Island, NY revealed there had been over 11,000 lost work days due to extension ladder accidents. After training, the number of extension ladder accidents in those work locations dropped significantly, to almost none. This initiative looked at aggregate data from one employer's multiple worksites. Establishment-specific data, on its own, would not have revealed the extent of the problem and the need for interventions, nor would it have incentivized the employer to take action and provide training.
• Analyses of OSHA 300 Log data has led to multiple safety improvements in CWA-represented manufacturing facilities with active health and safety committees. At locations where CWA members build engines and engine parts, OSHA 300 Log data analyses has resulted in ergonomic assessments and training, the provision of better PPE, and improved safety protocols.

(Docket ID 0092)

After consideration of these comments, OSHA has determined that researchers will be able to use the collected data to improve workplace safety and health. OSHA finds particularly convincing the examples of past and planned future uses of the data by researchers to monitor, target, and prevent occupational injuries and illnesses.

g. Beneficial Ways That Workplace Safety Consultants Can Use the Data From Forms 300 and 301

In the proposed rule, OSHA asked, “What are some ways that workplace safety consultants could use the collected data to improve workplace safety and health?” (87 FR 18547). OSHA received several comments about ways that workplace safety consultants could use the collected data to improve workplace safety and health (Docket IDs 0026, 0030, 0035). Most generally, AIHA commented that the value that workplace safety consultants bring to a company is directly related to the availability of high-quality data, and “[c]ompanies that engage consultants depend on the consultant to be fully informed of the inherent risks of specific operations, tasks, and industries so that the recommendations for improvement and correction are based on evidence” (Docket ID 0030). Justin Hicks commented that the collected data would be useful “[a]s a young safety professional . . . when educating my employer on safety culture” (Docket ID 0026). Additionally, NIOSH identified a number of ways in which workplace safety consultants might use this data, including “identifying and disseminating useful facts about the comparative safety performance of establishments, employers, and employer groups,” and “analy[zing] patterns of injury causation at their client workplaces and appropriate comparisons of workplaces” (Docket ID 0035, Attachment 2). NIOSH also noted that consultants' work with the collected data “promises to assist other stakeholders in identifying patterns of injuries and targets for prevention and to complement the research disseminated by state and federal agencies” (Docket ID 0035, Attachment 2).

OSHA agrees with these commenters that the collected data will help workplace safety consultants to be fully informed of the risks of specific operations, tasks, and industries and, in turn, will give consultants the information necessary to advise their employers on safety and health practices. Accordingly, OSHA has determined that workplace safety consultants and other workplace safety professionals will be able to use the collected data to improve workplace safety and health.

h. Beneficial Ways That the Public Can Use the Data From Forms 300 and 301

In the proposed rule, OSHA asked, “What are some ways that members of the public and other stakeholders, such as job-seekers, could use the collected data to improve workplace safety and health?” (87 FR 18547). Several commenters provided insights about how the general public, the media, and prospective employees will be able to use the collected data to improve workplace safety and health. With respect to the general public, Hunter Cisiewski commented that the public availability of data would “allow the public to hold companies accountable for creating unsafe workplaces” and “make informed decisions about . . . what industries they should support,” as well as “incentivize employers to create safe working conditions” (Docket ID 0024). The Seventeen AGs commented that the availability of data would benefit consumers, “who can use information about employer safety to inform their purchasing and contracting decisions” (Docket ID 0045). In addition, Worksafe commented that the press and advocacy organizations could “monitor and report on the data” (Docket ID 0063).

Commenters also addressed how job seekers could use the collected data to improve workplace safety and health (Docket IDs 0020, 0024, 0030, 0063, 0082). For example, Hunter Cisiewski commented that the data would allow prospective employees “to make informed decisions about where they should work” (Docket ID 0024). AIHA commented that access to the collected data would allow job seekers to “inquire about specific health and safety practices or culture during interviews,” help them to be more informed, and encourage prospective employers to be more transparent (Docket ID 0030). Similarly, Worksafe commented that the availability of injury and illness data would allow job seekers “to better assess the types, severity, and frequency of injuries and illnesses in a particular workplace” and make more informed decisions regarding their employment” (Docket ID 0063). Additionally, the Seventeen AGs commented that public access to detailed injury and illness data would “empower” workers who are most impacted by occupational hazards, i.e., low-income workers and workers belonging to racial and ethnic minority groups, “to make informed decisions regarding where they choose to work” (Docket ID 0045).

On the other hand, multiple commenters asserted that the data would not be useful to the public. The overarching concern of these commenters was that the public would lack the context necessary for the data to provide an accurate picture of an establishment's safety and health practices (Docket IDs 0021, 0043, 0050, 0052, 0053, 0062, 0071, 0075, 0086, 0090). For example, the National Propane Gas Association commented that the collected data would “mislead” the public because it is “only a fraction of information regarding a workplace” and, in order to provide accurate information about worker safety, OSHA would also need to publish information such as “the number of uninjured or healthy individuals working for the establishment; . . . the safety procedures or policies implemented, days/weeks/months/years without injuries or illnesses; . . . a comparison of the frequency or average for the industry versus the specific establishment; . . . actions by the employee that caused or contributed to the injury or illness; . . . [and] the corrective actions by the establishment” (Docket ID 0050). Similarly, Angela Rodriguez commented that injury and illness data may be misleading “without the explanation of contributing root causes” (Docket ID 0052). Likewise, Representatives Virginia Foxx (R-North Carolina) and Fred Keller (R-Pennsylvania) commented that “an employer's injury and illness logs say nothing meaningful about an employer's commitment to safety and compliance with OSHA standards,” and “[m]any factors outside an employer's control may lead to workplace injuries and illnesses” (Docket ID 0062). And, the Plastics Industry Association commented that when viewing an employer's injury and illness data in isolation, “[t]here is insufficient context to draw conclusions about the employer's safety program or practices” (Docket ID 0086).

Commenters pointed to a number of reasons for their concern about misinterpretation or misleading data. Some commenters expressed concern that the collected data may be misleading specifically because it may include injuries or illnesses that are not the employer's fault (Docket IDs 0021, 0043, 0052, 0075, 0086, 0090). For example, the Motor and Equipment Manufacturers Association and the Flexible Packaging Association commented that data may be misinterpreted because many workplace injuries occur due to circumstances entirely outside of an employer's control (Docket ID 0075, 0090). More specifically, AWCI commented that some injuries and illnesses are “due solely to employee misconduct,” or “the fault of neither the employer nor the employee” (Docket ID 0043). AWCI also commented that “falsified or misrepresented workplace injury or illness claims” may result in inaccurate data, as will workplace fatalities that are later determined not to be work-related (Docket ID 0043). Similarly, Angela Rodriguez commented that under 29 CFR 1904.5(b)(2)(ii), employers are required to record injuries and illnesses for which symptoms surface at work but result solely from a nonwork-related event or exposure that occurs outside the work environment (Docket ID 0052). The Chamber of Commerce claimed that injury and illness data are unreliable because workers' compensation programs and the presence of collective bargaining agreements affect the number of injuries and illnesses reported to OSHA, therefore, “[t]wo employers with the same kinds of injuries will be viewed by OSHA and the public as differently culpable” (Docket ID 0088, Attachment 2). Finally, the Plastics Industry Association commented that “many injuries that have no bearing on an employer's safety program must be recorded,” and pointed to injuries resulting from employee misconduct, substance abuse, and accidents as examples (Docket ID 0086).

Other commenters were concerned that the collected data would lead to misinterpretation because the data do not provide an accurate picture of what is currently happening or what will happen in the future. The Motor and Equipment Manufacturers Association commented generally that “injury and illness data would become stale by the time it is made public” (Docket ID 0075). AWCI commented that “[l]agging indicators . . . such as OSHA recordable/reportable injury and illness data[ ] have shown to be poor indicators of future safety and health performance” because they “present information about what has occurred in the past with no mechanism for accurately predicting what may occur in the future” (Docket ID 0043).

Still other commenters said that the public would be even more likely to misinterpret data from small businesses. AWCI commented that “the formula that OSHA uses [to calculate injury and illness rates] is based on 100 full-time workers and the denominator in the equation is the total number of hours worked by all employees,” so “the resulting incidence rates often depict extremely inaccurate perceptions of smaller establishments' safety and health cultures and past safety and health performances” (Docket ID 0043). Similarly, the Associated Builders and Contractors commented, “by expanding the mandate to 100 or more employees from 250, OSHA's proposal puts smaller companies at a disadvantage by making them appear to be less safe than larger companies by comparison. A smaller company with the same number of injuries and illnesses as a larger company is likely to have a higher incident rate” (Docket ID 0071).

In response, OSHA agrees with those commenters who stated that the public will be able to use the published establishment-specific, case-specific, injury and illness data to improve workplace safety and health. The online availability of such data will allow members of the public to determine which workplaces in a particular industry are the safest, and identify emerging injury and illness trends in particular industries. As noted by commenters, the public may use this data to make decisions about what companies and industries they support and want to work for. The availability of data will also facilitate the press's ability to monitor and report on it, which will further ensure that members of the public are well-informed and can make decisions accordingly. For these reasons, and as explained above, OSHA finds that public access to this data will ultimately help to improve workplace safety and health.

Generally, to the extent the commenters suggest that the case-specific data from Forms 300 and 301 will not be useful information to the public, OSHA disagrees, and finds that the benefits of expanded public access to this data outweigh commenters' concerns. As OSHA explained in the final rule on Occupational Injury and Illness Recording and Reporting Requirements (January 19, 2001), injury and illness records have long made employers more aware of the injuries and illnesses occurring in their workplaces, and are essential in helping employers to effectively manage their safety and health programs. Additionally, such records ensure employees are better informed about hazards they face in the workplace and encourage employees to both follow safe work practices and report workplace hazards to employers (66 FR 5916–67). For similar reasons, as identified by commenters and explained above, the public can use such data to improve workplace safety and health.

However, OSHA acknowledges commenters' concerns about potential misinterpretation and recognizes that the public may need more assistance in understanding the data than employers, researchers, and other similar interested parties. OSHA recognizes the need to provide information to the public to aid their understanding of the data. The web page for the ITA ( https://www.osha.gov/​Establishment-Specific-Injury-and-Illness-Data) contains several explanations of the data that address commenters' specific concerns, including:

• “Recording or reporting a work-related injury, illness, or fatality does not mean that the employer or employee was at fault, that an OSHA rule has been violated, or that the employee is eligible for workers' compensation or other benefits.”
• “While OSHA takes multiple steps to ensure the data collected is accurate, problems and errors invariably exist for a small percentage of establishments. OSHA does not believe the data for the establishments with the highest rates in these files are accurate in absolute terms. Efforts are made during the collection cycle to correct submission errors; however, some remain unresolved. It would be a mistake to say establishments with the highest rates in these files are the `most dangerous' or `worst' establishments in the nation.”

The web page for the data collected through the OSHA Data Initiative ( https://www.osha.gov/​ords/​odi/​establishment_​search.html) also includes the second explanatory note.

OSHA also notes the many examples in the rulemaking record provided by commenters on not only how various interested parties currently use establishment-specific, case-specific, injury and illness data, but also on how they will be able to use the greater access to such information provided by this final rule to reduce occupational injuries and illnesses. Some commenters' concerns seem to hinge on the assumption that the general public lacks the sophistication necessary to understand the collected data. However, this section of the preamble provides many examples of the ways in which employers, employees, government agencies, researchers, and other interested parties will use this data to perform more detailed and accurate analyses of workplace safety and health practices, create education and training programs to reduce workplace hazards, develop resources, and conduct studies. To the extent that members of the public require additional context to make sense of injury and illness data, other interested parties will make that information available through their own use of the data.

Additionally, as explained in more detail in Section III.B.14 of this Summary and Explanation, commenters provided suggestions for ways to make published data more useful to interested parties. The Seventeen AGs also commented that the public may only benefit from the publication of injury and illness data “if it is aware of its existence,” and suggested that OSHA “evaluate and choose effective avenues for publicizing the availability of the data” (Docket ID 0045). OSHA will take these comments into consideration when designing tools and applications to make the published data more accessible and useful to interested parties.

After consideration of these comments, OSHA has determined that members of the public and other interested parties will be able to use the collected data to improve workplace safety and health. OSHA will continue to consider additional ways to assist the public in both awareness of and understanding the data, including through web-based search applications and other products. As explained in the preamble to the proposed rule, the agency plans to make the data available and able to be queried via a web-based tool. Interested parties who are interested in learning about occupational injuries and illnesses will have access to information on when injuries and illnesses occur, where they occur, and how they occur. In addition, interested parties can use the tool to analyze injury and illness data and identify patterns that are masked by the aggregation of injury/illness data in existing data sources. As explained in the preamble to the proposed rule, in developing a publicly accessible tool for injury and illness data, OSHA will review how other Federal agencies, such as the Environmental Protection Agency (EPA), have made their data publicly available via online tools that support some analyses.

For the above reasons, and based on the record in this rulemaking, OSHA believes that the electronic submission requirements, along with the subsequent publication of certain injury and illness data, set forth in this final rule will result in significant benefits to occupational safety and health. OSHA also concludes that the significant benefits to employers, employees, OSHA, and other interested parties described in this section outweigh the slight risk to employee privacy. Accordingly, OSHA has determined that it is necessary and appropriate to require certain establishments to electronically submit case-specific, establishment-specific, data from their Forms 300 and 301 to OSHA once a year.

5. The Freedom of Information Act (FOIA)

Many of the comments OSHA received on proposed § 1904.41(a)(2) related not to the proposed requirement to submit information from OSHA Forms 300 and 301, per se, but rather to OSHA's plan to make some of the data which it receives publicly available on its website (as detailed above). The agency is doing so for two main reasons. First, based on its experience with previous FOIA requests for particular establishments' Forms 300A, 300, and 301 (as contained in inspection files) and for all Form 300A data submitted electronically, OSHA anticipates that it will receive FOIA requests for the Form 300 and 301 data submitted under the requirements of this final rule. Once the agency releases the Form 300 and 301 data submitted under the requirements of this final rule (after applying the appropriate FOIA exemptions), OSHA anticipates (again based on the previous FOIA requests) that it would be required to post the released information online under 5 U.S.C. 552(a)(2)(D), which requires agencies to “make available for public inspection in an electronic format . . . copies of all records . . . that because of the nature of their subject matter, the agency determines have become or are likely to become the subject of subsequent requests for substantially the same records; or . . . that have been requested 3 or more times[.]” OSHA finds that proactively releasing the electronically submitted information from establishments' Forms 300 and 301 would conserve resources that OSHA would otherwise spend responding to such FOIA requests (before the information would be posted online after the agency's initial responses to such requests).

Second, and more importantly from a safety and health perspective, as explained in detail in Section III.B.4 of this Summary and Explanation, above, OSHA believes that the public release of case-specific data from establishments' Forms 300 and 301 will generate many worker safety and health benefits. In short, OSHA anticipates that employers, employees, Federal and State agencies, researchers, workplace safety consultants, members of the public, and other interested parties can use the collected data to improve workplace safety and health. (Comments related to benefits are addressed above in Section III.B.4 of this Summary and Explanation.)

OSHA explained both of these reasons in the proposal (see 87 FR 18535, 18542). OSHA also discussed the similarities between the way it intends to treat the data it would collect and publish under this rule and the way it responds to requests for the same data under FOIA. OSHA explained that it already collects Forms 300 and 301 during many inspections, and often receives requests for them under FOIA. As a rule, OSHA releases copies of the Forms 300 and 301 for closed cases after redacting the same information that will either not be collected or not be published under this rule. OSHA explained that it uses FOIA Exemptions 6 and 7(C) to withhold from disclosure information in personnel and medical files and similar files that “would constitute a clearly unwarranted invasion of personal privacy” or records or information compiled for law enforcement purposes to the extent that the production of such law enforcement records or information “could reasonably be expected to constitute an unwarranted invasion of personal privacy” (5 U.S.C. 552(b)(6), 552(b)(7)(C)). OSHA intended this discussion to reassure the regulated community that it has a great deal of experience in protecting privacy interests when it releases the forms that are at issue in this rule.

Separately, OSHA also pointed out that in multiple cases where it had denied FOIA requests for Form 300A data, which does not include personal information about injured employees, courts had ruled that OSHA had to release the data (see 87 FR 18531). OSHA believes those rulings support its decision here to release non-personal information from the Forms 300 and 301. (One commenter said that the name and telephone number of the executive certifying the accuracy of Form 300A should be considered private information (Docket ID 0086); OSHA agrees; in fact, the agency has never even collected this information as part of its routine data collection of information from the Form 300A through either the ODI or the ITA. Likewise, it will not do so pursuant to this rule.)

A number of commenters reacted to OSHA's discussion of FOIA ( e.g., Docket IDs 0042, 0050, 0070, 0071, 0072, 0076, 0088, 0090, 0094). For example, the National Propane Gas Association (NPGA) said that it “strongly disagrees” with OSHA's argument “that since case-specific, establishment-specific information is subject to FOIA requests, the information is available to the public inevitably and, thereby, the agency's proposal to create a public website merely eliminates the procedural step of a stakeholder submitting a FOIA request.” According to NPGA, a “FOIA request is defined to a specific incident or event, date, and establishment and initiated on the basis of a defined interest by the submitter” (Docket ID 0050). OSHA does not agree. FOIA requests can be filed by any member of the public, with no requirement to show why the requester is seeking the information, and researchers and members of the press file such requests frequently. These requests are often for large quantities of data, not for material related to “a specific incident or event, date, and establishment.”

The Phylmar Regulatory Roundtable (PRR) also expressed concern with OSHA's statements in the preamble about how the agency “generally releases copies of the 300 logs [( i.e., Form 300)] maintained in inspection files in response to FOIA requests after redacting employee names (column B)” (see 87 FR 18532) commenting, “[i]t is not clear what is meant by `generally releases' but it can be assumed it is not often. Currently, OSHA only has access and, more importantly, the ability to release Form 300 Logs that are collected as part of an inspection” (Docket ID 0094). PRR added, ” It is commonly known, and stated in the NPRM, that OSHA does not have the resources to conduct a fraction of the inspections that collection through the proposed rule would produce. In actuality, the previous risk is much lower than what OSHA is now proposing. Also, the privacy is no longer central to FOIA requests because once the data is posted, anyone will have access, without having to make any official requests. Finally, the little protection the FOIA process does provide to protect worker confidentiality will be gone as well.” (Docket ID 0094).

This comment misunderstands OSHA's purpose in discussing its FOIA practice. The section of the NPRM preamble in which the OSHA statements quoted by PRR appear is an explanation of which data from the OSHA Forms 300 and 301 the agency proposed to make available on OSHA's website. In the paragraph in which the sentence commented on by PRR appears, OSHA explained that it plans to collect all the fields in establishments' Form 300 except employee name (column B) and that “[a]ll collected data fields on the 300 Log will generally be made available on OSHA's website” (87 FR 18532). At the end of this paragraph, OSHA explained that it currently “generally releases copies of the 300 Logs maintained in inspection files in response to FOIA requests after redacting employee names” (87 FR 18532). This information was included to explain that releasing information from establishments' Forms 300s is not new; OSHA has been releasing information from both the 300 and 301 forms for some time.

When OSHA said it “generally releases” data, it meant that the default is to release it, unless there is a reason not to do so ( i.e., one or more FOIA Exemptions). For example, if a Form includes information that could reasonably be expected to identify individuals directly, the agency would withhold that information from release under FOIA Exemption 6 or 7(C). Likewise, and as discussed in more detail below, OSHA is utilizing multiple layers of protection to ensure that information which could reasonably be expected to identify individuals directly is protected from disclosure.

OSHA also disagrees with PRR's assertion that “the little protection the FOIA process does provide to protect worker confidentiality will be gone” when this rulemaking goes into effect and with its claim that the risk of worker identification under OSHA's FOIA practice is far lower than that in this rulemaking (Docket ID 0094). As explained extensively throughout this section, OSHA has included multiple layers of protection to protect information that could reasonably be expected to identify individuals directly. Significantly, this includes not collecting some information that is included on the Forms 300 and 301 that OSHA collects during inspections ( e.g., employee names). Thus, the information obtained in this rulemaking is already starting at a less-identifiable point than the information obtained during inspections. And OSHA expects that the remainder of the process, i.e., system design, only releasing certain fields, and using scrubbing technology, will provide comparable protection to that provided under the FOIA process.

OSHA also received comments from a number of interested parties expressing concern about the proposed requirement for establishments to submit and OSHA's plan to publish particular information that appears on establishments' Forms 300 or 301. These commenters alleged that their businesses would suffer in various ways if such information was collected and released. For example, some of these commenters argued that the proposed rule would require employers to submit to OSHA data that the commenters consider to be proprietary and confidential to their businesses, e.g., the number of employees and the hours worked at a particular location are regarded as proprietary information by many companies (Docket IDs 0042, 0071, 0072, 0088, 0090). A comment from the Louisiana Chemical Association is representative of this argument: “The number of employees and the hours worked at a particular location [are] regarded as proprietary information by many companies. This information if revealed provides details regarding the business processes, production volumes, security, and operational status of a facility” (Docket ID 0042). Similar comments were made by the National Retail Federation (Docket ID 0090), the U.S. Chamber of Commerce (Docket ID 0088), and the Associated Builders and Contractors (Docket ID 0071).

Similarly, other commenters opposed the publication of an establishment's name and address, as well as case-specific injury and illness data from the Forms 300 and 301, on the ground that doing so would harm a company's overall reputation ( e.g., Docket ID 0036, 0043, 0050, 0068, 0071).^[7] For example, according to NAM, “This newly available data immediately puts employers, manufacturers in particular, in a defensive posture whereby compliance with this rule adds unintended risks to company reputation. Prematurely publishing sensitive establishment data would damage those companies who are improving their safety programs, leaving smaller businesses the most vulnerable in such a scenario. Manufacturers need to know that their good faith compliance will not hurt their business.” (Docket ID 0068).

When considering whether a particular piece of information OSHA proposed to collect and make publicly available in this rulemaking will be problematic in any way, including as to a company's competitiveness or its reputation, it is important to consider which information is currently publicly available and whether posting such data has actually resulted in the harm raised by commenters on this rulemaking. OSHA began publishing individual establishment 300A annual summary data, then submitted through the OSHA Data Initiative (ODI), in 2009, and data for calendar years 1996 through 2011 is posted in a searchable format at: https://www.osha.gov/​ords/​odi/​establishment_​search.html. The ODI data files include information on the number of employees and the hours worked hours, as well as establishments' names and street addresses (see “DataDictionary1996–2001.txt”, “DataDictionary2002–2011.txt” available at the ODI website cited in the previous sentence). Despite the fact that these data have been publicly available for more than a decade, OSHA is not aware of, and no commenter has provided, any specific examples of reputational harm, of firms losing business opportunities or potential employees, or any other harm resulting from the public availability of these data.

This point was emphasized in comments submitted by the Strategic Organizing Center for this rulemaking (Docket ID 0079), including one previously submitted during the proceeding leading the 2016 rule. That comment pointed out that none of the employers expressing concern about “reputational damage” during a 2013 public meeting on what became the 2016 rule “could point to a single instance of such damage arising from the release of workplace injury/illness records.” The comment added that “the representatives of several large trade associations . . . made the same claim, and offered the same paucity of evidence.” SOC further opined that if any of their members had actually suffered any reputational damages, then these “highly sophisticated participants . . . would either already know about it or been able to find at least a pattern of compelling examples worthy of the Secretary's consideration in this rulemaking,” but they did not offer any such examples at the public meeting, “even in response to repeated questions by OSHA.” Almost a decade has passed since that meeting, even more information is available, and OSHA has still seen no evidence of reputational or other harm to employers that submitted required data.

Moreover, OSHA has also published data from establishments' Forms 300A for calendar years 2016 through 2021 in downloadable data files at https://www.osha.gov/​Establishment-Specific-Injury-and-Illness-Data. These published data include, among other things, company name and address, annual average number of employees, and total hours worked (see Data Dictionary available at the OSHA website cited in the previous sentence). Again, OSHA is not aware of, and no commenter has provided, any specific examples of reputational harm, of firms losing business opportunities or potential employees, or any other harm resulting from the public availability of these data. Consequently, OSHA is not persuaded that these unsubstantiated concerns regarding potential harms that may result from OSHA's posting of information from their recordkeeping forms in any way outweigh the worker safety and health benefits that will be realized from OSHA's collection and posting of certain data from establishments' recordkeeping forms.

OSHA also received comments arguing that the proposed rule was arbitrary and capricious or that OSHA's statements within the proposed rule's preamble were otherwise suspect, problematic, or confusing because OSHA has taken a different position during past FOIA litigation. For example, the U.S. Chamber of Commerce commented that in the New York Times Co. v. U.S. Dep't of Labor, 340 F. Supp. 2d 394 (S.D.N.Y. 2004), and in OSHA Data/CIH, Inc. v. U.S. Dep't of Labor, 220 F.3d 153 (3d Cir. 2000), OSHA took the position that the total number of employees and hours worked at a particular establishment was “confidential and proprietary business information,” in contrast to its position in the NPRM (Docket ID 0088, Attachment 2).

The Chamber accurately characterizes OSHA's arguments in the New York Times case but fails to mention one key fact: the court found that the information was not confidential. Specifically, in its decision, the court concluded that basic injury and illness recordkeeping data regarding the average number of employees and total number of hours worked does not involve confidential commercial information (see 350 F. Supp. 2d 394 at 403). It held that competitive harm would not result from OSHA's release of lost workday injury and illness rates of individual establishments, from which the number of employee hours worked could theoretically be derived (id. at 402–403). Additionally, the court explained that most employers do not view injury and illness data as confidential (id. at 403).

In the years after the court's decision rejected the Secretary's argument that the injury and illness rates requested in the FOIA suit could constitute commercial information under Exemption 4 of FOIA, 5 U.S.C. 552(b)(4), the Secretary reconsidered their position. Beginning in 2004, in response to FOIA requests, OSHA's policy has been to release information from Form 300A on the annual average number of employees and total hours worked by all employees during the past year at an establishment. Similarly, OSHA began releasing establishment Forms 300 and 301 in response to FOIA requests (after appropriately redacting certain personal identifiers under Exemption 7(C)). And, as noted above, the agency began posting information from establishments' Forms 300A online in 2009 as part of ODI. Thus, OSHA included a statement in the 2013 proposed rule and 2016 final rule explaining that the Secretary no longer believes that the injury and illness information entered on the OSHA recordkeeping forms constitutes confidential commercial information.

OSHA's general practice of releasing recordkeeping forms to FOIA requesters (with appropriate redactions largely related to information that could identify employees, e.g., employee names) continued in the years prior to the Supreme Court's decision in Food Marketing Institute v. Argus Leader Media, 139 S. Ct. 2356 (2019) (“ Argus Leader ”). In Argus Leader, the Court held that “at least where commercial or financial information is both customarily and actually treated as private by its owner and provided to the government under an assurance of privacy, the information is `confidential' within the meaning of Exemption 4” (id. at 2366). After the issuance of the Argus Leader decision, OSHA changed its practice and began processing requests for OSHA Forms 300, 300A, and 301 under Exemption 4, a decision which the agency believed was supported by Argus Leader. Then, after several courts disagreed with OSHA's interpretation, the agency reverted to its previous practice and began releasing the recordkeeping forms as before (see 87 FR 18531 (discussing three adverse rulings in which courts rejected OSHA's position that electronically submitted 300A injury and illness data are covered under the confidentiality exemption in FOIA Exemption 4)). In other words, although OSHA has previously argued that some of the Form 300, 300A, and 301 information should not be released under FOIA, the agency changed its posture to comport with adverse court rulings. Consequently, the agency is not persuaded by comments reiterating those court-rejected arguments.

In making this decision, OSHA notes that many employers already routinely disclose information about the number of employees at an establishment. Since 2001, OSHA's recordkeeping regulation has required employers to record information about the average annual number of employees and total number of hours worked by all employees on the OSHA Form 300A. Section 1904.35 also requires employers to provide to employees, former employees, and employee representatives non-redacted copies of the OSHA Form 300A. In addition, § 1904.32(a)(4) requires employers to publicly disclose information about the number of employees and total number of hours worked through the annual posting of the 300A in the workplace for three months from February 1 to April 30.

OSHA notes that it also received comments from interested parties arguing that OSHA should rescind the requirement to submit the 300A Summary Form to OSHA because that form contains confidential business information (CBI) ( e.g., Docket ID 0059). Such comments are reiterating legal arguments which courts rejected in the cases discussed above. Consequently, OSHA disagrees with the assertion that the 300A forms contain CBI and declines to make the requested change.

6. Safeguarding Individual Privacy (Direct Identification)

As explained above, OSHA's decision to collect certain data from establishments' Forms 300 and 301 stems from its determination that OSHA will be able to use the data to improve worker safety and health. Similarly, the agency's decision to publish some of the Forms 300 and 301 data it receives pursuant to this rulemaking flows from its expectation that it will receive FOIA requests requesting the data and its determination that such publication will result in many occupational safety and health benefits. Importantly, in the proposal, OSHA also preliminarily determined that these benefits would not be at the expense of employee privacy. In other words, OSHA preliminarily determined that it would be able to adequately protect information that could reasonably be expected to identify individuals directly—both in the collecting and possession of the data and in its decisions surrounding which information will be made publicly available.

This question, i.e., whether OSHA would be able to adequately protect information that could reasonably be expected to identify individuals directly, was raised in the rulemaking that culminated in the issuance of the 2016 final rule. It was also a major factor in OSHA's decision to rescind the requirement for certain employers to electronically submit information from Forms 300 and 301. Specifically, in the preamble to the 2019 final rule, OSHA stated that it was rescinding that requirement “to protect sensitive worker information from potential disclosure under the Freedom of Information Act (FOIA)” and that “OSHA has always applied a balancing test to weigh the value of worker privacy against the usefulness of releasing the data” (84 FR 383–384). The preamble to the 2019 final rule also stated the agency's belief at the time that OSHA could withhold the data from Forms 300 and 301 from publication under FOIA Exemptions 6 and 7(C) (84 FR 386), but OSHA concluded at that time that the risk of disclosure of case-specific, establishment-specific, information could not be justified “given [the agency's] resource allocation concerns and the uncertain incremental benefits to OSHA of collecting the data” (84 FR 387). Moreover, in the preamble to the 2019 final rule, OSHA characterized information such as descriptions of workers' injuries and the body parts affected (Field F on Form 300, Field 16 on Form 301), as “quite sensitive,” and stated that public disclosure of this information under FOIA or through the OSHA Injury Tracking Application (ITA) would pose a risk to worker privacy. It added that “although OSHA believes data from Forms 300 and 301 would be exempt from disclosure under FOIA exemptions, OSHA is concerned that it still could be required by a court to release the data” (84 FR 383).

As noted in the preamble to the proposed rule for this rulemaking, however, OSHA has determined those bases for the removal of the 300 and 301 data submission requirement are no longer compelling. As to the risk to employee privacy, OSHA preliminarily determined that the proposed data collection would adequately protect information that could reasonably be expected to identify individuals directly, such as name and address, with multiple layers of protection. Of particular importance, OSHA explained that improvements in technology have decreased the resources needed by the agency to collect, analyze, and publish data from Forms 300 and 301 (87 FR 18538). In addition, OSHA noted the 2019 final rule took an overly expansive view of the term “personally identifiable information” and preliminarily determined that the 2019 final rule's position on such information was at odds with the agency's usual practice of regularly releasing such data (87 FR 18539).^[8]

A number of commenters expressed concern about OSHA's reasoning for the collection and publication of Forms 300 and 301 data in the preamble to the proposed rule ( e.g., Docket ID 0038, 0058, 0059, 0072, 0088, 0091). For example, NPGA argued that OSHA should evaluate the data it already collects from industries listed in appendix A to determine whether additional information collection will further workplace safety (Docket ID 0050). As discussed extensively above in Section III.B.4 of this Summary and Explanation, OSHA has evaluated and used the 300A data it collects and anticipates that many workplace safety and health benefits will flow from the collection of the case-specific data that will be submitted by establishments pursuant to final 1904.41(a)(2).

Other commenters focused on whether OSHA had adequately explained its change of opinion on whether the risk of collecting and publishing Form 300 and 301 data outweighs the benefits to worker safety and health. For example, the American Feed Industry Association (AFIA), the Coalition for Workplace Safety, and the Flexible Packaging Association all expressed disagreement with OSHA's determination that the significant benefits of collecting establishment-specific, case-specific data from the 300 and 301 forms outweigh the slight risk to employee privacy (Docket IDs 0038, 0058, 0091). On the other hand, the National Council for Occupational Safety and Health noted that OSHA needs “workplace injury and illness information . . . to work effectively,” and that it is “unlike almost any other government agency in charge of protecting public safety” in not receiving it already (Docket ID 0048).

As discussed above, OSHA believes it has good reasons to collect and publish information from the covered establishments' Forms 300 and 301 (see Section III.B.4 of this Summary and Explanation). And, as to the risk to employee privacy, OSHA has determined that it can implement multiple layers of protection described above to protect such information that could reasonably be expected to identify individuals directly, e.g., names and addresses. These protective measures include limiting the amount of information submitted by employers, reminding employers not to submit information that could reasonably be expected to identify individuals directly, withholding information from certain fields from publication, and using automated information technology to detect and remove any remaining information that could reasonably be expected to identify individuals directly. These measures will ensure that individual privacy is protected while key information on workplace hazards is disseminated to employees, employee representatives, and other interested parties. The following discussion explains how each layer of protection will help to ensure that individual privacy is protected.

In the proposed rule, OSHA stated that its first measure to prevent the release of information that could reasonably be expected to identify individuals directly is to not collect most of that information in the first place. Specifically, as discussed above and detailed in Section III.D of this Summary and Explanation, on § 1904.41(b)(9), the proposal explained to establishments that employers did not need to submit the following information: (1) from the Form 300 Log: the employee name column (column B) and (2) from the Form 301 Incident Report: the employee name (Field 1), employee address (Field 2), name of physician or other health care professional (Field 6), and facility name and address if treatment was given away from the worksite (Field 7). OSHA explained that, since this information would not be collected, there would be no risk of publication disclosure of the data in the fields (87 FR 18538).

Some interested parties submitted comments agreeing with OSHA's logic on this point ( e.g., Docket IDs 0030, 0063, 0064). For example, Worksafe supported the proposed omission of employee name and address, physician names, and treatment facilities from collection and publication to protect individual privacy (Docket ID 0063). And AIHA commented that if PII is not collected by OSHA, there would be no need to redact submitted information (Docket ID 0030). Based on this feedback, and as discussed further in Section III.D of this Summary and Explanation, the final rule, like the proposed rule, does not allow employers to submit the above information.

Again, as discussed in Section III.D of this Summary and Explanation, OSHA received comments from interested parties requesting that OSHA add other fields from Forms 300 and 301 to the list of fields which establishments are not required to submit under the final rule. These comments are addressed in detail in Section III.D, but OSHA also notes here that these interested parties' true concerns appear to relate to whether OSHA can keep the collected data private ( e.g., will OSHA have to release it in response to a FOIA request or otherwise release it accidentally, such as because an employee name or other direct employee identifier is contained in a narrative field) or whether the fields OSHA intends to release will allow third parties to indirectly identify employees. OSHA's plan to mitigate each of these concerns is discussed in detail below. Thus, again as stated in the summary and explanation for § 1904.41(b)(9), the agency declines to add further fields to the list of fields from establishments' Forms 300 and 301 which will not be collected under this final rule.

As discussed in the proposal, OSHA's second measure to prevent the release of information that could reasonably be expected to identify individuals directly relates to system design (87 FR 18538). Specifically, the agency explained that it planned to design its data collection system to provide extra protections for the personal information that establishments would be required to submit under the proposal. For example, OSHA stated that although the proposal would require employers to submit the employee's date of birth from Form 301 (Field 3), it planned to design the data collection system to immediately calculate the employee's age based on the date of birth entered and then store only the employee's age, not the employee's date of birth. OSHA also indicated its intent to post reminders to establishments to omit from the text fields they submit any information that could reasonably be expected to identify individuals directly, including names, addresses, Social Security numbers, and any other identifying information (see 87 FR 18538).

In addition to these proposed system design solutions, OSHA included a question in the proposal asking: “What additional guidance could OSHA add to the instructions for electronic submission to remind employers not to include information that reasonably identifies individuals directly in the information they submit from the text-based fields on the OSHA Form 300 or Form 301?” (87 FR 18546). OSHA received a number of responses to this question. For example, AIHA commented, “The electronic forms that OSHA provides should be designed to automatically exclude personal identifiers with an option to include the fields if required. The import side of the electronic form data could also block the importation of these fields” (Docket ID 0030).

The Plastics Industry Association (PIA) commented that, although it does not believe the reminder would be “an acceptable remedy for inadequate software,” “[i]f OSHA were to proceed in this way. . ., OSHA should include the warning about not including personal identifiers in an online screen and require the submitter to click a confirmation that it has not included any personal identifiers before allowing the submitter to proceed to the data entry step.” PIA also stated that after the data entry is completed, the system should provide the employer with an opportunity to review the complete data submission, view how it would be presented to the public, and correct any inaccurate data or inadvertently included personal identifiers. After completing that step, PIA recommended that the submitter should have to click through a second screen that repeats the warning about not including personal identifiers and confirm that none were submitted before allowing the submitter to click on the final submit button. Finally, PIA said that “[b]efore requiring compliance with the contemplated data submission requirements for the OSHA Form 300 or Form 301 data, OSHA needs to have a qualified, independent body test and validate that the software, as integrated into the OSHA ITA, will reliably remove any personal identifiers” (Docket ID 0086).

OSHA thanks the commenters who responded to the specific question on additional instructions to employers on not submitting information that identifies individuals. OSHA intends to take commenters' specific responses into account when designing the expanded collection system. Based on those comments, OSHA will include reminders in the instructions for the data collection system for employers not to submit information that could reasonably be expected to identify individuals directly. OSHA agrees that is an effective way to reduce the amount of identifiable information collected by the system. In turn, that will decrease the likelihood that such information will be published. OSHA has routinely used these types of instructions, such as when it requests comments from interested parties in rulemakings such as this one (see the section on “ Instructions ” above) and has found them to be an effective way to prevent the unintentional submission of information that could reasonably be expected to identify individuals directly.

Also, OSHA notes that the current ITA manual data entry option already includes a screen that provides establishments with an opportunity to review the complete data submission of Form 300A information and to make edits or corrections as appropriate. OSHA plans to gather additional information from similar data collection systems and incorporate best practices in the final design for the collection system for data from the Forms 300 and 301. Moreover, the Forms 300 and 301 themselves already include a box with the warning, “Attention: This form contains information relating to employee health and must be used in a manner that protects the confidentiality of employees to the extent possible while the information is being used for occupational safety and health purposes.” In addition, the Form 301 includes the warning, “Re [F]ields 14 to 17: Please do not include any personally identifiable information (PII) pertaining to worker(s) involved in the incident ( e.g., no names, phone numbers, or Social Security numbers).” Fields 14–17 do not ask for information likely to implicate privacy concerns, rather, they request information related to the injury or illness and how it occurred. OSHA believes these warnings are adequate and does not believe it is practical to develop a system that would remove remaining information between an establishment's draft and final electronic submissions. Such systems take time to run (see, e.g., Docket ID 0095), which would increase the time between employer submission ( i.e., when the employer clicks on the `submit' or `upload' button) and employer receipt of confirmation of successful submission, potentially creating concerns about whether the submission system is working. OSHA therefore believes that it is more appropriate to identify and remove any information that could reasonably be expected to identify individuals directly after submission and before publication, rather than during submission. Moreover, OSHA thinks its plans to protect such data will adequately protect worker privacy without adding this additional, impractical, potentially expensive (adding additional functionality to system) step. Finally, as to system design, OSHA's system will not allow establishments to enter the fields that are excluded from collection under § 1904.41(b)(9).

As discussed in the proposal, OSHA's third measure to prevent the release of information that could reasonably be expected to identify individuals directly is to withhold certain information that is submitted to it from public disclosure. As noted above, OSHA will not collect employees' names from either form, and will not collect employees' addresses or the names or addresses of healthcare providers from Form 301. However, the proposed rule would have required (and the final rule actually requires) submission of some fields that contain personal information, including date of birth (which will be converted to age) (Field 3), date hired (Field 4), gender (Field 5), whether the employee was treated in the emergency room (Field 8), and whether the employee was hospitalized overnight as an in-patient (Field 9) (see 87 FR 18539). OSHA proposed to collect that information, but not to make it public, and specifically requested comment on those proposals (see 87 at FR 18540).

OSHA received a number of comments, virtually all from employers and their representatives, expressing concern over the potential risk to employee privacy presented by the proposed collection and potential publication of information from Forms 300 and 301 that could reasonably be expected to identify individuals directly ( e.g., Docket IDs 0055, 0056, 0057, 0062, 0070, 0075, 0087, 0090, 0094). For example, the Precision Machined Parts Association (PMPA) commented, the Form 300 contains sensitive information that may be released under FOIA or “through the inadvertent publication of information due to the agency's reliance on automated de-identification systems to remove identifying information” or through the actions of “future administrations” (Docket ID 0055). The North American Die Casting Association (Docket ID 0056) and National Tooling and Machining Association and Precision Metalforming Association (Docket ID 0057) expressed similar concerns. Rep. Virginia Foxx (R-North Carolina) and Rep. Fred Keller (R-Pennsylvania) echoed that “there are no guarantees that this data may not be disclosed accidentally” (Docket ID 0062).

In contrast, commenters representing the workers whose injuries and illnesses are recorded on these forms did not share employers' concerns about the potential publication of sensitive worker information. For example, the AFL–CIO stated that “The preamble to the 2016 final rule included a comprehensive review of privacy issues raised by interested parties in requiring the collection of detailed injury and illness data and the final language was crafted to provide safeguards to protect the release of personally identifiable information (PII).” It explained the NPRM “has also considered PII and includes the same safeguards as the 2016 final rule and discusses recent technological developments that increase the agency's ability to manage information” (Docket ID 0061 (citing 87 FR 18538–46)). In addition, AFL–CIO observed that the type of information that OSHA proposed to collect in this rulemaking “has already been shown by other agencies it can be collected and shared without violating confidentiality, such as by Mine Safety and Health Administration (MSHA)[, and a]ll data provided under the Freedom of Information Act and Form 300 and Form 301 provided to workers and their representatives upon request under § 1904.35 provide detailed injury and illness information without releasing PII.” In summary, AFL–CIO argued that “OSHA should maintain the same privacy safeguards in the rule it issued in 2016, also proposed in this preamble and used by other agencies to protect sensitive information” (Docket ID 0061).

Similarly, the National Nurses Union affirmed that the NPRM “includes appropriate procedures to allow electronic data reporting and publication while protecting worker privacy.” To support this statement, it specifically referenced OSHA's “plans to instruct employers to omit the fields on Form 301 that include personal information about the worker” and the agency's plan to use data analysis tools to ensure that published data does not include any personal data that employers may accidentally submit. NNU concluded that “[t]he multiple measures to remove identifying information in the final rule will ensure that workers' privacy is protected while key information on workplace hazards is shared” (Docket ID 0064).

OSHA agrees with the latter commenters who stated that there are multiple measures in place to protect the privacy of individuals under this final rule. As discussed above, OSHA will not collect much of the information the commenters opposing this provision expressed concern about. In addition, the collection system will provide further safeguards and reminders. For example, OSHA will redact any identifying material from the portions of the forms it intends to publish ( e.g., Fields 10 through 18 of Form 301).

Further, and as discussed in more detail below in Section III.B.7 of this Summary and Explanation, OSHA will withhold from publication all of the collected information on the left side of the Form 301 ( i.e., employee age, calculated from date of birth (Field 3), employee date hired (Field 4), and employee gender (Field 5), as well as whether the employee was treated in emergency room (Field 8) and whether the employee was hospitalized overnight as an in-patient (Field 9)) that could indirectly identify injured or ill employees when combined with other potentially available information. As noted in the proposal, this decision is consistent with OSHA's handling of FOIA requests, in response to which the agency does not release data from Fields 1 through 9.

It is important to note that these forms have never been private. The information that OSHA will publish from the Forms 300 and 301 under this final rule is consistent with the information available in the agency's longstanding records access provisions. The recordkeeping regulation at 29 CFR 1904.35 allows current and former employees and their representatives access to the occupational injury and illness information kept by their employers, with some limitations. When an employee, former employee, personal representative, or authorized employee representative asks an employer for copies of an employer's current or stored OSHA 300 Log(s), the employer must give the requester a copy of the relevant OSHA 300 Log(s) by the end of the next business day (see 29 CFR 1904.35(b)(2)(ii)). Cases labeled as “privacy concern cases,” described below, are excluded from this requirement. Finally, an authorized representative is entitled, within 7 days of requesting them, to copies of the right-hand portion of all 301 forms for the establishment(s) where the agent represents one or more employees under a collective bargaining agreement. As discussed above, the right-hand portion of the 301 form contains the heading, “Tell us about the case,” and includes information about how the injury or illness occurred, including the employee's actions just prior to the incident, the materials and tools involved, and how the incident occurred, but should not include the employee's name. No information other than that included on the right-hand portion of the Form 301 may be disclosed to the authorized employee representative.

Put more simply, OSHA's decision not to release the collected information on the left-hand side of the Form 301 ( i.e., age (calculated from date of birth), date hired, gender, whether the employee was treated in the emergency room, and whether the employee was hospitalized overnight as an in-patient) is consistent with records access provisions in OSHA's recordkeeping regulation, § 1904.35(b)(2)(v)(A) and (B), which prohibit the release of information in fields 1 through 9 to individuals other than the employee or former employee who suffered the injury or illness and their personal representatives.

To protect employee privacy, § 1904.29(b)(7) requires the employer to enter the words “privacy concern case” on the OSHA 300 log, in lieu of the employee's name, for certain sensitive injuries and illnesses: an injury or illness to an intimate body part or the reproductive system; an injury or illness resulting from a sexual assault; a mental illness; an illness involving HIV infection, hepatitis, or tuberculosis; needlestick injuries and cuts from sharp objects that are contaminated with another person's blood or other potentially infectious material (see § 1904.8 for definitions); and other illnesses, if an employee independently and voluntarily requests that their name not be entered on the log. In addition, under § 1904.29(b)(9), if employers have a reasonable basis to believe that information describing a privacy concern case may be personally identifiable even though the employee's name has been omitted, they may use discretion in describing the injury or illness as long as they include enough information to identify the cause of the incident and the general severity of the injury or illness. Thus, contrary to the arguments of the Phylmar Regulatory Roundtable (PRR) (Docket ID 0094), OSHA's recordkeeping rule distinguishes between PII and “sensitive PII,” which is deserving of even higher protection. OSHA's definition of privacy concern cases is very similar to the DHS definition of “sensitive PII, which this comment urged OSHA to adopt (see https://www.dhs.gov/​publication/​handbook-safeguarding-sensitive-personally-identifiable-information, p. 15). Although DHS and OSHA collect and maintain information for different purposes, the provisions in 29 CFR 1904.29 addressing privacy concern cases protect details about injuries and illnesses that workers would consider sensitive to the same extent that the DHS rule does. Therefore, it is unlikely that information describing sensitive body parts will even be recorded by employers, much less subsequently submitted to OSHA under the data collection requirements of this final rule.

Section 1904.29(b)(10) also protects employee privacy if an employer decides voluntarily to disclose the Forms 300 and 301 to persons other than those who have a mandatory right of access, by requiring employers to remove or hide employees' names or other personally identifiable information before disclosing the forms to anyone other than government representatives, employees, former employees, or authorized employee representatives, with only a few exceptions. The exceptions include disclosure to authorized consultants hired by employers to evaluate their safety and health programs; where disclosure is necessary to process a claim for workers' compensation or other insurance benefits; and disclosure to a public health authority or law enforcement entity for uses and disclosures for which consent, or authorization, or opportunity to agree or object is not required under the HIPAA privacy rule at 45 CFR 164.512. These exceptions are not relevant here or are discussed in Section III.B.10 of this Summary and Explanation, below.

OSHA acknowledged the tension between the safety and health benefits of disclosing injury and illness records on the one hand, and the desire for privacy by the subjects of those records on the other, more than two decades ago. In OSHA's 2001 final rule overhauling its recordkeeping system, it explained that while agency policy is that employees and their representatives with access to records should treat the information contained therein as confidential except as necessary to further the purposes of the Act, the Secretary lacks statutory authority to enforce such a policy against employees and representatives (see 66 FR 6056–57 (citing, e.g.,29 U.S.C. 658, 659) (Act's enforcement mechanisms directed solely at employers)). Thus, it has always been possible for employees and their representatives to make the recordkeeping data they have accessed public if they wish to do so (see 81 FR 29684). Nonetheless, OSHA also concluded that the benefits to employees and their representatives of accessing the health and safety information on the recordkeeping forms carry greater weight than any particular individual employee's possible right to privacy (see 66 FR 6055). Similarly, in the current rulemaking, OSHA continues to believe that the benefits of publication of injury and illness data at issue in this rule, discussed in detail above, outweigh the slight possibility that some employees could be identified from that data. There are even more exclusions from the data that will be made public under this rule than from the data available to employees and their representatives, and OSHA is unaware of any instances where an employee took the currently available recordkeeping information and used it to publicize the identity of an injured or ill worker.

Some commenters, however, thought there should be a distinction between the information available to workers at an establishment and their representatives, and information available to the broader community. The U.S. Poultry & Egg Association, the Plastics Industry Association, and PRR all acknowledged the value of providing this information to those workers but argued that similar value is not provided by making the information available to others in the industry (Docket IDs 0053, 0086, 0094). OSHA disagrees. As explained in Section III.B.4 of this Summary and Explanation, OSHA believes that expanding access to such information on a public website will increase information about workplace hazards, create awareness of potential hazards for other members of an industry, provide useful information for potential and current employees, and allow all establishments to address hazards more effectively.

OSHA notes that it also received comments from interested parties expressing concern that courts might order the agency to release some of the data it collects and does not plan to release in this rulemaking, i.e., in a decision in a FOIA lawsuit. Based on its years of experience processing FOIA requests to which establishments' Forms 300 and 301 were responsive and redacting and releasing those forms, OSHA believes this outcome is highly unlikely. As noted in the proposal and discussed in more detail above, the agency often collects such forms during inspections. When releasing the forms to FOIA requesters, it has long redacted the information that it will collect as a result of this rulemaking but does not intend to publish.

Specifically, as noted above and explained in the proposal, OSHA uses FOIA Exemption 7(C) to withhold from disclosure information that reasonably identifies individuals directly included anywhere on the three OSHA recordkeeping forms. And OSHA has used FOIA Exemption 6 to protect information about individuals in “personnel and medical and similar files” when the disclosure of such information “would constitute a clearly unwarranted invasion of personal privacy” (5 U.S.C. 552(b)(6)). Together, these Exemptions clearly cover the information about which commenters are concerned ( i.e., directly identifying information—concerns about indirect identifiers are discussed below) and OSHA is confident that it will continue to be able to withhold such information from public exposure under these Exemptions.

In addition, OSHA notes that its plan to release only certain fields will also prevent accidental release of information that could reasonably be expected to identify individuals directly. Specifically, when OSHA publishes the information collected in this rulemaking, that release will by design exclude the fields that OSHA does not intend to release. This is similar to OSHA's current practice as to the collection of information submitted with establishments' Forms 300 A. Specifically, as part of the process for collecting information from the Form 300A through the ITA, OSHA collects the name and contact information for the person associated with the account that is electronically submitting information from the Form 300A for a given establishment. OSHA also previously collected this information for establishment submissions of information from the Form 300A through the ODI. OSHA does not make this information public. Indeed, there is little risk that the agency might accidentally do so because the data release only includes information from the Form 300A. It plans to follow that same practice with the data from establishments' Forms 300 and 301.

OSHA's fourth measure to prevent the release of information that could reasonably be expected to identify individuals directly is through the use of scrubbing technology. In the preamble to the 2019 final rule, OSHA stated that “de-identification software cannot fully eliminate the risk of disclosure of PII or re-identification of a specific individual and manual review of the data would not be feasible” (84 FR 388). However, in the preamble to this proposed rule, OSHA preliminarily determined that this reason was no longer compelling. The agency explained that recent advancements in technology have reduced the risk that information that could reasonably be expected to identify individuals directly will be disclosed to the public. In addition, OSHA expected the improved technology used to protect sensitive employee data to reduce costs and resource-allocation issues for OSHA by eliminating the need to manually identify and remove information that could reasonably be expected to identify individuals directly from submitted data and by decreasing the resources required to analyze the data. OSHA added that, because of these improvements in automated de-identification systems, OSHA would now be better able to collect, analyze, and publish data from the 300 and 301 forms, so the anticipated benefits of collecting the data would be more certain. The collection of case-specific data would allow the agency to focus its enforcement and compliance assistance resources based on hazard-specific information and trends, and to increase its ability to identify emerging hazards, at the establishment level. Accordingly, OSHA preliminarily believed that the significant benefits of collecting establishment-specific, case-specific data from the 300 and 301 forms would outweigh the slight risk to employee privacy (87 FR 18538).

In the preamble to the proposed rule, OSHA specifically asked the following questions about automated de-identification systems:

• What other agencies and organizations use automated de-identification systems to remove information that reasonably identifies individuals directly from text data before making the data available to the general public? What levels of sensitivity for the automated system for the identification and removal of information that reasonably identifies individuals directly from text data do these agencies use?
• What other open-source and/or proprietary software is available to remove information that reasonably identifies individuals directly from text data?
• What methods or systems exist to identify and remove information that reasonably identifies individuals directly from text data before the data are submitted?
• What criteria should OSHA use to determine whether the sensitivity of automated systems to identify and remove information that reasonably identifies individuals directly is sufficient for OSHA to make the data available to the general public?
• What processes could OSHA establish to remove inadvertently-published information that reasonably identifies individuals directly as soon as OSHA became aware of the information that reasonably identifies individuals directly?

(87 FR 18546–47)

Overall, there were no comments about the technical aspects of software to identify and remove information that could reasonably be expected to identify individuals directly. However, Worksafe commented, “Worksafe encourages OSHA to consult with technical experts. The Federal Government has two groups of experts that may be able to help: the U.S. Digital Service, a group of technology experts that assist agencies with pressing technology modernization, and 18F, a `technology and design consultancy' housed within the General Services Administration. Technical experts should be able to advise on both the capabilities and limits of software to accomplish the sort of filtering that OSHA has proposed.” (Docket ID 0063). In addition, AIHA's comment supported use of software to remove the information before submission: “If the personally identifiable information (PII) is not submitted, there would be no reason to have an automated system capable of removing the sensitive portions of the information. A unique identifier could be auto-generated by the system instead of utilizing PII” (Docket ID 0030).

There were also comments that OSHA should select, identify, test, and demonstrate the results of de-identification software before proceeding with a final rule. For example, the Coalition for Workplace Safety commented, “OSHA has not yet conducted tests of [its privacy scrubbing] technology on the Forms 300 or 301,” and “OSHA acknowledges that the information it will collect and publish can still be used to identify individuals indirectly by combining it with other publicly available information.” The commenter also stated that OSHA “relies heavily on automated information technology to remove information that can directly identify individuals,” which is “not 100 percent accurate so there will still be information made publicly available which can be used to directly identify individuals” (Docket ID 0058).

Similarly, the National Association of Manufacturers commented, “The new online requirement places an unintentional burden on the agency that it may not be prepared to implement. The agency's pledge to design a system that both abides by FOIA protocols and uses scrubbing technology to protect PII is problematic because such a system is unproven and untested at OSHA. The agency should demonstrate the effectiveness and stability of such a system before it proceeds further with this rulemaking. (Docket ID 0068).

The Motor and Equipment Manufacturers Association commented, “OSHA says it will also address this risk by using existing privacy scrubbing technology that it claims is capable of de-identifying information that reasonably identifies individuals directly (such as name, phone number, email address, etc.). However, OSHA made this same claim in the preamble to the 2016 injury and illness reporting rule, which the agency rejected in the preamble to the 2019 rescission rule . . . the Proposed Rule provides no details on the systems, software, or platforms that are available now but were not available at the time of the 2019 rescission rule. In fact, all but one of the data scrubbing products identified by OSHA in the Proposed Rule were commercially available prior to the issuance of the rescission rule.” (Docket ID 0075).

The Plastics Industry Association commented, “First, we are concerned that OSHA is referring to technically feasible automated software that could identify unique personal identifiers, but it is unclear whether it currently exists. Second, as the foregoing discussion from the January 19, 2001 preamble makes clear, there are likely to be many cases in which disclosure of a generic identifier or data point becomes a personal identifier in the context of those with knowledge of the site ( e.g., “only one woman works at the plant”), a situation that we believe is beyond the shield that could be provided by any automated software. If OSHA had identified automated software capable of scrubbing unique personal identifiers, we would have expected OSHA to have provided an appropriate certification from a qualified testing organization that the software, after integration into the OSHA ITA, will accurately perform that function—possibly with some acceptable, minimal error rate. However, the following questions OSHA posed in the preamble suggest the necessary software is not yet available or, if it is, OSHA has not yet identified it and verified it would be adequate and within the agency's budget.” (Docket ID 0086).

The Employers E-Recordkeeping Coalition (Coalition) commented, “The supposed improved technology to decrease the number of resources required to analyze this data has neither been presented to employers nor explained in the Notice of Proposed Rulemaking. The “scrubbing application” and automated information technology is neither tested or verified, nor is there any reason to consider it trustworthy. In fact, the proposed use of automated information technology to detect and remove information that reasonably identifies individuals is, OSHA admits, a “preliminary” finding that has not been vetted. (The point is further underscored by the Agency's request for information on what proprietary software is out there that is capable of removing information that reasonably identifies individuals directly from text data).” (Docket ID 0087).

The agency disagrees with the comments that it is necessary to select, identify, test, and demonstrate the results of de-identification software before proceeding with a final rule. AI and machine learning—technologies that OSHA plans to use to detect, redact, and remove information that reasonably identifies individuals directly from structured and unstructured data fields—have advanced rapidly in recent years. Commercially available products that were introduced to the marketplace during the previous rulemaking process are now well-established. In the preamble to the proposed rule, OSHA listed and described three packages initially released between November 2017 and March 2018, as well a fourth package that was released in March 2021 (87 FR 18540). There has now been time for these packages to go through multiple updates, as well as for studies of comparative performance to be performed and published. For example, a study entitled “A Comparative Analysis of Speed and Accuracy for Three Off-the-Shelf De-Identification Tools” was published in May 2020 in AMIA Summits on Translational Science Proceedings; it compared three text de-identification systems that can be run off-the-shelf (Amazon Comprehend Medical PHId, Clinacuity's CliniDeID, and the National Library of Medicine's Scrubber). This study found that “No single system dominated all the compared metrics. NLM Scrubber was the fastest while CliniDeID generally had the highest accuracy” (Docket ID 0095). While the study concluded that “no perfect solution exists for text de-identification,” the system with the highest accuracy displayed 97% or greater precision (positive predicted value) and recall (sensitivity) for name, age, and address. The study mentions but does not compare two additional commercially available packages, and OSHA is aware of at least two more packages that have become commercially available since the publication of the proposed rule (see https://atlasti.com/​ and https://privacy-analytics.com/​health-data-privacy/​health-data-software/​ ).^[9] The PRR agreed that available software is capable of “scrap[ing] the data and remov[ing] direct identifiers” and supported the agency's use of this technology (Docket ID 0094).

As explained in the preamble to the proposed rule, OSHA intends to test multiple systems, including systems that are commercially available, and analyze the results carefully to select the best option to secure and protect information that could reasonably be expected to identify individuals directly. No option is expected to be 100% effective. Therefore, OSHA will supplement the selected system with some manual review of the data, in order to ensure the system adequately protects such information.^[10]

In summary, OSHA has determined that the agency will be able to adequately protect information that could reasonably be expected to identify individuals directly using the safeguards in this final rule and OSHA's planned data collection system, in combination with warnings to employers and available automated information technology. OSHA also intends to consult with technical experts within the Federal Government, and agrees with the commenters who pointed out the relevance of MSHA's data collection to OSHA's proposed data collection (see Section III.B.8 of this Summary and Explanation). In addition, the use of the automated informational technology will significantly decrease the need for the type of resource-intensive manual reviews that OSHA was concerned about in the 2019 rulemaking. OSHA does recognize the possibility that information could be released that could be used to identify an employee—this is a risk whenever any organization collects information that relates to individuals; however, OSHA intends to minimize this risk to the extent possible. The most reliable means of protecting individuals' information is by not requiring its submission in the first instance; therefore, OSHA has determined that it will not collect fields like employee name as part of this expanded data collection (see Section III.D of this Summary and Explanation). Even if some minimal risk to privacy remains, however, OSHA finds that the benefits of collecting and publishing the data for improving safety and health outweigh that risk.

7. Indirect Identification of Individuals

In the proposal, OSHA acknowledged that the OSHA Forms 300 and 301 also contain fields that are not direct identifiers but that could act as indirect identifiers if released and combined with other information, such as job title on the Form 300, time employee began work on the Form 301, and date of death on the Form 301 (87 FR 18538). However, because this risk of re-identification already exists (given that OSHA has previously released such information in response to FOIA requests) and OSHA had not been made aware of widespread issues regarding employee reidentification, the agency preliminarily did not see any cause for concern.^[11] Nonetheless, some commenters argued that OSHA underestimated the possibility that personal information will be disclosed under this rule because third parties (such as data miners, the media, or even neighbors or acquaintances of an injured or ill worker) will be able to determine the identity of that worker.

Some of these comments seem to assume that establishments will submit all information on the Forms 300 and 301 to OSHA, something that has never been under consideration (see, e.g., Docket IDs 0007, 0013, 0062). Others, however, expressed concern that, even though OSHA intends to delete names and other identifiable information from the collected 300 and 301 data, enough information will remain in the published data for the public to identify injured or ill employees (Docket IDs 0053, 0059, 0062, 0081, 0086, 0090). For example, the Motor and Equipment Manufacturers Association commented, “concerns that individual data fields could be linked and used to identify injured employees—even if the information, standing alone, would not be considered traditional PII—were raised in prior rulemakings and were a part of OSHA's justification for issuing the 2019 rescission rule” (Docket ID 0075).

Some such commenters expressed concerns about the publication of specific fields. For example, the Plastics Industry Association (PIA) expressed concern about the identification of workers through the publication of information about job title, department, and gender (Docket ID 0086). PIA also noted that “many employees have established social network accounts that list their name and position with their employer. Those profiles typically include the month and year the employee began working for the employer, a potentially reliable personal identifier that corresponds to the date of hire listed in field 4. Some unknown number of those profiles include birth dates, a potentially reliable personal identifier that corresponds to field 3” (Docket ID 0086). Consequently, PIA argued that OSHA should either exclude birth date and hiring date data from the collected information or reliably establish certain fields of collected information that are available only to OSHA and not the general public (Docket ID 0086).

An anonymous commenter also stated that “columns C, D, E, and F of the 300 form and [(job title, date of injury of onset of illness, where the event occurred, and the description of the injury or illness, parts of body affected, and object/substance that directly injured or made person ill)] and fields 3, 11, 13, 14, 15, 16, and 17 of the 301 form [(date of birth, date of injury or illness, time of event, and descriptions of what the employee was doing just before the incident occurred, what happened, what the injury or illness was, and what object or substance directly harmed the employee)] should be submitted but not made accessible by an member of the public on the internet” (Docket ID 0074).

According to some of the commenters who expressed concern about indirect identification, the concern is particularly acute in smaller communities where more of the residents know each other. The U.S. Poultry and Egg Association commented, “We emphasize that many of our members operate establishments in small, rural locations. People know one another. Publishing this information and data will significantly impact employee privacy. And simply redacting the names of the persons affected will not prevent people—particularly in small towns—from knowing exactly who was injured and the extent of the injury.” (Docket ID 0053). The North American Insulation Manufacturers Association and National Association of Home Builders made similar comments (Docket IDs 0081, 0059).

A related concern involves data companies that have developed tools that scrape data and link to relational databases. PRR commented that “developers will be able to create tools that scrape [public injury and illness data] . . ., including job titles, facility locations, company names and facts from open narrative text fields” and, when used in combination with information obtained via other internet sources, “developers will be able to potentially re-identify individuals with a high degree of accuracy.” In addition, this commenter stated that developers will be able to use the same tools, including artificial intelligence algorithms, for a multitude of reasons including to develop targeted sales campaigns and recruitment strategies, which would not contribute to workplace safety (Docket ID 0094).

As discussed in detail in Section III.B.4.c–h of this Summary and Explanation, other commenters supported the publication of the fields OSHA proposed to publish. For example, AFL–CIO agreed with the agency's determination about what to publish and what to collect but not publish, noting that the agency “carefully considered issues of worker privacy” (Docket ID 0061). Similarly, the National Employment Law Project (NELP) stated that “adopting the proposed standard will not put individual privacy at risk” (Docket ID 0049, Attachment 2). NELP cited to OSHA's preliminary decision to withhold certain fields from disclosure as one of the reasons it believed that worker privacy was not at risk (Docket ID 0049, Attachment 2).

Still other interested parties argued in favor of publication of such information. For example, NIOSH noted that information such as age and date of hire could be useful information to publish (Docket ID 0035, Attachment 2; see also Docket ID 0083 (agreeing with NIOSH's comment)). However, NIOSH added that if cannot be released as part of the individual injury case records, it is still important for this data to be used in aggregate analysis of injuries on the industry and occupation levels” (Docket ID 0035, Attachment 2). NIOSH further requested that OSHA facilitate analysis of these data “under terms of data use agreements with other Federal or State government agencies (such as NIOSH or State health departments) (Docket ID 0035, Attachment 2). The Council of State and Territorial Epidemiologists also generally supported the dissemination of collected information from existing records, stating that “[m]aking this information broadly available is consistent with the growing recognition, predominant in the patient safety field, that transparency—sharing of information, including information about hazards—is a critical aspect of safety culture (Docket ID 0040). Further, again as discussed in Section III.B.4.c–h of this Summary and Explanation, commenters argued that the publication of the data OSHA proposed to make public will be beneficial to employers, employees, Federal and State agencies, researchers, workplace safety consultants, members of the public and other interested parties.

Having considered the comment on these issues, OSHA recognizes the concerns of interested parties who are concerned about publication of select information from establishments' Forms 300 and 301, but believes these risks are mitigated by decisions OSHA has made with regard to which data should be collected and published and other safeguards that OSHA will be observing ( e.g., only requiring larger establishments to submit data). First, as noted above, OSHA has decided to collect but not publish five fields from Form 301 that it has decided contain information about personal characteristics, employment history, and medical treatment: Age (calculated from date of birth in field 3), date hired (field 4), gender (field 5), whether the employee was treated in the emergency room (field 8), and whether the employee was hospitalized overnight as an in-patient (field 9). The agency believes it is appropriate to refrain from releasing these data because of privacy concerns and the potential risk of indirect individual identification raised by commenters regarding the publication of this information. As noted above, this decision is consistent with the manner in which OSHA handles responses to FOIA requests, as well as 29 CFR 1904.35(b)(2)(v)(A)–(B).

However, as discussed below in Section III.D of this Summary and Explanation, OSHA still finds that there is a significant safety and health benefit with the collection and analysis of information about these fields. For example, in some cases, young workers lack necessary training and experience and may be assigned to more hazardous tasks, subjecting them to higher rates of injury or illness in some industries and occupations. Likewise, it is important for OSHA to know whether older workers are more vulnerable to certain types of injuries and illnesses. Also, information about gender is valuable to OSHA in determining whether men or women face greater risk to certain workplace hazards ( e.g., injury victims of intentional attacks in the workplace are disproportionately likely to be women). In addition, information about visits to emergency rooms and hospitals assists OSHA in tracking the type and severity of employee injuries and illnesses in specific industries and occupations. Further, OSHA could use these data in combination with other available data, such as Severe Injury Reporting data, to assess data accuracy and reporting compliance.

Although OSHA has found that it is not appropriate to publish the five fields from Form 301, the agency notes and will consider NIOSH's suggestion that those fields could be shared with NIOSH and other government agencies outside of this rulemaking utilizing appropriate privacy protections, e.g., via a written data sharing agreement with robust privacy protections.

As to the fields that OSHA plans to collect and publish ( e.g., job title), the agency believes that the final rule appropriately protects against re-identification of individuals via the release of this information. Specifically, the final rule requires only establishments with 100 or more employees, in certain designated, high-hazard industries, to electronically submit information from their Forms 300 and 301. OSHA believes it is less likely that employees in these larger establishments would be identified based on the limited recordkeeping data posted on the public website, even in small towns. Moreover, in the vast majority of cases, at establishments with 100 or more employees, OSHA believes it is unlikely that anyone other than employees at the workplace would be able to use the collected and published data from the Forms 300 and 301 to identify the injured or ill employee. For example, if only one individual performs a certain job at an establishment with 100 or more employees, OSHA believes that it is highly unlikely that anyone other than employees with specific knowledge of that workplace would be able to use the remaining information from the Forms 300 and 301 to identify that employee. As discussed above, employees at the worksite already have access to information from the Forms 300 and 301, and thus publication of these forms would not add any risk of individual employee identification.

In fact, even though OSHA has released redacted Forms 300 and 301 in response to FOIA requests for more than a decade (see the discussion of the Freedom of Information Act in Section III.B.5 of this Summary and Explanation for more details), only one commenter claimed knowledge of any employees being identified through OSHA data. Specifically, the Coalition asserted that several members of the Coalition have had third parties, including the media, contact their employees about their personal and medical information, including information related to COVID–19, because their identities were discerned from information provided to and released by OSHA (Docket ID 0087).

The Coalition's comment did not specify the size of the establishments at which the employees contacted by the third parties worked ( i.e., whether the establishments employed fewer than 100 employees), how the third parties used the information OSHA released to identify those employees, or whether there is any reason to believe that the employees' identities were not already publicly known. It also does not specify whether the employee identities became known through the release of the injury and illness data at issue in this rulemaking ( i.e., Forms 300 and 301), another document in the released portion of the inspection files, or a combination of the two. Consequently, based on the information submitted by this commenter, it is impossible to tell whether the third parties would have been able to identify these “several” employees using the case-specific information OSHA plans to collect and release in this rulemaking—information that will be submitted by relatively large establishments.

Nevertheless, OSHA takes the issue of employee privacy and the possibility of employee re-identification very seriously. As discussed in Section III.B.1 of this Summary and Explanation, OSHA chose the 100-employee threshold for the collection of case-specific data, in part, to minimize the burden on small businesses and to protect the identity of employees by only requiring relatively large businesses to submit their data. It similarly has carefully considered which fields from these forms should be collected and released with employee re-identification in mind. With these safeguards, OSHA believes the risk of indirect employee identification is minimal.

Moreover, as discussed throughout this preamble, OSHA finds that the benefits to worker and safety and health that stem from the release of this information outweigh any privacy risks. For example, as to job title specifically, researchers will be able to use this information to analyze and identify specific occupations associated with particular types of injuries and illnesses in the workplace. Also, publication of such data will allow the public to better understand and evaluate the injury and illness rates for certain jobs, tasks, and/or occupations. Potential employees will be able to review published data to assess the workplace injury/illness experience of a given job at a particular facility. In turn, employers will focus their safety and health efforts to reduce the number of injuries and illnesses associated with certain jobs as a way to attract well-qualified job candidates. Similarly, the publication of information about job title will assist researchers in analyzing and identifying injury and illness trends for specific jobs, tasks, or occupations. Better analysis of these data should result in the development of improved mitigation strategies and result in the reduction of injuries and illnesses for certain jobs. Similarly, OSHA believes that the publication of the other fields it proposed to publish will have safety and health benefits that outweigh any small risks to worker privacy. For example, time employee began work will help OSHA, employers, researchers, and others assess the relationship between workplace safety/health and known risks such as shift work and fatigue.

8. The Experience of Other Federal Agencies

As noted above, OSHA's belief that it can collect and publish the data at issue without harm to privacy or other interests is supported by the experience of its sister agency, the Mine Safety and Health Administration (MSHA). Under 30 CFR part 50, MSHA requires mine operators to submit an incident report ( Mine Accident, Injury and Illness Report, MSHA Form 700–1) within ten working days for every occupational injury, illness, or near-miss incident occurring at a mine. The MSHA Form 700–1 includes 27 mandatory fields, including a description of the incident, the nature of the injury or illness, the job title of the affected worker, and the employee's work activity at the time of the injury or illness. Under this reporting system, mine operators use an authentication code and password to securely submit establishment-specific, case-specific, injury and illness data online. MSHA maintains the injury and illness information on its website and the information is made available to the public through downloadable format. The submitted information is reviewed by at least three approving authorities, and PII is redacted, before it is uploaded to the database for public release. This system has been in place since 1999 with no adverse results.

Several commenters also suggested that MSHA's experience supports OSHA's plan to publish redacted information on occupational injuries and illnesses ( e.g., Docket IDs 0049, 0061, 0063). The National Employment Law Project commented, “MSHA keeps and has kept for decades the PII on the form protected. Clearly, MSHA's system demonstrates that the Department of Labor can post case specific data without releasing PII” (Docket ID 0049). The AFL–CIO recommended that OSHA collaborate with MSHA, NIOSH and other agencies “with a demonstrated commitment and capability to collect and utilize injury and illness data, while protecting employee privacy, and institute similar procedures for the collection, sharing and utilization of injury and illness data reported on the OSHA Form 300 and Form 301” (Docket ID 0061). Worksafe submitted similar comments and added that OSHA's proposed rule is quite modest compared to the reporting requirements for employers in the mining industry (Docket ID 0063). OSHA has been and expects to continue consulting with MSHA, NIOSH, and other Federal agencies while implementing the injury and illness data collection and publication requirements of this final rule.

Finally, on this topic, OSHA notes that MSHA is not alone in its release of information that theoretically could identify individuals indirectly if released and combined with other information. The Federal Railroad Administration (FRA) posts Accident Investigation Reports filed by railroad carriers under 49 U.S.C. 20901 or made by the Secretary of Transportation under 49 U.S.C. 20902; in the case of highway-rail grade crossing incidents, these reports include personally identifiable information (age and gender of the person(s) in the struck vehicle). In addition, the Federal Aviation Administration (FAA) posts National Transportation Safety Board (NTSB) reports about aviation accidents. These reports include information about employees, including job history and medical information. Again, OSHA is not aware of any issues related to the release of such information, a lack that OSHA believes supports its decision to release the relevant information collected in this rulemaking.

9. Risk of Cyber Attack

Cyber security is another issue that OSHA has considered in thinking through how to protect the Form 300 and 301 information safe. OSHA received comments on this issue in the rulemaking that led to the 2016 final rule and, after considering those comments, the agency disagreed with those commenters who suggested that OSHA would not be able to protect employee information (81 FR 29633). In so doing, OSHA observed that “[a]ll federal agencies are required to establish appropriate administrative and technical safeguards to ensure that the security of all media containing confidential information is protected against unauthorized disclosures and anticipated threats or hazards to their security or integrity” (81 FR 29633). Similarly, in the 2019 final rule, OSHA again received and considered comments on the issue of cyber security, ultimately finding that “the ITA data meet the security requirements for government data” (84 FR 388). In addition, the agency did “not find that collecting the data from Forms 300 and 301 would increase the risk of a successful cyber-attack” (84 FR 388). However, the agency noted that some risk of cyberattack and subsequent data risk remained (84 FR 388). And OSHA Stated that it shared concerns of some commenters about how having thousands of businesses upload a large volume of additional data could generally increase risk for cyber-security issues (84 FR 388).

OSHA received some comments about cyber security in response to the NPRM in this rulemaking. For example, the U.S. Poultry & Egg Association commented, “On August 14, 2017, the U.S. Department of Homeland Security notified OSHA of a security breach of the recently activated online incident reporting page. While the full extent of this breach is unknown, it is an unsettling circumstance for employers that a security incident occurred and to learn of the occurrence of a security breach significant enough to shut down the reporting system.” (Docket ID 0053).

The Coalition submitted a comment that addressed the same potential security breach: “As OSHA is well aware, industry concerns about worker privacy breaches came to fruition shortly after the ITA was rolled-out. As determined by the Department of Homeland Security (“DHS”), a serious potential breach of the ITA system occurred . . . virtually immediately after the ITA system had gone live. Although the security issues associated with that breach have since been resolved, industry is fearful of submitting hundreds of thousands of pieces of personal data with personal identifier information (“PII”) on a portal that has already had suspicious activity that warranted DHS scrutiny. As OSHA notes, the ITA episode demonstrated that such large data collection will inevitably encounter malware and may even incentivize cyber-attacks on the Department of Labor's (“DOL”)'s IT system. We are aware of OSHA's view that, since 2019, the DOL's cybersecurity protective software has improved. However, the cyber security risk of employees' highly confidential and personal medical information being hacked and published, or used in other even more nefarious ways, has become even more serious since the Agency decided it was too risky to collect 300 and 301 level data a few years ago. Since 2019, the threat and sophistication of cybersecurity attacks has also grown immensely, outpacing the development of cybersecurity protections. The lack of confidence in protecting data has never been greater in this country.” (Docket ID 0087).

In response, OSHA notes that an investigation of the 2017 incident by the Department of Labor's IT team found there was no breach of data. The ITA detected a virus on a user's computer and blocked that user from accessing the system, as it was designed to do. In other words, the ITA's security system functioned properly and there was no security breach. No other cyber-security issues have been reported. In addition, as explained above, the agency's decision to change course on collecting information from Forms 300 and 301 was not based on cyber-security concerns.

This successful performance of the ITA's security system in this attempted breach underscores OSHA's finding in 2016: although here is some risk cyber attack, the Department of Labor's systems are prepared to defend against such attacks. As explained in the 2016 final rule, regardless of the category of information, all Department of Labor agencies must comply with the Privacy and Security Statement posted on DOL's website. As part of its efforts to ensure and maintain the integrity of the information disseminated to the public, DOL's IT security policy and planning framework is designed to protect information from unauthorized access or revision and to ensure that the information is not compromised through corruption or falsification. Consequently, in this rulemaking, OSHA finds that the data that will be collected in compliance with this final rule will be protected from cyber attack in accordance with the appropriate government standards.

10. The Health Information Portability and Accountability Act (HIPAA)

OSHA also received comments from some interested parties expressing concern about how the proposed rule would relate to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 101–191 ( e.g., Docket IDs 0007, 0013, 0059, 0082). For example, two interested parties commented that the OSHA Forms 300 and 301 include personal and private information about an employee's health and wellness, and that requiring the submission of such information to OSHA will place employers in legal liability due to HIPAA restrictions (Docket IDs 0007, 0013). But as explained below, HIPAA's implementing regulations specifically allow employers to release workplace injury and illness data to OSHA.

The U.S. Department of Health and Human Services (HHS) implements HIPAA through regulations at 45 CFR parts 160 and 164, known as the HIPAA “Privacy Rule.” The Privacy Rule protects the privacy of individually identifiable health information (referred to as “protected health information” or “PHI”) maintained or transmitted by HIPAA-covered entities and their business associates. The term “covered entity” includes health plans, health care clearing houses, and health care providers who transmit health information in electronic form (see 45 CFR 160.104). OSHA is not a covered entity for purposes of the Privacy Rule, so the use and disclosure requirements of the Privacy Rule do not apply to OSHA.

The HIPAA Privacy Rule also excludes certain individually identifiable health information from the definition of PHI. For example, employment records held by a covered entity in its role as an employer are not PHI and the HIPAA Privacy Rule does not prohibit the disclosure of health information contained in employment records to OSHA (see 45 CFR part 160.103). Even for information that qualifies as PHI, the Privacy Rule specifically permits disclosures of PHI without an individual's authorization for certain purposes, including when they are required to do so by another law (see 45 CFR 164.512(a)). HHS has made clear that this provision encompasses an array of binding legal authorities, including statutes, agency orders, regulations, or other Federal, State, or local governmental actions having the effect of law (see 65 FR 82668). Similarly, a covered entity may also disclose PHI without an individual's authorization to “public health authorities” and to “health oversight agencies” (see 45 CFR parts 164.512(b) and (d)). The preamble to the Privacy Rule issued in 2000 specifically mentions OSHA as an example of both (see 65 FR 82492, 82526). Finally, the Privacy Rule also permits a covered entity who is a member of the employer's workforce and provides healthcare at the request of an employer, to disclose to employers protected health information concerning work-related injuries or illnesses, or work-related medical surveillance in situations where the employer has a duty under the OSH Act, the Federal Mine Safety and Health Act, or under similar State law to keep records on or act on such information. Accordingly, covered entities generally may not restrict or refuse to disclose PII required by an OSHA standard or regulation based on the provisions of the Privacy Rule.

OSHA also received comments from interested parties that, while recognizing that HIPAA does not apply to the information disclosures at issue here, argued that OSHA “should examine the principles of HIPPA in determining how to proceed—or not proceed—with this rule” (Docket ID 0059; see also Docket ID 0082). For example, NAHB asserted “HIP[A]A recognizes the legitimate privacy interests that individuals have with respect to their own health information. HIP[A]A also recognizes that aspects of a person's health record can serve as an identifier of a person under certain circumstances. And HIP[A]A recognizes that this is not acceptable” (Docket ID 0059). NAHB further argued that “[t]he procedure for OSHA reviewing this should have been thoroughly considered and addressed in the proposed regulation; it was not” (Docket ID 0059).

OSHA agrees with commenters who suggested that the agency consider applying the principles set forth in the Privacy Rule for the de-identification of health information. Health information is individually identifiable if it does, or potentially could, identify the individual. As explained by commenters, once protected health information is de-identified, there are no longer privacy concerns under HIPAA. Again, it is OSHA's policy under the final rule not to release any individually identifiable information. As discussed elsewhere in this document, procedures are in place to ensure that individually identifiable information, including health information, will not be publicly posted on OSHA's website.

However, OSHA disagrees with NAHB's claim that “OSHA has provided no thought regarding what types of information it will or should redact to protect employees, except to mention that it may redact names and other information that it would otherwise need to redact under the Freedom of Information Act” or that the agency's procedure was not “thoroughly considered and addressed” in the proposal (Docket ID 0059). As reiterated above, the proposal specified which fields the agency proposed to collect and what subset of that collected information it planned to release. It also detailed its plans to ensure that it did not collect certain data ( e.g., by not requiring the submission of certain data fields and designing the system to remind establishments not to submit certain data) and ways to protect the data it does receive ( e.g., carefully choosing which fields would be publicly released and using scrubbing technology to ensure that data contained in the fields to be released did not unintentionally include information which could reasonably be expected to identify individuals directly). In sum, contrary to NAHB's assertion, the agency has carefully considered how to protect information that could reasonably be expected to identify individuals directly and explained its plans and thinking in the proposal.

11. The Americans With Disabilities Act (ADA)

OSHA also received comments related to the Americans with Disabilities Act (ADA). Specifically, in their comment, the Seventeen AGs noted that “if a certain type of occupational injury regularly leads to ongoing disability in a particular industry or place of work,” the case-specific data that would be collected and published under the proposed rule would allow States to “explore what accommodations those employers provide, for example, whether affected workers have been placed in appropriate positions with reasonable accommodations as required under the [(ADA)] and similar State laws” (Docket ID 0045). OSHA agrees with this commenter that this kind of inquiry is one of the many benefits that will stem from this final rule.

The Seventeen AGs' mention of the ADA raises the question of its applicability to this final rule, a question that has been raised in the rulemakings culminating in the 2016 and 2019 final rules (see 81 FR 29665–66; 84 FR 387). At various times as OSHA has considered whether to collect and publish information from establishments' Forms 300 and 301 (and 300A, as well), commenters have raised concerns about whether the ADA would prohibit establishments from releasing health and disability-related information to OSHA. It would not. The ADA would permit the collection by employers of such information.

By its terms, the ADA limits disability-related inquiries and medical examinations of job applicants or employees and requires confidentiality for medical information obtained from any such inquiries or medical examinations. However, the ADA also states that “nothing in this Act shall be construed to invalidate or limit the remedies, rights, and procedures of any federal law” (see 29 U.S.C. 12201(b)). In enacting the ADA, Congress was aware that other Federal standards imposed requirements for testing an employee's health, and for disseminating information about an employee's medical condition or history, determined to be necessary to preserve the health and safety of employees and the public (see H.R. Rep. No. 101–485 pt. 2, 101st Cong., 2d Sess. 74–75 (1990), reprinted in 1990 U.S.C.C.A.N. 356, 357 (noting, e.g., medical surveillance requirements of standards promulgated under the OSH Act and the Federal Mine Safety and Health Act, and stating “[t]he Committee does not intend for [the ADA] to override any medical standard or requirement established by federal . . . law . . . that is job-related and consistent with business necessity”); see also 29 CFR part 1630 App.). The ADA yields to the requirements of other Federal safety and health standards and regulations. The implementing regulation, codified at 29 CFR 1630.15(e), explicitly states that an employer's compliance with another Federal law or regulation may be a defense to a charge of violating the ADA (see Enforcement Guidance on Disability-Related Inquiries and Medical Examinations of Employees under the ADA | U.S. Equal Employment Opportunity Commission ( eeoc.gov) Enforcement Guidance on Disability-Related Inquiries and Medical Examinations of Employees under the ADA | U.S. Equal Employment Opportunity Commission ( eeoc.gov) (available at: https://www.eeoc.gov/​laws/​guidance/​enforcement-guidance-disability-related-inquiries-and-medical-examinations-employees), at Question 21). The ADA recognizes the primacy of other Federal laws including Federal safety and health regulations; therefore, such regulations, including mandatory OSHA recordkeeping requirements and disclosure requirements, pose no conflict with the ADA (cf. Albertsons, Inc. v. Kirkingburg, 527 U.S. 555, (1999) (“When Congress enacted the ADA, it recognized that federal safety and health rules would limit application of the ADA as a matter of law.”)).

It also is worth noting that the information in the OSHA injury and illness records is similar to that found in workers' compensation forms and may be obtained by employers by the same process used to record needed information for workers' compensation and insurance purposes. The Equal Employment Opportunity Commission (EEOC), the agency responsible for administering Title I of the ADA, which addresses employment, recognizes a partial exception to the ADA's strict confidentiality requirements for medical information regarding an employee's occupational injury or workers' compensation claim (see generally 29 CFR 1630.15(e) and EEOC Enforcement Guidance: Workers' Compensation and the ADA (available at https://www.eeoc.gov/​laws/​guidance/​enforcement-guidance-workers-compensation-and-ada), (September 3, 1996)). For these reasons, OSHA does not believe that the mandatory submission and publication requirements in § 1904.41 of this final rule conflict with the confidentiality provisions of the ADA.

12. The Privacy Act

The Plastics Industry Association commented that a failure by OSHA to exclude or reliably redact all personal identifiers and personally identifiable medical information would violate the Privacy Act of 1974, 5 U.S.C. 552a, as well as other privacy laws (Docket ID 0086).

In response, OSHA notes that the Privacy Act is a Federal statute that establishes a code of fair information practices that governs the collection, maintenance, use, and dissemination of personal identifiable information by Federal agencies. The Privacy Act only applies to records that are located in a “system of records.” As defined in the Privacy Act, a system of records is “a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual” (see 5 U.S.C. 552a(a)(5)). Because OSHA injury and illness records are retrieved neither by the name of an individual, nor by some other personal identifier, the Privacy Act does not apply to OSHA injury and illness recordkeeping records. As a result, the Privacy Act does not prevent OSHA from posting recordkeeping data on a publicly accessible website. However, OSHA again wishes to emphasize that, consistent with the applicable exemptions under FOIA, the agency does not intend to post personally identifiable information on the website.

13. Privacy Impact Assessment

Section 208 of the E-Government Act requires Federal agencies to conduct a Privacy Impact Assessment when developing or procuring new information technology involving the collection, maintenance, or dissemination of information in identifiable form or when making substantial changes to existing information technology that manages information in identifiable form. In the preamble to the proposed rule, OSHA stated that it expected to complete a Privacy Impact Assessment before issuing the final rule (87 FR 18540). Several commenters supported this step (Docket IDs 0058, 0068, 0072, 0077, 0094).

OSHA now has completed a Privacy Impact Assessment for this final rule which is available at https://www.dol.gov/​agencies/​oasam/​centers-offices/​ocio/​privacy (Docket ID 0107). In the Privacy Impact Assessment, OSHA determined that the safeguards and controls described in this preamble will adequately protect the collected and published data addressed in the final rule.

14. Other Issues Related to OSHA's Proposal To Require the Submission of and Then Publish Certain Data From Establishments' Forms 300 and 301

a. Miscellaneous Comments

OSHA received a variety of other comments related to its proposal to require certain establishments to submit certain data from their Forms 300 and 301 and its plan to then publish a subset of that data. For example, some interested parties expressed concern over repeated rulemakings addressing the electronic submission of injury and illness data to OSHA ( e.g., Docket IDs 0058, 0060, 0071, 0072, 0077). The Associated Builders and Contractors (ABC) commented, “we hope that OSHA recognizes that the frequent revisions it has made related to the requirements surrounding electronic reporting of injury and illness data has caused confusion and uncertainty among construction contractor employers in respect to what requirements apply to their businesses, especially for small businesses” (Docket ID 0071). Similarly, the Window and Door Manufacturers Association commented, “OSHA must also consider the impact that the agency's repeated changes and reversals to its recordkeeping policies has had on employers, especially smaller entities. This year's proposed rule is now the third such rulemaking by OSHA on injury and illness recordkeeping since 2014.” This commenter added that the frequent changes to recordkeeping regulations have resulted in confusion among employers regarding what requirements apply to their business (Docket ID 0072). The Coalition for Workplace Safety, the National Demolition Association, and the National Lumber and Building Materials Association submitted similar comments (Docket IDs 0058, 0060, 0077).

OSHA acknowledges that some employers may be confused by the multiple rulemakings amending the part 1904 requirements for certain employers to electronically submit injury and illness data from their Forms 300 and 301. However, OSHA believes this rulemaking provided potentially affected employers with clear notice of the possibility that their obligations might change. And OSHA plans to implement a robust roll-out plan to alert employers of the final rule's requirements. Moreover, even if some confusion remains, OSHA must place primary importance on whether new occupational safety and health requirements will help “assure so far as possible . . . safe and healthful working conditions . . . by providing for appropriate reporting procedures . . . which will help achieve the objective of th[e] Act and accurately describe the nature of the occupational safety and health problem” (see 29 U.S.C. 651(b)(12)). As discussed above in Section II, Legal Authority, Section 8 of the OSH Act provides OSHA with broad authority to prescribe regulations as necessary or appropriate for the enforcement of the OSH Act and for developing information about the causes and prevention of occupational injuries and illnesses. Federal agencies, furthermore, are permitted to change or reverse prior policies, provided that they provide a reasoned explanation for the change. In this rulemaking, OSHA has made every effort to balance the benefits of this rule to occupational safety and health against any potential burden created for the regulated community, and has explained the reasons supporting any changes in OSHA's prior policies throughout this preamble.

As explained in more detail below, based on its experience with the collection of injury and illness data through the ITA, and with the advancements in technology to protect individual privacy, OSHA has determined that it is necessary and appropriate at this time to require certain larger establishments in higher hazard industries to electronically submit data from their Forms 300 and 301 to OSHA once a year. OSHA believes that this requirement to submit case-specific data will have significant benefits for occupational safety and health, especially since the requirement applies to certain establishments in higher hazard industries where such reporting will have the greatest impact on reducing injury and illness rates.

b. The Effect of the Rule on the Accuracy of Injury and Illness Records

OSHA received comments expressing concern that OSHA collection and publication of data from Forms 300 and 301 would lead to less accurate data, because employers may respond by recording fewer injuries and illnesses ( i.e., under-recording) ( e.g., Docket IDs 0052, 0053, 0088, 0090). One commenter, Angela Rodriguez, stated that some employers may be tempted to avoid logging recordable cases (Docket ID 0052). The U. S. Poultry & Egg Association commented that employers might record less information because of fears that recording more cases could harm recruitment and retention of employees (Docket ID 0053), while the National Retail Federation stated that “fear of developing a negative image in their communities, may cause managers to underreport injuries and illnesses that occur at the workplace to protect their business reputation” thereby reducing the accuracy of the data OSHA collects (Docket ID 0090). NIOSH commented that employers might submit inflated employee counts to OSHA in order to reduce their injury and illness rates or alter their NAICS code to avoid the rule's requirements (Docket ID 0035, Attachment 2).

In response, OSHA notes that, as discussed above in Section III.B.4 of this Summary and Explanation, the agency already publishes establishment-specific information from the OSHA Form 300A. Because the new information employers will be submitting under the final rule ( i.e., the information from Forms 300 and 301) is simply the more specific information underlying the data from the 300A that employers are already submitting (and that is already being published online), it is not clear to OSHA why publishing the additional information would change any existing incentives to under-record or to falsify information. Commenters did not provide any examples of increased under-recording as a result of the collection and publication of Form 300A data, nor is OSHA aware of any. While OSHA believes that most employers act in good faith when carrying out their recordkeeping duties under the OSH Act, failing to record injuries or illnesses, or submitting false information to OSHA, could result in a citation for a violation of OSHA's recordkeeping regulations. In addition, employers that falsify information provided to the government could also be found to have violated 18 U.S.C. 1001(a), which prohibits the knowing and willful provision of false information regarding material facts on matters that are under the jurisdiction of the Executive branch, or Section 17(g) of the OSH Act, 29 U.S.C. 665(g), which prohibits knowingly making any false statement, representation, or certification in any application, record, report, plan, or other document filed or required to be maintained pursuant to the OSH Act.

Some commenters raised the possibility that expanded data collection and publication could lead some employers to record fewer injuries and illnesses for which work-relatedness is unclear ( e.g., Docket IDs 0042, 0086, 0088). For example, the Chamber of Commerce stated that employers “will reconsider whether to record as many injuries or illnesses” and pointed in particular to cases in which work-relatedness is difficult to determine (Docket ID 0088).

While OSHA recognizes that there are cases in which the analysis of work-relatedness may not be straightforward, OSHA also notes that employers are required to make good faith efforts to determine whether an injury or illness is work-related in order to establish whether the case is recordable under part 1904 (see § 1904.4(a)). There is a good deal of guidance in OSHA's recordkeeping regulations themselves (see § 1904.5) on how to determine if an employee's injury or illness is work-related, including: general guidance for when a case is considered to be work-related and when work-relatedness is presumed (§ 1904.5(a)); a list of circumstances in which cases that occur in the work environment are not work-related (§ 1904.5(b)(2)); and instructions for how to determine work relatedness when employees are injured or become ill during work travel or while working from home (§ 1904.5(b)(6), (7)). Further guidance on the work-relatedness determination, as well as useful examples, can be found on OSHA's web page, Detailed Guidance for OSHA's Injury and Illness Recordkeeping Rule ( https://www.osha.gov/​recordkeeping/​entry-faq). While OSHA does not issue citations for over-recording, to the extent that this rule encourages employers to record only cases that they have determined are work-related, OSHA would expect the rule to increase the accuracy of the data that is recorded and then submitted to OSHA. Indeed, the Chamber of Commerce appears to support this as a likely outcome, stating that employers “may look more closely as to whether the injury or illness is work related and needs to be recorded” (Docket ID 0088).

Some commenters also expressed concern that expanded data collection and publication would lead to greater underreporting by employees of their workplace injuries and illnesses, thereby reducing the data's accuracy ( e.g., Docket IDs 0042, 0055, 0056, 0070, 0086, 0087). The Employers E-Recordkeeping Coalition stated that it “is very concerned that the increased risk of employee personal and medical information being collected by a Federal agency and then publicized, albeit inadvertently, will create a significant disincentive for employees to report workplace injuries that are recordable events” (Docket ID 0087). Worksafe and the Strategic Organizing Center suggested that OSHA add a provision to prohibit employer practices that discourage the reporting of injuries and illnesses by employers, pointing to employer programs that disincentive reporting as well as workers' fear of retaliation for reporting an injury or illness to their employer (Docket IDs 0063, 0079).

With respect to the impact of privacy concerns on employee reporting, OSHA understands the importance of protecting personally identifiable information and notes that there is a very low risk that information that could reasonably be expected to identify individuals directly will be disclosed as a result of this final rule. OSHA acknowledges commenters' concerns about the potential posting of this type of information on a publicly accessible website. However, the posting or disclosure of information that could reasonably be expected to identify an individual directly is not the intent, nor is it a likely result, of this rulemaking. As explained in more detail in Section III.B.6 of this Summary and Explanation, above, OSHA believes it has, and will have, effective safeguards in place to prevent the disclosure of that type of information. Further, OSHA hopes that employers will educate their employees about the safeguards OSHA is putting into place to protect against the disclosure of information that could reasonably be expected to identify individuals directly. OSHA also intends to include materials for employees in the materials that will be created to educate interested parties about the requirements of the rule as well as those safeguards.

In response to Worksafe's comment proposing a new regulatory provision prohibiting employer practices that discourage employee reporting, OSHA notes that the recordkeeping regulations, at § 1904.35(b)(1)(i), already require employers to establish reasonable procedures for reporting work-related illnesses and injuries that do not deter or discourage employees from accurately reporting their injuries or illnesses. Furthermore, the regulations explicitly prohibit employers from discharging or otherwise discriminating against employees for reporting work-related injuries and illnesses (§ 1904.35(b)(1)(iv); see also § 1904.36). And as OSHA clarified in the 2016 final rule which contained these recordkeeping provisions, a workplace safety incentive program could be found to violate § 1904.35 if employees are penalized for reporting work-related injuries or illnesses as part of the program (81 FR 29673–74). OSHA further stated that the changes were designed to “promote accurate recording of work-related injuries and illnesses by preventing the under-recording that arises when workers are discouraged from reporting these occurrences” (81 FR 29669). Thus, OSHA has addressed this issue in its regulations since 2016. Moreover, OSHA has recognized since at least 2012 that incentive programs that discourage employees from reporting injuries and illnesses by denying a benefit to employees who report an injury or illness may be prohibited by Section 11(c) (see https://www.osha.gov/​laws-regs/​standardinterpretations/​2012-03-12-0;81 FR 29673–74).

In contrast to those who argued that the final rule will lead to less accurate data, other commenters argued that the expanded data collection and publication will lead to more accurate data, because of increased transparency and oversight ( e.g., Docket IDs 0049, 0066, 0084, 0089). For example, the United Food and Commercial Workers International Union (UFCW) stated, “We anticipate that the requirement that companies submit data electronically will improve the quantity, quality, and accuracy of their records, and increase OSHA's and the public's oversight ability, all of which will improve worker health and safety also” (Docket ID 0066). Cal/OSHA noted that the increased transparency created by the publication of the data will encourage and support accuracy in injury and illness reporting (Docket ID 0084).

OSHA agrees with commenters who stated that the final rule will result in improved accuracy of injury and illness records, due to increased transparency and oversight by OSHA, employees, and others, as well as awareness by employers that their records could be subject to additional scrutiny. Section 1904.32 already requires company executives subject to part 1904 requirements to certify the annual summary (Form 300A); this process requires them to examine the OSHA 300 Log and certify that the annual summary is correct and complete based on their examination of the OSHA 300 Log and their knowledge of the process by which the information was recorded. OSHA recognizes that most employers are diligent in complying with this requirement. However, a minority of employers is less diligent, leading to violations of the recordkeeping regulations. It is OSHA's hope that, if these employers know that their data must be submitted to the agency and may also be examined by members of the public and their own employees, they may pay more attention to the requirements of part 1904, which could lead both to improvements in the quality and accuracy of the information and to better compliance with § 1904.32. Increased oversight by labor unions or a company's employees could lead to corrections to the data if, for example, a labor union discovers that a known workplace injury of a union member is not included in the published data and reports the omission to the employer ( e.g., Docket ID 0049). Finally, OSHA notes the comment from NIOSH suggesting various means of investigating the effect of implementation of this final rule on compliance with the requirements of part 1904 (Docket ID 0035, Attachment 2). While the agency has determined that staggered implementation, where industries with the highest injury rates would be required to comply first, would be too confusing to implement, OSHA encourages future studies to assess the effect of the final rule on injury and illness recording, reporting, and data submission, and to identify solutions if problems are found.

c. Collecting and Processing the Data From Forms 300 and 301 Will Help OSHA Use Its Resources More Effectively

In the preamble to the 2019 final rule, OSHA stated that collecting and processing the Form 300 and 301 data and keeping information confidential which could reasonably be expected to identify an employee directly would require the agency to divert resources from other priorities, including the analysis of Form 300A data (84 FR 392; see also 84 FR 387). In particular, OSHA was concerned that collecting and processing this data would prevent it from “fully utilizing the data from the Form 300As and severe injury reports it is already collecting to improve its enforcement and outreach objectives to ensure compliance with the OSH Act” (84 FR 393). However, in the NPRM, OSHA explained that because of improvements in available technology, it would no longer need to rely on manual review or analysis for Form 300 and 301 data and had preliminarily determined that the agency's resource-related concerns described in the 2019 final rule were no longer compelling (87 FR 18541–42). In addition, OSHA explained that the proposed rule would increase the agency's ability to focus resources on those workplaces where workers are at high risk (87 FR 18533). In other words, the proposal would, in some ways, save agency resources by helping the agency be more efficient, e.g., “allow[ing] the agency to focus its enforcement and compliance assistance resources based on hazard-specific information and trends, and . . . increas[ing] its ability to identify emerging hazards, at the establishment level” (87 FR 18538).

A number of interested parties submitted comments on this issue and generally agreed that the data collected and published under this final rule will actually help OSHA use its limited resources more effectively to protect workers. For example, some interested parties, including the Council of State and Territorial Epidemiologists, National COSH, the Laborers' Health and Safety Fund of North America, Worksafe, the International Brotherhood of Teamsters, Centro de los Derechos del Migrante, and Public Citizen, commented that requiring regular electronic submission of injury and illness data would help OSHA to use its limited enforcement and compliance assistance resources more effectively (Docket IDs 0040, 0048, 0063, 0080, 0083, 0089, 0093). The AFL–CIO agreed that because OSHA's resources are very limited, it “must maximize the use of existing tools” (Docket ID 0061).

Commenters also provided examples of how this data would help OSHA use its resources more effectively. For example, National COSH, the National Employment Law Project, and the Centro de los Derechos del Migrante commented that “case-specific data will help the agency identify the hazard-specific materials and other compliance assistance resources they could direct to employers who report high rates of injuries or illnesses related to those hazards,” and “to workers in those industries” (Docket IDs 0048, 0049, 0089). These commenters also said that the data would “aid the agency in identifying emerging hazards . . . and focus outreach to employers and workers whose workplaces might include those hazards.”

Similarly, Public Citizen commented that the collected data would enable OSHA to “quickly pinpoint workplace hazards . . . and target its enforcement efforts” (Docket ID 0093). The International Union of Painters and Allied Trades/AFL–CIO commented that this requirement would “ensure factors responsible for those pronounced illness and injuries trends are identified and addressed in a timely manner for the well-being of workers” (Docket ID 0073). Worksafe also noted that electronic submission would allow the agency “to search and analyze the data” and provide “timely and systematic” injury and illness information that will help OSHA to focus its enforcement efforts on “hazards that are affecting workers now ” (Docket ID 0063).

On the other hand, the Chamber of Commerce questioned whether the data could actually help OSHA target its enforcement efforts (Docket ID 0088, Attachment 2). The Chamber stated that injury and illness data are complex and “unavoidably subjective,” and asserted that because the log only includes work-related injuries, it does not show actual risks—rather, “it shows whether the employer believes that there is a connection between the working environment and the injuries.” Additionally, several commenters reiterated OSHA's concerns from the 2019 final rule regarding the diversion of OSHA's resources from other important initiatives ( e.g., Docket IDs 0058, 0070, 0076). Some such commenters argued that any resource diversion would be inappropriate because OSHA is incapable of processing and utilizing the Forms 300 and 301 data that would be received under the proposal. OSHA has addressed those comments elsewhere in this preamble, explaining that the agency has the capability to collect and use such data (see, e.g., Section III.B.14.d of this Summary and Explanation). Other commenters merely referenced OSHA's 2019 determination that its resources would be diverted without analyzing the reasons OSHA gave for reconsidering its previous decision. Still other commenters attacked OSHA's findings that improvements in technology will decrease the resources required to collect and process the Form 300 and 301 information and ensure that information which could reasonably be expected to identify an individual directly is not publicly released. OSHA has covered these comments elsewhere as well (see, e.g., Section III.B.6 of this Summary and Explanation).

Finally, the International Bottled Water Association (IBWA) pointed to district court rulings on the 2019 final rule and argued, “[T]he reviewing court agreed with OSHA's determinations that costly manual review of collected 300 and 301 data would be needed to avoid a meaningful risk of exposing sensitive worker information to public disclosure, finding that the uncertain benefits of collecting the 300 and 301 data did not justify diverting OSHA's resources from other efforts.” (Docket ID 0076).

IBWA's comment misconstrues the court's decision. The court did not “agree” with OSHA's determination. Rather, the court found that OSHA's decision was neither arbitrary nor capricious, i.e., that OSHA had not “entirely failed to consider an important aspect of the problem, [or] offered an explanation for its decision that runs counter to the evidence before the agency” at the time OSHA made its decision (see State of New Jersey et al. v. Pizzella, No. 1:19–cv–00621 (D.D.C. Jan. 11, 2021) (citation and internal quotations omitted)). Importantly, the court stated that “the arbitrary and capricious standard is narrow, and a court is not to substitute its judgment for that of the agency (id. (citation and internal quotations omitted)). Rather, reviewing court's decisions are “based on a consideration of the relevant factors and whether there has been a clear error in judgment” (id. (citation and internal quotations omitted)). In short, the court did not do an independent review of all the record evidence and determine that OSHA made the correct decision. Instead, it looked to see if OSHA considered all the relevant factors and made a reasonable decision. The fact that an agency's decision based on the record at the time was reasonable does not prevent the agency from subsequently making a different reasonable decision based on new information.^[12] That is what OSHA has done here.

After consideration of these comments, OSHA agrees with commenters that collection of case-specific information from the Form 300 and 301 will help the agency use its enforcement and compliance assistance resources more effectively by enabling OSHA to identify the workplaces where workers are at high risk. As explained in the 2001 final rule, and as identified by commenters, establishment-specific injury and illness information will help OSHA target its intervention efforts on the most dangerous worksites and the worst safety and health hazards, and injury and illness data will help OSHA to identify the scope of safety and health hazards and decide whether regulatory intervention, compliance assistance, or other measures are warranted (see 66 FR 5917). OSHA disagrees with the Chamber's claim that the case-specific data would not help OSHA target its enforcement efforts because it does not show actual risks. The Chamber is correct in that a single recorded injury or illness, in and of itself, does not necessarily indicate the existence of a risk. Similarly, recording a work-related injury, illness, or fatality does not mean that the employer or employee was at fault, that an OSHA rule has been violated, or that the employee is eligible for workers' compensation or other benefits (see Note to § 1904.0). However, an injury or illness recorded under part 1904 is an indicator of a potential risk in the workplace, i.e., the employer has determined that a particular injury or illness of an employee meets the definition of work-relatedness in 29 CFR 1904.5(a). In other words, such data can indicate a failure in an area of an establishment's safety and health program or the existence of a hazard. The fact that they do not always do so is not persuasive (see Section III.B.4 of this Summary and Explanation). Thus, rather than diverting OSHA's resources from higher priority issues, OSHA has determined that the data collected and published under this rule will help OSHA use its limited resources more effectively to protect workers.

d. OSHA's Capacity To Collect and Process the Data From Forms 300 and 301

The preamble to the 2019 final rule cited the costs of building the data collection system and processing the data from Forms 300 and 301 as one reason OSHA was rescinding some of the 2016 rule's data submission requirements (84 FR 389). As discussed throughout this preamble, in the NPRM to this rulemaking, OSHA found that the reasons given in the preamble to the 2019 final rule for the removal of the 300 and 301 data submission requirement are no longer compelling (87 FR 18538).

As to the collection of the data, OSHA (and more broadly, the Department of Labor) has the technical capacity to build the necessary data collection system. OSHA's ability is supported by its success in building and utilizing the system to collect data from establishments' Forms 300A. Since 2017, the ITA has collected submissions of Form 300A from roughly 300,000 establishments per year. In addition, OSHA's ability to build such a system is supported by the fact that other Department of Labor agencies, i.e., BLS and MSHA, successfully built and are utilizing similar collection systems (see, e.g., Docket ID 0079). BLS's system, in particular, is illustrative of the Department's ability to create and utilize such systems: each year, the BLS Survey of Injuries and Illnesses (SOII) collects the same case-specific information, from the same OSHA records, from roughly 200,000 employers, nearly 150,000 more submitters than will provide data to OSHA under this final rule. NIOSH also effectively built and is using a similar system (Docket IDs 0035, Attachment 2, 0079). Based upon this information, it is reasonable to anticipate that OSHA will have the technical capacity to collect the case-specific submissions. OSHA discusses the costs to build the data collection system in Section IV, Final Economic Analysis.

As to data processing, the preamble to the 2019 rule does not specifically explain what is included in the “processing” of data; however, the discussion included a comment from NIOSH “offering to help with data analysis” and “not[ing] that it has already developed auto-coding methods for categorizing occupation and industry based on free text data and has successfully utilized similar free text data collected from workers' compensation claims” (84 FR 389, referencing Document ID 2003–A2). As explained in the NPRM for the current rulemaking, the agency preliminarily found that these concerns about “processing” costs were no longer compelling, due to technological developments in automated data coding for text-based fields that have made it easier and more cost-effective for OSHA to efficiently use electronically submitted, establishment-specific, case-specific injury and illness data. As discussed below, coding data is helpful for characterizing, analyzing, and making use of large amounts of text-based information.

In the preamble to the proposed rule, OSHA declared an intention to use automated systems to assign standardized codes based on the information contained in the text fields ( e.g., type of accident is “fall”) to categorize and more efficiently use the data (87 FR 18540). This standardized, automated coding of information from text fields in Forms 300 and 301 is already being done by BLS. As explained in the preamble to the proposed rule, in 2018, after the beginning of the previous rulemaking process, BLS switched to an autocoding system that uses deep neural networks (87 FR 18541). This system outperformed the alternatives across all coding tasks and made an average of 24% fewer errors than the logistic regression autocoders, and an estimated 39% fewer errors than the manual coding process.^[13] OSHA explained in the preamble that, by 2019, according to BLS, “automatic coding had been expanded to include all six primary coding tasks (occupation, nature, part, source, secondary source, and event), with the model assigning approximately 85% of these codes.” ^[14] OSHA asked for public comment on the issue of automated coding of text-field data and other available technology that would enable OSHA to automatically code these data and also specifically asked, “In addition to the automated methods for coding text-based data discussed above, what additional automated methods exist to code text-based data?” (87 FR 18547).

In response, NIOSH commented, that it “collects occupational injury data from a national probability sample of emergency departments.” It further explained: “These data are collected through the occupational supplement to the National Electronic Injury Surveillance System (NEISS-Work) [NIOSH 2022a]. Beginning with the 2018 NEISS-Workdata, injury event or exposure and source codes from the BLS Occupational Injury and Illness Classification System (OIICS) Version 2.01 were assigned through a machine learning algorithm with manual quality control efforts.” (Docket ID 0035).

NIOSH clarified that the machine learning algorithm “relies mostly on the information in the narrative injury incident description field.” Further, NIOSH explained that it “has continued to enhance [its] machine learning process using more technologically advanced approaches, including incorporating additional quantitative variables, which has increased the coding accuracy and further reduced the need for manual coding.” It also noted that it recently collaborated with a partner university to develop a machine learning algorithm that assigns Bureau of Census industry codes based on the narrative fields of employer name and business type (Docket ID 0035).

Similarly, the Strategic Organizing Center (SOC) referenced the work that BLS has done, stating that BLS “faced a problem of similar magnitude when constructing the addition to the Annual Survey of Occupational Injuries and Illnesses in the early 1990's—the Detailed Case and Demographic series, based on its sampling of the exact same data types from employers Form 301's” and it “developed and refined the Occupational Injury and Illness Coding System (OIICS).” SOC extolled BLS's system: “[t]his system is now successfully used annually to code all those cases, with extraordinary benefits for all parties interested in both the BLS survey and the underlying data from the employer sources themselves” (Docket ID 0079).

In contrast, AIHA commented, “Automated methods to analyze text-based responses are very difficult to develop due to the variation of words and writing styles used around the United States. It would be more cost effective to expand the use of checkboxes and radio buttons to assist in interpreting and extracting data from text responses.” (Docket ID 0030). Similarly, the U.S. Poultry and Egg Association commented, “the idea that OSHA will assess the OSHA 301's is unrealistic. The amount of data from the OSHA 301 will be massive and the answers for most questions are not standardized” (Docket ID 0053).

The Phylmar Regulatory Roundtable also expressed doubts about OSHA's ability to process the data it would receive pursuant to the proposed rule, commenting that, “[t]he amount of information and data points that this regulation will produce is exponentially larger than what OSHA currently collects from Form 300A alone.” It added that “[i]t is also not clear whether, despite the use of technology such as AI or deep learning models to process and interpret the data, OSHA has the resources in place to constructively utilize the information.” PRR estimated that OSHA would receive “1,065,363” documents if the proposed rule was promulgated, a number which PRR claimed is “3 times more than the number of documents OSHA has experience working with” (Docket ID 0094).

The Employers E-Recordkeeping Coalition (Coalition) similarly expressed concerns with OSHA's plans, arguing that “[t]he proposed use of an automated system to assign standardized codes based on text identified in the 300 and 301 forms is unrealistic.” Specifically, the Coalition doubted that a system which relies on keyword searches would be helpful because “[they] are literal in the sense that computers find terms wherever they appear—even if part of a larger phrase or used in a different context. Words often have multiple meanings, so keyword searches tend to return irrelevant results (false positives), failing to disambiguate unstructured text.” The Coalition added that such “searches also may fail to identify useful information that does not use the express search terms (false negatives).” Further, it noted, “OSHA's proposed use depends on employers typing words without spelling errors, abbreviated text, or industry-specific language, acronyms or codes that are not encapsulated in a word search. Under these conditions, OSHA would miss mountains of pertinent information, be flooded by irrelevant information, and, in our view, simply would not effectively identify workplaces that should be targeted for enforcement.” The Coalition concluded: “[a]n accurate analysis of employer 300 and 301 information requires individualized analyses by real people—not IT systems using word searches” (Docket ID 0087; see also Docket ID 0076).

In response, OSHA notes that no coding system, including manual coding, is 100% accurate. However, as discussed in the preamble to the proposed rule, a system to collect and autocode text-based data from OSHA Forms 300 and 301 already exists, and BLS is effectively using it (see, e.g., Docket ID 0102 ^[15] ). In fact, BLS continues to expand use of autocoding, explaining that “For survey year 2020, all cases mentioning `covid' or `corona' were manually coded due to their novel nature and prevalence, dropping the percentage of cases autocoded. Since then, COVID–19 cases were integrated into the autocoder training process, allowing for the automated coding of approximately 92 percent of codes for survey year 2021. Starting with survey year 2021, BLS expanded collection of case data from all sampled establishments to include details for cases involving days of job transfer or restriction only. Previously BLS collected complete details only for cases involving days away from work. Biennial estimates of detailed case circumstances for cases involving days away from work, job transfer, or restriction covering survey years 2021–2022 will first be published in the fall of 2023.” ^[16] Chart 1, below, illustrates the SOII autocoder performance for data collected annually.

NIOSH also currently has the capability to accurately autocode text-based data related to occupational injuries and illnesses. OSHA is continuing discussions with BLS and NIOSH about adopting and/or modifying their autocoding source code to create a pilot system where the autocoding of OSHA data collected by OSHA could be tested and compared to manual coding of the same data. Upon successful testing and adoption of the autocoding system, OSHA plans to consult and work with BLS, NIOSH, and other agencies with experience autocoding text-based occupational safety and health data for long-term system maintenance to continuously update the neural network code and refine automation of the data. Until the autocoding system has been tested and is in place, OSHA intends to only use and publish uncoded data. Both uncoded and coded data can be useful for OSHA, as well as researchers, employers, and employees.

Once the data are coded, OSHA expects to use the data similarly to how the agency currently uses coded data from the Severe Injury Reporting (SIR) program (see Docket ID 0005 for an example of a search interface for the data that will be collected under this final rule). OSHA also intends to combine the coded data with other data sources ( e.g., inspection data or SIR data) to increase the utility of the data for both the agency as well as other users ( e.g., employers, employees, researchers, and the public). The specific estimated cost burden on OSHA and employers for data collection and processing is discussed in Section IV, Final Economic Analysis, below.

e. Data Submission

In the preamble to the proposed rule, OSHA also asked the following two questions related to helping employers meet the requirements of the proposed rule:

• Are there electronic interface features that would help users electronically submit part 1904 data, particularly for case data from the OSHA Form 300 and Form 301 and for establishments that submit using batch files? For example, would it be helpful for OSHA to provide a forms package or software application that exports the required files into a submission-ready format?

• What features could OSHA provide to help establishments determine which submission requirements apply to their establishment?

OSHA received a number of comments related to these questions. Electric Boat commented that their company currently uses proprietary recordkeeping software to compile injury and illness data. Data from the Form 300A is then manually entered in order to submit it to OSHA. Electric Boat asked how OSHA will require data on the Forms 300 and 301 to be submitted and noted that manually entering data for each case would be difficult, costly, and could result in errors in the submitted data. The company asked for “clarification on the method of submission and whether or not scanned versions or PDF uploads of the forms would be an acceptable means of submission” (Docket ID 0028).

The Sheet Metal and Air Conditioning Contractors' National Association expressed concern about being required to use OSHA-provided software on their systems, alleging that this would require additional resources for familiarization with the software and that it could create potential cyberliability claims for their member companies (Docket ID 0046). On the other hand, AIHA urged OSHA to “consider providing software with recordkeeping logic to enable the completion of data forms and automatic generation of logs for posting and reporting. . . . Employers struggle with interpreting recordkeeping requirements, and a user interface could include interpretation logic as well as assist in paperwork completion” (Docket ID 0030). The AFL–CIO similarly stated that it would be useful for OSHA to provide basic software for “injury and illness recordkeeping from which the data can be easily uploaded/reported to OSHA through a secure website as OSHA envisions” (Docket ID OSHA–2013–0023–1350, Attachment 2). And Cal/OSHA “encourage[d] the design of a data submission system that is compatible with other existing electronic systems used to track and report establishment-specific injury and illness data” (Docket ID 0084).

For the expanded data collection under this final rule, OSHA plans to continue to enable three methods of data submission: manual data entry, batch file, and API. In manual data entry, the user enters the data into a web form and then submits the web form. In batch file submission, the user uploads a csv file (a delimited text file in which commas separate the values). In API (application programming interface), the user uses a software program that communicates directly with OSHA's data collection program. In response to Cal/OSHA's comment, OSHA notes that the API submission method is compatible with other existing electronic systems used to track and report injury and illness data. In addition, OSHA intends to continue to require electronic submission of the recordkeeping data, i.e., OSHA will not permit the uploading of scanned documents or pdfs.

None of the data submission methods described above require establishments to use OSHA-provided software on their systems. Indeed, OSHA has never provided, and does not intend to require employers to use, OSHA-developed software for data submission. OSHA, however, is aware that some employers—particularly small employers—might find OSHA-provided software useful for data submission, as reflected in the comments from the AIHA and the AFL–CIO. OSHA will therefore consider developing and providing such software in the future; however, use of such software would not be required and the other data submission options would remain available. Regardless of whether OSHA decides to provide such software, OSHA expects that developers of proprietary recordkeeping software will expand their applications that enable automated electronic submission of the required information from the OSHA Form 300A to also include submission of information from the Forms 300 and 301; this is further discussed in the Final Economic Analysis, below.

AIHA noted that “Built-in error checks for key data problems would be helpful,” stating that the usefulness of the online data could be affected by errors in submissions: “For example, the 2020 data for NAICS codes in the 331500 industry series contain five entries with more than 150,000 hours worked per employee. In one case, an employer with 150 employees reported working 24 million hours. On the other hand, there were a couple of anomalies in the opposite direction, including an employer with 27 employees who reported a total of only 40 hours worked for the entire year, less than two hours per employee. The result of these obvious errors is that the average hours for the industry were 3,713 per worker, almost double the expected number. . . . OSHA should consider adding some editing features that would highlight potential errors.” (Docket ID 0030).

In response, OSHA notes that the Injury Tracking Application (ITA) already contains built-in edits that warn users of potential data errors, including warnings about too many or too few hours worked per employee. However, OSHA decided to allow the user to bypass the warning in order to avoid discouraging or prohibiting the user from meeting their reporting obligations. Each year, OSHA follows up with users who submitted questionable data by informing them of the potential errors and providing step-by-step guidance on how to correct the error. OSHA encourages data corrections, but does not require them. This follow-up process is limited to establishments under Federal OSHA jurisdiction. OSHA anticipates incorporating similar built-in edits into the expanded ITA for collection of Form 300/301 information in order to warn users of potential errors in their submissions; the agency, however, does not intend to prevent users from submitting their information if they bypass the warning.

On a related topic, the Coalition for Workplace Safety (CWS) requested that OSHA “establish clear procedures for employers to make corrections to already-submitted data, and improve internal processes to ensure those corrections are reflected in the publicly posted data” because “[c]urrently, upon notice from an employer of a required correction, it takes months for OSHA to make these corrections online” (Docket ID 0058). OSHA notes that these comments seem to reflect a misunderstanding of the process for correcting injury and illness information that has already been submitted. For changes to data for the current collection year, the Injury Tracking Application allows respondents to edit their already submitted data, and those changes take place immediately within the application. To make the data publicly available, OSHA posts each year's data on its public website three times: (1) an initial file is posted in April of the collection year; (2) an updated file is posted in September of the collection year; and (3) a final file is posted in the beginning of the following year. Users may also make requests for changes to previous years via the Help Request Form on the Frequently Asked Questions page for the Injury Tracking Application ( https://www.osha.gov/​injuryreporting/​ita/​help-request-form). During the six years OSHA has been collecting information from the Form 300A, OSHA is aware of only one request to change the data for an establishment in the publicly posted file. That change was made within days, and a revised file was posted. Because this system has been working so far to incorporate changes made to already-submitted data, OSHA intends to continue to follow these procedures for correcting and posting updated data.

More generally, the NSC recommended that OSHA develop tools and resources to help employers understand the forms and questions, “which could include a mentoring program allowing for larger, more sophisticated employers to assist small and mid-sized businesses with reporting” (Docket ID 0041). While OSHA certainly does intend to develop additional tools and resources to enable employers to comply with the final rule, it does not currently have plans to develop such a mentoring program. However, OSHA encourages collaboration between regulated entities, whether as part of industry associations, union efforts, or the type of collaboration mentioned by NSC. In addition, OSHA notes that the compliance assistance materials the agency will offer could be used as part of such collaborative efforts.

Regarding the means of determining an establishment's NAICS codes and number of employees, NIOSH recommended that employers use, as a starting point, the NAICS and employee counts that are reported quarterly, on a per-establishment basis, to their State workforce agencies. NIOSH noted that these reports are submitted as part of their unemployment insurance (UI) filings and/or as part of the Quarterly Census of Employment and Wages (QCEW), a Federal-State partnership (Docket ID 0035). In addition, NIOSH suggested that “a single summary `lookup' table be provided to make it easy to simply look up any industry and see the requirements for form submission by establishment size.” Furthermore, NIOSH suggested that OSHA could provide a table or tables that would include different generations of NAICS codes, to account for the fact that different employers will be using NAICS codes from different years. (Docket ID 0035, Attachment 2).

In response, OSHA agrees with NIOSH that it would be appropriate for employers to use the reports they make to State workforce agencies as a starting point for determining their NAICS and employee numbers. OSHA also concurs that a look-up table by industry and establishment size could help establishments determine whether and how they are affected by the data submission requirements. The agency currently has a look-up app at https://www.osha.gov/​itareportapp to help employers determine if their establishment is required to submit 300A data to OSHA, based on State location, peak employment in the previous year, whether the establishment is a government facility, and the establishment's NAICS code. The agency plans to modify the app to cover the new requirements before they become effective.

Finally, OSHA asked the following question in the proposal about requiring versus allowing establishments that already have accounts in the ITA to update their accounts to the 2022 NAICS: “Going forward, OSHA intends to use the 2022 NAICS in the ITA for establishments that are newly creating accounts. However, for establishments that already have accounts in the ITA, the version of NAICS used is the 2012 NAICS. BLS anticipates that establishments that already have accounts in the ITA, are also subject to the SOII, and have 2022 NAICS codes that are different from their 2012 NAICS codes, would be unable to use the data-sharing feature . . . to prefill their BLS SOII submission with data already submitted through the OSHA ITA, unless these establishments updated their accounts to revise their industry classification from the 2012 NAICS to the 2022 NAICS. What are the advantages and disadvantages of requiring establishments that already have accounts in the ITA to update their accounts to the 2022 NAICS? How much time would an establishment require to determine whether their 2022 NAICS is different from their 2012 NAICS? How much time would an establishment require to edit their NAICS code in the ITA to reflect any changes?” (87 FR 18547).

In response to this question, NIOSH expressed a preference for all users to update their NAICS codes to the 2022 version in the OSHA ITA: “As potential end users of the data, NIOSH believes the use of multiple NAICS code schemes will require extra work to analyze the data and increase the potential for errors during data entry and data analysis because the codes often change between versions. . . . For end users who are interested in analyzing the submitted data, the first step will be to crosswalk the codes across the various coding schemes, mapping old codes to new codes so that a single coding scheme can be used. Depending on the changes from version to version, crosswalking codes is often a tedious, time-consuming task and can potentially introduce error when the crosswalked categories are not the same or certain codes cannot be easily crosswalked.” (Docket ID 0035, Attachment 2).

CWS also commented on the issue of updating NAICS codes in the OSHA ITA: “OSHA also states that establishments creating new accounts within the Injury Tracking Application (“ITA”) that OSHA uses for data submission will be identified using 2022 NAICS codes, while establishments with existing ITA accounts will continue to be identified by the 2017 NAICS code. These inconsistencies will cause confusion for employers, may require employers to keep multiple sets of records, and may result in either over- or under-reporting.” (Docket ID 0058).

OSHA has decided to allow, but not require, employers that already have accounts in the ITA to update the NAICS for their establishments to the 2022 codes. OSHA understands NIOSH's concern about the time-consuming and potentially inaccurate process of using crosswalks to convert from 2012 NAICS to 2022 NAICS when using the data for research purposes. However, the same concern applies to individual establishments using a crosswalk to update their NAICS. In fact, end users of the data may have more experience with NAICS and crosswalk use than those submitting data. OSHA has therefore determined not to burden establishments that already have accounts in the ITA with a requirement to update their NAICS codes from 2012 NAICS to 2022 NAICS. Establishments will have the option to update, but the update will not be required. Establishments that want to take advantage of the data-sharing feature to prefill their BLS SOII submission with data submitted to OSHA will, therefore, be able to use that feature if they update their NAICS.

In response to CWS comment, OSHA notes that establishments creating new accounts in the ITA choose their NAICS from a pull-down menu of NAICS codes; with an update optional but not required, the only difference under this final rule will be that the pull-down menu will be loaded with 2022 NAICS codes instead of 2012 NAICS codes. (No accounts in the ITA use the 2017 codes, as the Coalition mistakenly stated in its comment). Establishments that already have accounts in the ITA will not have to do anything with respect to their NAICS codes. It is not clear to OSHA why this would cause confusion for employers, require employers to keep multiple sets of records, or result in over- or under-reporting. And, even if it did, an employer could simply choose to update their NAICS code in the ITA.

f. Tools To Make the Collected Data From Forms 300 and 301 More Useful

In the preamble to the proposed rule, OSHA also asked for comment about tools that would make the published data more available and useful to interested parties (including employers, employees, job-seekers, customers, researchers, workplace safety consultants, and the general public) (87 FR 18543). Several commenters provided suggestions for ways to make published data more useful to interested parties. NIOSH's primary concern was that “some data users might draw unwarranted conclusions about the overall safety record of establishments or employers when the numbers of employees and injuries are low.” To prevent misinterpretation, NIOSH suggested that “OSHA could publish statistical estimates of the extent to which an observed injury rate for an individual industry or establishment is predictive of future injury rates, or the extent to which any such injury rate reflects the underlying risk of injury.” NIOSH also commented that to address potential inaccuracies in OIICS codes and “increase data users' understanding of the degree of reliability of the coding, OSHA may consider posting or making available the probabilities of code accuracy that are generated by the autocoding system, both on the individual injury case level and the aggregate level” (Docket ID 0035).

Additionally, Unidos U.S., Farmworker Justice, and Texas RioGrande Legal Aid suggested that OSHA “publish the data in a way that is accessible, searchable, and sortable using a greater level of detail than is currently available” and make the data “available in a way that allows the public to search for injuries and deaths among workers in specific industries—including by six-digit NAICS codes” and to “refine that data by type of hazard down to the most detailed subcategories of event, exposure, or source, and then to sort by other relevant fields such as location, employer, race, and ethnicity” (Docket ID 0078). Additionally, the commenters suggested that OSHA make the data available in multiple languages, including Spanish, to “ensure that Spanish-speaking Latinos themselves have access to the information” (Docket ID 0078).

The International Brotherhood of Teamsters suggested that OSHA “develop tools and resources within its website, especially where data is to be downloaded, that would allow better user interface and help users understand what they are looking at and what conclusions to draw,” such as providing more information on Total Case Rate (TCR), and Days Away Restricted or Transferred (DART) rates (Docket ID 0083).

OSHA will take these comments into consideration when designing tools and applications to make the published data more available and useful to interested parties. As discussed above, there are considerable potential benefits to occupational safety and health resulting from publishing the collected data, and the easier it is for all interested parties to access and use the published data, the more these benefits will be realized.

C. Section 1904.41(b)(1)

Section 1904.41(b)(1) of the final rule includes clarifying information on the injury and illness record submission requirements for establishments of various sizes that are contained in final § 1904.41(a)(1) and (2). The information, like many of the provisions in part 1904, is conveyed in question-and-answer format. The final provision addresses the question of whether every employer has to routinely make an annual electronic submission of information from part 1904 injury and illness recordkeeping forms to OSHA. The answer clarifies that not every employer has to routinely submit this data, and that, in fact, only three categories of employers must routinely submit information from these forms. The answer then describes the three categories of employers and the information they must submit. The first category is establishments that had 20–249 employees at any time during the previous calendar year, and are classified in an industry listed in appendix A. Establishments in this category must submit the required information from Form 300A to OSHA once a year. The second category is establishments that had 250 or more employees at any time during the previous calendar year, and are required by part 1904 to keep records. Establishments in this second category must also submit the required information from Form 300A to OSHA once a year. The third category is establishments that had 100 or more employees at any time during the previous calendar year, and are classified in an industry listed in appendix B. Establishments in this category must submit the required information from Forms 300 and 301 to OSHA once a year, in addition to the required information from Form 300A.

The answer in § 1904.41(b)(1) also specifies that employers in these three categories have to submit the required information by the date listed in § 1904.41(c) of the year after the calendar year covered by the form. Since the date in paragraph (c) is March 2, that means that, for example, employers must submit the required information covering calendar year 2023 by March 2, 2024. Finally, the answer clarifies that establishments that are not in any of the three categories must submit information to OSHA only if OSHA notifies that establishment that it must do so for an individual data collection.

Proposed § 1904.41(b)(1) would have provided employers with further clarity on which employers and establishments needed to submit data under proposed § 1904.41(a)(1) and (2) and how the requirements of those provisions interacted with each other. These proposed provisions, like the final provision, were written in question-and-answer format to help employers easily identify the information they seek.

Proposed § 1904.41(b)(1)(i) reiterated the question posed in the previous version of § 1904.41(b), which asked whether every employer has to routinely make an annual electronic submission of information from part 1904 injury and illness recordkeeping forms to OSHA. The proposed answer was updated to be consistent with the requirements in proposed § 1904.41(a)(1) and (2). Proposed § 1904.41(b)(1)(ii) would have clarified that an establishment that has 100 or more employees, and is in an industry included in both appendix A and appendix B, need only make one submission of the OSHA Form 300A in order to fulfill the requirements of both proposed § 1904.41(a)(1) and (2).

OSHA welcomed public comment on proposed § 1904.41(b)(1)(i) and (ii), including on whether the proposed provisions appropriately clarified the proposed requirements for employers. OSHA did not receive any comments specifically related to the text of proposed § 1904.41(b)(1), and the agency has addressed comments related to the substantive submission requirements in § 1904.41(a)(1) and (2), above. Therefore, OSHA has decided to finalize § 1904.41(b)(1) with changes from the proposal to reflect the revised structure of final § 1904.41(a)(1) and (2). Final § 1904.41(b)(1) therefore describes three categories of establishments that are required to submit information under the final rule, as opposed to the two categories described in proposed § 1904.41(b)(1)(i). The three categories are: (1) establishments with 20–249 employees in industries on appendix A that are required to submit information from their Form 300A under final § 1904.41(a)(1)(i); (2) establishments with 250 or more employees that are required to keep records under part 1904 and are required to submit information from their Form 300A under final § 1904.41(a)(1)(ii); and (3) establishments with 100 or more employees in industries on appendix B that are required to submit information from their OSHA Forms 300 and 301.

Similar to the proposal, the remainder of final § 1904.41(b)(1) notes that employers with establishments falling into any of these three categories must submit the required information by the date listed in paragraph (c) of this section of the year after the calendar year covered by the form. The example given in the final regulatory text—which specifies that submission for 2023 forms must occur in 2024—has been updated to reflect the first year OSHA anticipates employers having to submit information under this final rule. Finally, the provision specifies that if an establishment is not in any of the three specified categories, the employer must submit information to OSHA only if OSHA notifies the employer to do so for an individual data collection. OSHA anticipates that final § 1904.41(b)(1), along with the additional compliance information the agency intends to issue, will assist employers in determining their compliance responsibilities under the final rule.

Proposed § 1904.41(b)(1)(ii) has not been included in the final rule; it is no longer necessary due to the restructuring of the final regulation. As discussed above, final § 1904.41(a)(1) relates only to the OSHA Form 300A, and final § 1904.41(a)(2) relates only to the OSHA Forms 300 and 301. This restructuring is expected to eliminate any confusion regarding whether an establishment might be required to submit information from its Form 300A twice. Therefore, there is only one question under final § 1904.41(b)(1), as opposed to the two that were proposed.

One commenter requested additional guidance related to how the submission requirements will work. S.W. Anderson Company asked for clearer guidance for companies in designated industries that have 100 employees across multiple sites. The company stated that “we have just reached the 100-employee threshold. We have previously only submitted electronically the OSHA 300A for our company headquarters since we have more than 20 employees. Our other locations all have less than 20 employees” (Docket ID 0008).

In response, OSHA clarifies that this final rule does not affect how employees are counted for recordkeeping or information submission purposes under part 1904. As OSHA states in reporting requirement FAQs on the agency's Injury Tracking Application website ( https://www.osha.gov/​injuryreporting), OSHA's electronic reporting requirements are based on the size of the establishment, not the firm. An establishment is a single physical location where business is conducted or where services or industrial operations are performed (see 29 CFR 1904.46). Therefore, under the facts described by this commenter, if the firm has only one establishment (the company's headquarters) with more than 20 employees, that is the only establishment for which the commenter might need to submit injury and illness information. That single establishment would have to submit the required information from its Form 300A under final § 1904.41(a)(1)(i) if the establishment falls under a NAICS code listed in appendix A. The company would not, however, have to submit information from its Form 300 or 301 for that establishment, regardless of NAICS, because the establishment does not have at least 100 employees. More generally, OSHA plans to revise and expand the FAQs on its recordkeeping website as part of its compliance efforts related to this final rule.

D. Section 1904.41(b)(9)

Section 1904.41(b)(9) of the final rule specifies which information employers must submit from the OSHA Forms 300 and 301. Final § 1904.41(b)(9) asks and answers the following question: If I have to submit information under paragraph (a)(2) of this section, do I have to submit all of the information from the recordkeeping forms? Paragraph (a)(2) contains the submission requirements for information from the OSHA Forms 300 and 301.

The answer in the final rule is no, employers who have to submit information under paragraph (a)(2) of this section must submit all the information from the OSHA Forms 300 and 301 except for the following case-specific information:

• Employee name (column B), from the Log of Work-Related Injuries and Illnesses (OSHA Form 300).
• Employee name (field 1), employee address (field 2), name of physician or other health care professional (field 6), and facility name and address if treatment was given away from the worksite (field 7) from the Injury and Illness Incident Report (OSHA Form 301).

Proposed § 1904.41(b)(9) was the same as final § 1904.41(b)(9). In the preamble to the proposed rule, OSHA explained that collecting data from these fields would not add to OSHA's ability to identify establishments with specific hazards or elevated injury and illness rates. Therefore, OSHA proposed excluding these fields from the submittal requirements to minimize any potential release or unauthorized access to any PII contained in those fields. Because the data collection would not include the information from these fields, there would be no risk of public disclosure of the information from these fields through the data collection. OSHA requested comment on all aspects of proposed § 1904.41(b)(9), including whether the proposed specified fields should be excluded from data that would be collected, and whether other data should be similarly excluded to protect employee privacy or for other reasons. OSHA also asked more specific questions, as addressed below.

1. Collecting Employee Names

In the preamble to the proposed rule, OSHA specifically asked the following question about collecting employee names, in the context of data-sharing between OSHA and BLS: “OSHA is proposing not to collect employee names under proposed § 1904.41(a)(2) and (b)(9), consistent with worker privacy concerns expressed in public comments during previous rulemakings. However, BLS uses the “employee name” field on the Form 300 and Form 301 in their data collection for the SOII. Beginning in 2021, a data-sharing feature has allowed some establishments that are required to submit Form 300A information to both OSHA and BLS, under the current regulation, to use their data submission to the OSHA ITA in their submission to the BLS SOII. BLS anticipates an inability to use this data-sharing feature for establishments required to submit under proposed § 1904.41(a)(2), unless OSHA requires these establishments to submit the “employee name” field on the Form 300 and 301. Without the data-sharing feature, establishments that submit data to OSHA under proposed § 1904.41(a)(2), and that also submit data to the BLS SOII, would not be able to use their OSHA data submission of case-specific data to prefill their BLS SOII submission. What would be the advantages and disadvantages, in terms of employer burden and worker privacy concerns or otherwise, of requiring all establishments subject to proposed § 1904.41(a)(2) to submit employee names, to support this data-sharing feature for Form 300 and 301 submissions? (Please note that OSHA would not intend to publish employee names.)” (87 FR 18547).

In response, OSHA received multiple comments about the desirability of data-sharing between BLS and OSHA, but there were no comments supporting the collection of employee names. In fact, as discussed in more detail above in this preamble, numerous commenters expressed concerns about worker privacy and advocated that employee names be excluded from the data submission.

The Coalition for Workplace Safety commented in support of data-sharing, “Employers who submit data to OSHA should not be required to separately submit the same data to BLS. These duplicative reporting requirements are unacceptable, and OSHA's current proposal only serves to exacerbate this existing problem” (Docket ID 0058). Similarly, the National Association of Manufacturers commented that it would be in the best interest of OSHA and manufacturers for OSHA to gather detailed information about workplace injuries and illnesses “in conjunction with the BLS SOII survey rather than in a separate data collection process” (Docket ID 0068). However, the Coalition for Workplace Safety and the National Association of Manufacturers also expressed great concern in their comments that collection of case-specific information from the Form 300 and Form 301 would risk employee privacy.

Other commenters also expressed support for data-sharing without expressing support for collection of employee names. For example, the American College of Occupational and Environmental Medicine commented in support of avoiding duplicate reporting and encouraged streamlining and simplifying the importation of data from OSHA to SOII (Docket ID 0037). Similarly, the National Safety Council commented, “OSHA and BLS should continue their collaboration to enable more businesses to benefit from single reporting and make reporting easier” (Docket ID 0041).

Having reviewed the comments on this issue as well as the comments on employee privacy described in more detail elsewhere in this preamble, OSHA has decided not to collect employee names under final § 1904.41(a)(2) and (b)(9). This decision is consistent with worker privacy concerns expressed in a number of public comments during this rulemaking and discussed elsewhere in this preamble. Not collecting employee names is, of course, the best way to ensure that this information does not get released online. The agency also, however, recognizes the value in providing ways to reduce the time and burden for employers that are required to submit data to both OSHA and BLS. As such, the agency will continue to work with BLS to identify and implement data-sharing methods that do not require submission of employee names to OSHA in order to reduce the burden for the subset of establishments that are required to submit their Form 300 and 301 data to OSHA and also to submit data to the BLS SOII.

2. Excluding Other Specified Fields

In addition, in the preamble to the proposed rule, OSHA welcomed more general public comment on proposed § 1904.41(b)(9), including whether the proposed specified fields should be excluded from data that would be collected, and whether other data should be similarly excluded to protect employee privacy or for other reasons (87 FR 18546). OSHA asked that any comments suggesting exclusion of other fields or data from the proposed submission requirements also address whether the exclusion of that particular field or data from collection would hinder OSHA's ability to use the collection to protect employee safety and health. Exclusion of employee names is discussed above. Similar to employee names, there were no comments arguing that OSHA should collect the fields listed in proposed § 1904.41(b)(9) ( i.e., from Form 301 employee address (field 2), name of physician or other health care professional (field 6), facility name and address if treatment was given away from the worksite (field 7)).

However, there were some commenters that wanted additional fields to be excluded. For example, the Plastics Industry Association commented that OSHA should not collect job title, department, gender, birth date, date of hire, and date of death to avoid identifying individual employees, and urged excluding job titles in particular because there may only be a small number of employees, or a single employee, with a job title in a facility (Docket ID 0086). Other comments discussed elsewhere in the preamble also expressed concern that employees may be identified by the data fields OSHA intends to make public, (see, e.g., Docket IDs 0062, 0094). The Plastics Industry Association also commented on the possibility that these data fields could be cross-referenced with other data available publicly online, such as social network accounts like LinkedIn, to identify employees (Ex. 86). Similarly, R. Savage commented that “job title, date of hire, date of injury, and social media” could be used to identify the injured employee (Ex. 18). However, other commenters countered that the detailed data can be used to improve workplace safety and health, (see, e.g., Docket IDs 0030, 0079, 0090). The Plastics Industry Association's comments did not address whether the exclusion of these fields from the collection would hinder OSHA's ability to use the collection to protect employee safety and health.

In response to these concerns and, as discussed elsewhere in this preamble, OSHA has determined that the benefits of collecting the data for improving safety and health outweigh potential privacy concerns. Each of these data variables included in the data collection gives OSHA the ability to identify unique hazards. The age of workers is relevant to indicating increased hazards for certain age groups. The date of hire demonstrates when injuries disparately impact new employees versus more experienced employees. An injury that occurs mostly in recent hires may indicate a greater need for training and monitoring new employees, while other illnesses or injuries can occur predominantly in longer term employees. Gender is similarly helpful to indicate workers at higher risk. For example, women are at a higher risk for workplace violence. Job titles aid OSHA in indicating specific jobs with higher rates of illnesses and injuries. The date of injury and date of death are also useful to OSHA for identifying hazards. For example, certain illnesses may have a lag time between the date of injury and the date of death. Other injuries and illnesses may have a seasonal component, such as heat illnesses in the summer.

Further, as part of OSHA's determination that the benefits of collecting and publishing the data outweigh potential privacy concerns, the agency emphasizes that it will be able to adequately protect workers' information that could reasonably be expected to identify individuals directly. OSHA notes that employee birth dates will not be made available to OSHA for outreach, enforcement, or research/analytical purposes.^[17] Instead, establishments will enter the birth date, the system will convert the information to age, and OSHA will retain the age. The data from the fields for age (calculated from date of birth in field 3), date hired (field 4), gender (field 5), whether the employee was treated in an emergency room (field 8), and whether the employee was hospitalized overnight (field 9) will be collected, but these fields will not be published. OSHA also notes regarding the date of death field that deceased individuals do not have a right to privacy; further, since January 1, 2015, § 1904.39(a)(1) has required employers to report the death or hospitalization or amputation or lose of an eye of any employee as a result of a work-related incident within eight hours of the death, and OSHA publishes the reports at https://www.osha.gov/​severeinjury, including narrative information. In addition, as discussed elsewhere, HIPAA does not apply.

After consideration of these comments, OSHA has decided to exclude the following fields from the data collection, as proposed:

• Log of Work-Related Injuries and Illnesses (OSHA Form 300): Employee name (column B).
• Injury and Illness Incident Report (OSHA Form 301): Employee name (field 1), employee address (field 2), name of physician or other health care professional (field 6), facility name and address if treatment was given away from the worksite (field 7).

E. Section 1904.41(b)(10)

Section 1904.41(b)(10) of the final rule addresses how establishments identify themselves in their electronic recordkeeping submissions. As noted above, OSHA's recordkeeping regulation requires employers to maintain and report their injury and illness data at the establishment level. An establishment is defined as a single physical location where business is conducted or where services or industrial operations are performed (see 29 CFR 1904.46). Part 1904 injury and illness records must be specific for each individual establishment. The text of final § 1904.41(b)(10) is in question-and-answer format and responds to the question of whether a company may use numbers or codes as its establishment name when submitting data to OSHA. The answer to the question is yes, a company may use numbers or codes as its establishment name. However, the submission must also include a legal company name, either as part of the establishment name or separately as the company name.

Final § 1904.41(b)(10) is identical to the proposed provision except for changing “company name” to “legal company name.” The final version of § 1904.41(b)(10) is intended to address a problem OSHA identified with the previous rule, which was that the company name was not required. Specifically, as OSHA explained in the preamble of the proposed rule, the ITA (the data submission portal) includes two text fields which OSHA uses to identify each establishment: Company Name and Establishment Name. The Establishment Name field is a mandatory field, and users must provide a unique Establishment Name for each establishment associated with their user account. In contrast, the Company Name field is an optional field. OSHA's review of five years of data electronically submitted under § 1904.41 showed that some firms submitted data with codes in the required Establishment Name field and nothing in the optional Company Name field. For example, in the 2020 submissions of 2019 Form 300A data, users submitted data for more than 18,000 establishments with a code in the Establishment Name field and no information in the Company Name field. The data are considerably less useful and more difficult for both OSHA and other interested parties to work with when establishments have a code in the Establishment Name field and no information in the Company Name field. For example, it is not possible for a data user to search for data by company for companies that use codes without including a company name. In addition, without the legal company name, OSHA is unable to determine whether a particular establishment in that company met the reporting requirements.

To address this problem of missing data under the previous rule, OSHA proposed a provision to require employers who use codes for the Establishment Name to include a legal company name. The proposed provision, § 1904.41(b)(10), provided: “My company uses numbers or codes to identify our establishments. May I use numbers or codes as the establishment name in my submission? Yes, you may use numbers or codes as the establishment name. However, the submission must include the company name, either as part of the establishment name or separately as the company name.”

The final provision, § 1904.41(b)(10), states: “My company uses numbers or codes to identify our establishments. May I use numbers or codes as the establishment name in my submission? Yes, you may use numbers or codes as the establishment name. However, the submission must include the legal company name, either as part of the establishment name or separately as the company name.”

OSHA changed “company name” to “legal company name” in the final regulatory text to clarify that the legal company name should be entered as opposed to a more generic company name. For example, “Company X, LLC” would be entered if that is the legal company name for the establishment, not “Company X.” This clarification is consistent with the Summary and Explanation for proposed § 1904.41(b)(10), which stated “[t]he submission must include the legal company name, either as part of the establishment name or separately as the company name” (87 FR 18523, 18546 (March 30, 2022)). All companies must enter a legal company name, either as part of the establishment name field or the company name field. Users will be reminded during data submission that the information about the establishment must include the company's legal name, either in the establishment field or in the company name field.

OSHA welcomed public comment on the proposed requirement to submit the company name, including any comments on the utility of such a requirement and how the company name should be included in an establishment's submission (87 FR 18456). The agency received a number of comments in response to the comment solicitation on this topic. For example, Worksafe supported the proposed requirement to submit both establishment name and company name (Docket ID 0063). Similarly, Cal/OSHA commented, “The proposed inclusion of employers' entity names, which we support, makes detailed information usable even when employers use numbers or codes to identify their facilities” (Docket ID 0084). In their comment, Seventeen AGs also supported the requirement, which they described as “critical[ ]” (Docket ID 0045). The comment further described the proposal as an improvement to existing reporting requirements, noting that the requirement to disclose a legal name will aid job-seekers in making informed decisions about the injury and illness data for a specific employer (Docket ID 0045).

In contrast, several organizations argued against requiring a company name. For example, the National Propane Gas Association argued that “any research to evaluate the general performance or safety of a particular industry can be investigated on the basis of industry NAICS code; not company name” (Docket ID 0050). OSHA recognizes the value of data that is industry-wide for industry-based research, but there is additional value obtained through collecting and publishing company names. OSHA intends to use the data to engage in company-specific activities to effectively address occupational health and safety issues, and such activities require the company name.

The Phylmar Regulatory Roundtable (PRR) also opposed OSHA's proposed requirement to include the legal company name. It explained that it is concerned “about OSHA's, and particularly the public's, ability to remain objective. To alleviate this concern, PRR recommends OSHA does not publish this information publicly, does not collect the company name, and uses this data for statistical purposes only” (Docket ID 0094). In addition, the Association of the Wall and Ceiling Industry also expressed strong opposition to including the company's name, noting its concern “about provisions in the proposed rule that would unintentionally and unnecessarily harm construction businesses,” such as “any requirement that would result in public access to any affected company's name and address, and/or signatory executive's name and telephone number” (Docket ID 0043). The National Propane Gas Association similarly argued that OSHA's assessment of the utility of the collected information did “not include the regulated companies because there is no evaluation of the potential damage by misunderstanding or misconstruing the information that is proposed for the public website” (Docket ID 0050). It further stated that “[t]he injury and illness reports do not include explanations of employees' conduct, variations from company policies, common practices, or comparisons to indicate positive safety practices, days without injuries or illnesses, or other safeguards companies implement” (Docket ID 0050).

OSHA understands these commenters' concerns. However, as discussed elsewhere, OSHA notes that it has published injury and illness data by company name since 2009, and most establishments were already submitting company name under the previous requirements. Despite this history, opposing commenters did not provide any examples of burden or damage resulting from the publication of company names, nor is OSHA aware of any. Moreover, as discussed in more detail in Section III.G of this Summary and Explanation, OSHA's existing Note to § 1904.0 makes clear that “[r]ecording or reporting a work-related injury, illness, or fatality does not mean that the employer or employee was at fault, that an OSHA rule has been violated, or that the employee is eligible for workers' compensation or other benefits.” Further, OSHA notes that the signatory executive's name and telephone number will not be collected or published under the final rule, nor were they under the previous rule. Consequently, OSHA does not find these comments persuasive.

OSHA agrees with comments that inclusion of the legal company name will improve workplace safety and health. The primary purpose of collecting the company name is to make the data more useful for OSHA for activities at the company level, such as inspection targeting, compliance outreach, research, and assessment of company-wide compliance with the submission requirement. With the company name included, OSHA will, for example, be able to identify company-wide trends of occupational illnesses or injuries. Additionally, interested parties may also use company name data to improve workplace health and safety or to inform themselves about the injury and illness records of specific employers.

One commenter offered an example of how it used company-specific information to improve workplace safety. The Strategic Organizing Center explained in its comment how it used the release of the 2020 and 2021 Injury Tracking Application data to publish reports on the rate of serious injuries at a particular company, which was much higher than the rate at other similar businesses. After the reports were published, the company responded by announcing that safety improvements were underway. OSHA agrees with this commenter that “the availability of more detailed information, including names and locations of employers, allows employers and others to make more meaningful comparisons”—and, as a result, can lead to improvements in worker safety and health (Docket ID 0079).

After consideration of these comments, OSHA has decided to require establishments to submit company name, as proposed, in order to aid both OSHA and other interested parties in using the data more effectively. Users will be reminded during data submission that the information about the establishment must include the company's legal name, either in the establishment field or in the company name field.

F. Section 1904.41(c)

Section 1904.41(c) of the final rule requires employers to electronically submit the required information to OSHA by March 2 of each year. The final provision simplifies the regulatory language in § 1904.41(c)(1)–(2) of the previous rule concerning the dates by which establishments must make their annual submissions. Previously, § 1904.41(c)(1) included information for establishments on what to submit to OSHA during the phase-in period of the 2016 final rule and the deadlines for submission during that phase-in period. That information is no longer relevant and, thus, OSHA removed it to streamline the section. The substantive information already contained in the previous § 1904.41(c)(1) was consolidated into § 1904.41(c) of the final rule. Like previous § 1904.41(c)(2), § 1904.41(c) of the final rule requires all covered establishments to make their electronic submissions by March 2 of the year after the calendar year covered by the form(s). Also, § 1904.41(c) of the final rule provides an updated example of that requirement, explaining that the forms covering calendar year 2023 would be due by March 2, 2024. As the example indicates, because this final rule becomes effective on January 1, 2024, OSHA intends for March 2, 2024 to be the first submission deadline for the new information required to be submitted under this rule.

The Coalition for Workplace Safety commented, “Employers must have notice of the exact requirements of any final rule at the beginning of the year for which collected data will be submitted.” Otherwise, they argued, employers will not have sufficient notice and time to adjust their information collection and review processes (Docket ID 0058). The Flexible Packaging Association made a similar comment (Docket ID 0091). On the other hand, the AFL–CIO expressed frustration that the date of the proposed rule “already delayed the ability of OSHA to institute final reporting requirements . . . until at least 2024” (Docket ID 0061).

OSHA does not agree that employers must have notice of the requirements of any final rule at the beginning of the calendar year for which the data will be submitted. The commenters who made this assertion cite no official rule or other legal authority to support it, and OSHA is not aware of any such rule regarding calendar years and reporting requirements. It is OSHA's position that it was not necessary for the final rule to be published before the end of 2022 in order for OSHA to begin collecting 2023 data in 2024. OSHA anticipates that employers will have sufficient time between publication of the final rule in 2023 and the first submission deadline in 2024 to make any changes to their submission systems that they determine should be made. Indeed, the final rule does not make any changes to the recordkeeping requirements for 2023; employers will continue to record the same information as they were required to record before this final rule was issued.

Both the Flexible Packaging Association and the Coalition for Workplace Safety commented that the changes in the final rule will require technological changes within and outside of OSHA that will require testing for accuracy and effectiveness, and that OSHA must account for the time it will take to make such adjustments (Docket IDs 0058, 0091). To the extent that these commenters are concerned about changes they plan to make to their own recordkeeping or data submission systems, OSHA notes that these types of changes are not a requirement of the final rule. The final rule simply requires submission of the data. OSHA will continue to provide three options for employers to submit the data (manual entry via web form, batch upload via csv file, and API), and it will continue to be up to the individual employer to decide which option to use. To the extent that these comments focus on changes OSHA must make to the ITA to accept the new submissions, OSHA has considered this issue and anticipates being prepared to accept these submissions beginning in early 2024.

Some commenters also argued for an annual submission date later than March 2 to allow employers more time to collect and submit the data from the previous year. For example, the Coalition for Workplace Safety commented that “OSHA should push future deadlines to allow companies to submit past March 2; this date is too early in the year and does not provide enough time for companies to collect and submit this data” (Docket ID 0058; see also Docket ID 0091). The Employers E-Recordkeeping Coalition similarly commented: “For example, one national employer with approximately 700 establishments that would be covered by the new requirement to submit 300 and 301 level data currently takes approximately 3 months to audit and submit its injury and illness records to ensure that its 300A data submissions are accurate. Manually keying in every line of hundreds of 300 log data, or if that is not necessary, at least keying in thousands of 301 Reports would be exponentially more burdensome—likely infeasible given the annual March 2nd submission deadline.” (Docket ID 0087).

In response, OSHA is not persuaded that the March 2 date is too early in the year to submit data for the previous year. OSHA notes that § 1904.32 already requires employers to review the Form 300 Log entries and complete, certify, and post the Form 300A annual summary no later than February 1 of the year following the year covered by the records. Therefore, employers must already have collected and reviewed all of their establishments' 300 Log information for the previous year by February 1 of each year. Having completed this review, they will then have an additional month to submit the data. The scenario posed by the Employers E-Recordkeeping Coalition regarding manually typing in hundreds or thousands of lines of data would only arise if a company with many establishments chose to enter all the data via webform. There are three data submission methods available, as discussed further elsewhere in this preamble, and entering data via webform would be the least efficient method for a company with many establishments.

After consideration of these comments, OSHA has decided to retain the proposed data submission deadline in the final rule and require submission of the previous calendar year's data by March 2 of each year.

G. Additional Comments Which Concern More Than One Section of the Proposal

1. General Comments

There were several comments asking OSHA to add data submission requirements for other types of establishments. For example, Worksafe recommended adding a requirement for companies with five or more establishments to collect and submit part 1904 occupational injury and illness data for those work locations and establishments (Docket ID 0063). Similarly, the National Nurses Union recommended adding a submission requirement for companies with 500 or more employees across multiple establishments (Docket ID 0064). Neither of these recommendations is being incorporated into the final rule. Data submission requirements for multi-establishment companies, regardless of the number of establishments or size of the employer, were not included in any proposed regulatory provision or alternative in the NPRM; nor was the topic otherwise addressed by OSHA as part of the proposed rule. As such, OSHA does not believe that a requirement for multi-establishment employers to submit data to OSHA would be a logical outgrowth of the proposal. (Although OSHA believes that these recommendations are out of the scope of the proposal, the agency notes that it proposed similar ideas as Alternative I in the 2016 rulemaking and rejected that Alternative, in part, due to practicality concerns. OSHA does not believe that those concerns have been obviated in the years since the issuance of the 2016 final rule.)

Similarly, there was a comment expressing concern that the rule will not capture data for workers classified as independent contractors, and “encourag[ing] OSHA to study the benefits of data collection for all workers, regardless of classification, including those who may be improperly designated as independent contractors” (Docket ID 0045). As interested parties are generally aware, the Occupational Safety and Health (OSH) Act of 1970 only applies to “employment” (see 29 U.S.C. 653(a)). Businesses do not meet the definition of the term “employer” in Section 3(5) of the OSH Act, 29 U.S.C. 652(5), unless they have employees. Similarly, individuals are not considered “employees” under the OSH Act unless they are employed by an employer (29 U.S.C. 652(6)). Thus, independent contractors are not covered under the OSH Act. The agency understands that, at times, employees are misclassified as independent contractors and are consequently not receiving the protections that they should. OSHA has other initiatives to address that important issue. However, the agency finds that it is beyond the scope of this rule, which only covers employees.

There were also comments asking OSHA to expand the data requested on OSHA's recordkeeping forms. For example, the National Safety Council commented that OSHA should collect more demographic data, such as race or ethnic origin, and that OSHA should include a method to identify and collect basic information on musculoskeletal disorders (MSDs) (Docket ID 0041). Similarly, Unidos US, Farmworker Justice, and Texas RioGrande Legal Aid commented that OSHA should require employers to report race and ethnicity data in case-specific reports and publish the data alongside the other case-specific information (Docket ID 0078). ConnectiCOSH proposed a requirement for employers to document when workers have complained about retaliation (Docket ID 0069).

Also related to expanding the data requested on the OSHA recordkeeping forms, the Phylmar Regulatory Roundtable (PRR) commented that instead of requesting information from the Forms 300 and 301, OSHA should revise the Form 300A to include more useful identifiers. For example, including “heat” as a type of illness, and “indoor,” “outdoor,” “office,” “distribution facility,” and “off-site” for a field titled “location” would give OSHA more information without identifying employees (Docket ID 0094). More generally, the Employers E-Recordkeeping Coalition commented that OSHA should create a committee or task an existing committee to explore changes to injury and illness recordkeeping, including to consider adopting ASTM E2920–14 (Standard Guide for Recording Occupational Injuries and Illnesses), an international standard that would allow data comparisons with other countries (Docket ID 0087).

These recommendations to expand or change recordkeeping forms, or to explore broader changes to injury and illness recordkeeping, such as adopting an ASTM standard, were not included in any proposed regulatory provision or alternative in the NPRM, nor were these topics otherwise addressed by OSHA as part of the proposed rule. As such, these topics are not within the scope of this rulemaking. Similarly, comments raising issues with OSHA's recording criteria or other parts of part 1904 that are not at issue in this rulemaking ( e.g., Docket ID 0017 (related to the recordability of COVID–19 cases)) are out of scope of this rulemaking.

The National Safety Council (NSC) provided a comment about OSHA enforcement of the reporting requirements: “First, OSHA must take steps to improve reporting compliance. The Department of Labor Office of Inspector General report provides some key recommendations for OSHA to improve reporting: 1. Develop guidance and train staff on identifying underreporting, 2. Issue citations for all late reporters, 3. Clarify guidance on documenting essential decisions, collecting evidence to demonstrate employers corrected all identified hazards, and monitoring employer conducted investigations, and 4. Conduct inspections on all Category 1 incidents. These are key recommendations to improve the original data. Additionally, the National Academy of Sciences (NAS) produced a 2018 study on OSHA data collections acknowledging the limitations of the current data system(s) and made several recommendations for improving and supplementing the OSHA data that should also guide OSHA actions.” (Docket ID 0041; see also Docket ID 0080 (recommending OSHA evaluate procedures for compliance and enforcement)).

With respect to the Office of the Inspector General's 2018 Report, OSHA Needs to Improve the Guidance for its Fatality and Severe Injury Reporting Program to Better Protect Workers, OSHA agreed that better case documentation can help promote consistency in the issuance of citations, as well as the determination of whether to conduct an inspection or a rapid response investigation. However, OSHA was concerned that the OIG's report suggested that the burden to ensure reporting falls on the agency when the OSH Act clearly states that it is the employer's responsibility to comply with the standards under Section 5(a)(2). The agency encourages employers to comply with illness and injury reporting requirements through a variety of enforcement, outreach, and compliance assistance tools. OSHA's full response to the OIG's report can be found in Appendix B of that report at https://www.oig.dol.gov/​public/​reports/​oa/​2018/​02-18-203-10-105.pdf.

With respect to the National Academies of Science, Engineering, and Medicine (NAS) report, A Smarter National Surveillance System for Occupational Safety and Health in the 21st Century, OSHA concludes the final rule is responsive to that report (see OSHA–2021–0006–0097). This NAS report was the result of a joint request from NIOSH, BLS, and OSHA to NAS, asking NAS to conduct a study in response to the need for a more coordinated, cost-effective set of approaches for occupational safety and health surveillance in the United States. The NAS report suggested that electronic collection of Form 300 and 301 data would allow OSHA to focus its interventions and prevention efforts on hazardous industries, workplaces, exposures, and high-risk groups. Additionally, the NAS report made recommendations on ways the public data could be utilized by employers, researchers, government agencies, and workers (Docket ID 0061). Further, according to the report, collecting Form 300 and 301 data electronically would also allow for expanding and targeting outreach to employers to improve hazard identification and prevention efforts, and would give OSHA the opportunity to advise employers on how their rates of injury and illness compare with the rest of their industry. OSHA agrees with these assessments regarding the value of electronically collecting Form 300 and 301 data, as reflected by the final rule.

PRR commented, “to ensure the Agency remains fair, balanced, and trusted, any targeting for enforcement that results from submission of Forms 300, 301 and 300A should be based on a systematic approach that is standardized and impacts all industries in [a]ppendix B subpart E, equally” (Docket ID 0094). In response, OSHA agrees that it should take a systematic approach to enforcement targeting based on the data it collects from these recordkeeping forms. As addressed elsewhere in this preamble ( e.g., Section III.B.4 of this Summary and Explanation), OSHA's systematic approach to enforcement in site-specific targeting using data collected from the Form 300A is illustrated by OSHA's directive on Site-Specific Targeting (SST) (CPL 02–01–064, issued on February 7, 2023, https://www.osha.gov/​enforcement/​directives/​cpl-02-01-064). In this directive, OSHA states that it will generate inspection lists of: (1) establishments with elevated Days Away, Restricted, or Transferred (DART) rates for CY 2021; (2) establishments with upward trending rates for the range of CY 2019–2021; (3) establishments that did not provide the required 2021 Form 300A data to OSHA; and (4) establishments with low DART rates in CY 2021 to verify data accuracy and quality control. OSHA's Office of Statistical Analysis provides each Area Office (AO) with access to software and databases that include the establishments on the Inspection List. AOs must generate inspection cycles using the SST software that randomly selects the establishments and shall determine inspection cycle size ( i.e., 5 to 50 establishments) based on available resources and the geographic range of the office. Once initiated, the entire cycle must be completed. Within a cycle, the AO may schedule and inspect the selected establishments in any order that makes efficient use of available resources.

As indicated by the content of the directive, while OSHA does take a systematic approach to enforcement targeting, OSHA does not agree that any targeting for enforcement resulting from submission of the data from Forms 300, 301, and 300A should necessarily impact all industries in appendix B subpart E equally. If reported data were to show a particular industry had a very high rate of occupational illnesses or injuries, enforcement targeting that particular industry would be appropriate. The final rule provides more accurate and detailed information that will be used to protect workplace health and safety.

Reps. Foxx and Keller commented, “DOL further revealed its intention to reward Big Labor in its extension of the proposed rule's comment period, citing a single request from the AFL–CIO, despite the fact that it has routinely denied similar requests from business stakeholders and members of Congress” (Docket ID 0062). In response, OSHA notes that the agency received two requests for extension of the comment period: from the AFL–CIO in a letter dated May 5, 2022 (Docket ID 0027), and from the Employers E-Recordkeeping Coalition in a letter dated May 20, 2022 (Docket ID 0032). OSHA determined that it would be reasonable to extend the comment period and offered the same additional 30 days to everyone (see 87 FR 31793–4 (May 25, 2022)).

2. Misunderstandings About Scope

Some commenters expressed concern that the proposal would expand the number of employers required to submit data. The Chamber of Commerce commented that the lists of designated industries in Appendices A and B “are long and not that limiting,” and the National Propane Gas Association commented, “[a]ccording to the proposed revisions to [a]ppendix A and proposed creation of [a]ppendix B, the NPRM would expand reporting requirements to more establishments within the propane industry” (Docket IDs 0050, 0088). The National Propane Gas Association also expressed disagreement with “the proposed creation of [a]ppendix B to the extent that it includes all the industries already listed in [a]ppendix A” (Docket ID 0050). In response, OSHA notes that appendix B does not include all the industries listed in appendix A; rather, appendix B is a subset of appendix A. Additionally, as explained in the NPRM and elsewhere in this preamble, all of the establishments that will be required to submit information to OSHA under the new requirements in this final rule were already required to submit information to OSHA under the previous requirements, so it is not the case that this rule expands the number of establishments required to report.

The National Propane Gas Association also recommended that “OSHA retain the current scope and applicability of [§ ]1904.41(a)(1) to apply to employers with 250 or more employees within the industries identified in [a]ppendix A,” rather than “expanding” the requirement to “more employers and more establishments” (Docket ID 0050). As explained in the NPRM and the preamble to this final rule, OSHA did not propose to expand the scope of [§ ]1904.41(a)(1). Rather, the agency explicitly stated that the proposal “would not impose any new requirements on establishments to electronically submit information from their Form 300A,” however, “proposed § 1904.41(a) would remove the electronic submission requirement for certain establishments with 250 or more employees.” Accordingly, the commenter's concerns are misplaced.

The National Propane Gas Association also stated that OSHA is proposing to increase “the frequency of submissions” of injury and illness reports (Docket ID 0050). OSHA did not propose to increase the frequency of submissions of injury and illness data; rather, employers required to submit such data will continue to be required to do so once a year, as under the current requirements.

3. Diversion of Resources

In the 2019 final rule, OSHA stated that rescinding the information submission requirements would allow employers to devote more of their resources towards compliance with safety and health standards (84 FR 394). Similarly, several commenters to the current NPRM also asserted that the proposed rule would be counterproductive to the goal of improving safety and health because complying with the rule would divert resources that would otherwise be devoted to other worker safety and health efforts ( e.g., Docket IDs 0060, 0062, 0070, 0088). In most cases these assertions were unsupported ( e.g., Docket ID 0062 (simply asserting that compliance with the rule would divert employer resources from workplace safety and health initiatives without further explaining how it would do so)).

A few commenters, however, did make more concrete statements that might relate to this issue. For example, the Chamber of Commerce, in challenging OSHA's economic analysis, claimed that the proposal would require safety department personnel to spend time on preparation of the data for submission, presumably at the cost of spending time improving safety (Docket ID 0088). But that diversion, if it occurs, would be required by the recordkeeping rule itself, not by the requirement to submit records. Employers have always been required to keep accurate records. To the extent that the argument is that employers will take greater care with records to be submitted to OSHA and eventually published, that is not a result of the rule so much as it is a result of employers not having taken adequate care previously. Similarly, the need to ensure that information that could compromise workers' privacy is not submitted inappropriately (see, e.g., Docket ID 0081) should be obviated by entering the information carefully in the first place (see, e.g., the instructions on Form 301: “Re fields 14 to 17: Please do not include any personally identifiable information (PII) pertaining to worker(s) involved in the incident ( e.g., no names, phone numbers, or Social Security numbers”)).

4. Lagging v. Leading Indicators

OSHA also received several comments which focused on OSHA's recordkeeping system's use of lagging, rather than leading indicators. Broadly speaking, leading indicators are proactive, preventive, and predictive measures that provide information about the effective performance of an employer's safety and health activities. They measure events leading up to injuries, illnesses, and other incidents and reveal potential problems in an employer's safety and health program. In contrast, lagging indicators measure the occurrence and frequency of events that occurred in the past, such as the number or rate of injuries, illnesses, and fatalities (see https://www.osha.gov/​sites/​default/​files/​OSHA_​Leading_​Indicators.pdf).

On the issue of lagging versus leading indicators, the American Society of Safety Professionals (ASSP) commented, “ASSP advocates a comprehensive risk-based approach that measures leading as well as lagging indicators. Leading indicators provide critical information about an organization's true commitment to safety and health, at times acting as a better gauge of a system's vulnerabilities or effectiveness than lagging indicators” (Docket ID 0031; see also Docket IDs 0041, 0053). Similarly, PRR commented, “The safety community has been actively moving away from using case rates as indicators of a safety program's effectiveness and has been experimenting with various leading indicators” (Docket ID 0094). PRR further commented that the use of lagging indicators “leads the general public, which is uninformed, to think that there is direct correlation between injury and illness rates and the effectiveness of an employer's worker safety and health programs and practices” (Docket ID 0094; see also Docket IDs 0043, 0088).

In addition, ASSP “recommends that OSHA develop guidance on leading indicators and overhaul the current recordkeeping system to use both leading and lagging indicators as indicators of the effectiveness of a business' safety and health management system” (Docket ID 0031). In its comment, ASSP referred the ANSI/ASSP Z16.1–2022 standard (“Safety and Health Metrics and Performance Measures”), which contains leading indicators, to OSHA for consideration. (OSHA has placed a copy of ANSI/ASSP Z16.1–2022 standard in the docket as a copyright protected reference (Docket ID 0101).)

In response to ASSP's recommendation that OSHA “overhaul the current recordkeeping system to use both leading and lagging indicators as indicators of the effectiveness of a business' safety and health management system[,]” including through a review of the referenced ANSI/ASSP standard, OSHA notes that such an overhaul is outside of the scope of this rulemaking, which focuses only on the annual electronic submission of data which employers are already required to keep. The agency did not propose changes to the data which should be kept, e.g., whether such data should include leading indicators, and if so, which.

That said, OSHA agrees with ASSP that leading indicators are an important tool to assess the effectiveness of workplace safety and health programs. However, as ASSP acknowledges, leading indicators are not the only such tool. As OSHA has explained many times before (see, e.g., https://www.osha.gov/​safety-management/​program-evaluation), both leading and lagging indicators are valuable performance measures. These two measures work together to provide a comprehensive picture of worker safety and health in an industry or particular workplace. (For more information on the benefits and utility of the lagging indicators that will be collected and published in this rulemaking, see Section III.B.4 of this Summary and Explanation.) This rulemaking and OSHA's recordkeeping system in general focuses on lagging indicators. Other OSHA programs, such as the Voluntary Protection Programs (VPP) which recognizes employers and workers in the private industry and Federal agencies who have implemented effective safety and health management systems and maintain injury and illness rates below national Bureau of Labor Statistics averages for their respective industries, encourage the use of leading indicators. And, as ASSP suggests, OSHA has previously published guidance related to leading indicators (see, e.g., https://www.osha.gov/​sites/​default/​files/​OSHA_​Leading_​Indicators.pdf; https://www.osha.gov/​leading-indicators).

Moreover, OSHA notes that its recordkeeping system is in line with Congress' instructions in the OSH Act (see, e.g., Section 8(c)(2) (“The Secretary . . . shall prescribe regulations requiring employers to maintain accurate records of, and to make periodic reports on, work-related deaths, injuries and illnesses other than minor injuries requiring only first aid treatment and which do not involve medical treatment, loss of consciousness, restriction of work or motion, or transfer to another job[;]”); see also Section 8(g)(1) (“The Secretary and Secretary of Health and Human Services are authorized to compile, analyze, and publish, either in summary or detailed form, all reports or information obtained under this section.”)).

As to the argument that OSHA's planned publication of lagging information will mislead the public, OSHA has previously published data from establishments' CY 2016–2021 300A forms online and has long given out redacted Forms 300 and 301 in response to FOIA requests, and the agency has not received reports of widespread public confusion, nor have interested parties pointed to such reports of confusion in their comments in this rulemaking. Consequently, OSHA is not persuaded that these parties' hypothetical concerns should change the course of this rulemaking. Nevertheless, to help decrease the risk that members of the public might inaccurately assume that an establishment's report of an injury or illness always suggests a deficiency in that establishment's safety and health system, OSHA will continue to include a reference to the Note to 29 CFR 1904.0 in the notes below the links to the website on which it publishes the safety and health data submitted pursuant to this rulemaking (see Note to § 1904.0 (“Recording or reporting a work-related injury, illness, or fatality does not mean that the employer or employee was at fault, that an OSHA rule has been violated, or that the employee is eligible for workers' compensation or other benefits.”)).

OSHA also received comments arguing that requiring the submission of injury and illness data from the recordkeeping forms, and publishing data from the submissions, will divert employer focus from leading indicators. For example, ASSP commented, “OSHA's focus on lagging injury and illness data has at times created a stumbling block to systemic safety program improvements by actively discouraging employers from embracing a holistic risk-based approach” (Docket ID 0031). Similarly, the U.S. Poultry & Egg Association commented, “In this proposal, OSHA is myopically focusing on injuries and injury rates . . . Despite what OSHA may believe, because employers will know that their information will be made available worldwide, they will focus greater attention on these issues at the expense of focusing on leading safety metrics” (Docket ID 0053). The North American Meat Institute made a similar comment (Docket ID 0076).

In response, OSHA notes that, as discussed in Section III.G of this Summary and Explanation, employers are already required to complete these forms, and there is no reason why the new requirement to submit information from these forms would prevent employers from additionally implementing proactive measures as part of a comprehensive safety and health program. The agency is unaware of any resulting increase in inappropriate focus by employers on recordable injuries/illnesses vs. leading indicators, commenters did not provide any examples, and it is not clear why publishing case-specific information from the OSHA Form 300 and 301 would cause employers to focus inappropriately on recordable injuries and illnesses in a way that collecting and publishing establishment-specific information from the OSHA Form 300A Annual Summary did not. Moreover, as discussed in Section III.B.4 of this Summary and Explanation, OSHA's publication of the establishment-specific, case-specific, injury and illness data will benefit employers by giving them access to a larger data set that can be used for benchmarking. This increased access to information will enable employers to proactively improve their workplace safety and health.

5. Employer Shaming

The National Propane Gas Association commented: “It is assumed that the agency's ambition is to embarrass, shame, or otherwise damage the reputation of employers as a means to induce some undefined improvement. Underscoring this ambition is the agency's presumption that employers are not invested in employees' safety; that public scrutiny is the only enticement to improve the workplace rather than an employers' natural concern for employees' safety. We disagree with the agency's lack of faith in employers . . . .” (Docket ID 0050).

In response, this appears to be a misunderstanding. There is no mention in the preamble to the proposed rule of shaming, embarrassing, or damaging the reputation of employers; nor is this the agency's intent. On the contrary, the preamble specifically stated that “publication of establishment-specific, case-specific injury and illness data would benefit the majority of employers who want to prevent injuries and illnesses among their employees, through several mechanisms” (87 FR 18533–4). Those mechanisms include “enable[ing] interested parties to gauge the full range of injury and illness case types at the establishment,” allowing employers to “compare case-specific injury and illness information at their establishments to those at comparable establishments, and set workplace safety/health goals benchmarked to the establishments they consider most comparable,” and “allow[ing] employees to compare their own workplaces to the safest workplaces in their industries” (id.). OSHA further stated that, “if employees were able to preferentially choose employment at the safest workplaces in their industries, then employers might take steps to improve workplace safety and health (preventing injuries and illnesses from occurring) in order to attract and retain employees” (id.). As OSHA has discussed elsewhere in this preamble, the currently available 300A data has already been critical to efforts to improve worker safety and health, and publishing the case-specific data required to be submitted under this rule will further improve workplace safety and health (see, e.g., Section III.B.4 of this Summary and Explanation). The purpose of this rule is to improve workers' well-being not by shaming their employers, but by providing employers and other interested parties with valuable information that can be used to better understand and address occupational safety and health hazards.

6. Impact on Employee Recruiting

The Precision Machined Parts Association commented, “PMPA believes that posting this information on the internet without explanation will not improve workplace safety but will make it tougher for manufacturers to recruit young people and qualified employees into manufacturing careers” (Docket ID 0055).

Similarly, the North American Die Casting Association commented, “This proposed rulemaking will only serve to hurt the image of the industry and discourage individuals from seeking careers in manufacturing. In a recent survey, 96 percent of NADCA members report they have job openings in their facilities, and OSHA's actions in making these reports public will create a false image of the industry as dangerous. . . . At a time when businesses are already struggling to recruit employees and compete globally, OSHA should not continue to erect additional barriers to job growth and drive a wedge between employer and employee.” (Docket ID 0056). The Precision Metalforming Association and National Tooling and Machining Association expressed similar concerns in their joint comment (Docket ID 0057).

In response, OSHA notes that supporting and explanatory information has always been included on its website for ODI as well as ITA data, and the agency plans to continue this practice. For example, the ITA website contains several explanations of the data that address commenters' specific concerns, including a note that “[r]ecording or reporting a work-related injury, illness, or fatality does not mean that the employer or employee was at fault, that an OSHA rule has been violated, or that the employee is eligible for workers' compensation or other benefits” ( https://www.osha.gov/​Establishment-Specific-Injury-and-Illness-Data). The ODI website also includes explanatory notes ( https://www.osha.gov/​ords/​odi/​establishment_​search.html). The agency has published establishment-specific information from the Form 300A summary since 2009 but is unaware of any resulting detrimental effects on the recruitment of young people and qualified employees into manufacturing careers; nor did the commenters provide any examples. On the other hand, OSHA notes that the data could assist with new employee recruitment efforts by providing prospective employees with more information about injuries and illnesses occurring at the establishment. For example, a prospective employee might be concerned by the number of injuries or illnesses listed in the information from an establishment's 300A Summary, but the case-specific forms allow establishments to provide more information regarding the injuries and illnesses summarized in the 300A, allowing prospective employees to make more informed decisions.

7. Legal Disputes

AIHA commented, “Data related to personal injury can be combined with other readily available data from newspapers, community `gossip', etc., and then used to identify the affected individuals. Once identified, the individuals could be harassed or encouraged to file lawsuits or additional claims against employers” (Docket ID 0030). Similarly, the National Propane Gas Association stated that OSHA ignored the “potential for frivolous lawsuits or investigations that could be fueled by the incomplete information that the agency intends to publish” (Docket ID 0050).

The Motor and Equipment Manufacturers Association commented, “Making such data publicly available would allow third parties to use it for reasons wholly unrelated to safety.” This commenter provided the following example: “plaintiffs' attorneys, labor unions, competitors, and special interest groups would be able to use such information—selectively or otherwise—as leverage against companies during legal disputes, union organizing drives, contract negotiations, or as part of an effort to prevent a company from entering a specific market” (Docket ID 0075; see also Docket ID 0088).

The Chamber of Commerce similarly argued that, “[M]aking these data publicly available would very likely lead to less desirable outcomes, such as increased litigation from plaintiffs' attorneys looking to assert that the employer was at fault to overcome workers' compensation no-fault limitations, as well as unions using these data to mischaracterize an employer's safety record during organizing campaigns or contract negotiations.” (Docket ID 0088).

As discussed above, the agency has published establishment-specific information from the Form 300A summary since 2009 but is unaware of any resulting increase in legal disputes or unwarranted reputational damage; nor did the commenters provide any specific examples. As noted above, given that this final rule requires the submission of information that can provide details on, and context for, the information from the Form 300A that is already being made public, the new information may help provide a fuller, more accurate picture of worker safety and health at a given establishment. This additional context and detail could actually help protect businesses against attempts to mischaracterize their safety records, whether in the legal context or otherwise. As discussed above, it is also important to note that employees and their representatives already have the right to request and receive injury and illness records from their employers (see 29 CFR 1904.35). While OSHA recognizes that such access is on a smaller scale, there is already the potential for the data to be used for these purposes, independent of this regulation. Finally, also as discussed above, to the extent that the published data serves to address the problem of information asymmetry in the labor market, OSHA considers that a positive consequence of the final rule.

8. No Fault Recordkeeping

OSHA also received several comments asserting that the proposed rule would be inconsistent with the “no fault” nature of the recordkeeping system, as set forth in the note to 29 CFR 1904.0: “Recording or reporting a work-related injury, illness, or fatality does not mean that the employer or employee was at fault, that an OSHA rule has been violated, or that the employee is eligible for workers' compensation or other benefits” ( e.g., Docket IDs 0053, 0086, 0087, 0090, 0091). OSHA received similar comments on the 2013 NPRM (the rulemaking which culminated in the 2016 final rule) (see 81 FR 29666–67).

These comments misconstrue what OSHA means by no fault reporting. As OSHA has explained previously, it will not use the mere fact that an employer has recorded or reported and injury or illness as evidence that the employer violated the OSH Act or an OSHA standard. But that is not the same as saying that the data recorded and reported have no valid use or effect. OSHA has used employer reports of worker deaths and injuries, as well as press reports and referrals from other agencies, as a basis for investigating conditions at an affected workplace throughout its entire history. For just as long, OSHA's first step in all of its workplace inspections has been an examination of the establishment's injury and illness records. OSHA's very first Compliance Operations Manual, issued in January 1972, states that “During the course of a routine inspection, the CSHO shall inspect those employer records required to be kept by the Act and by [p]art 1904” (Docket ID 0100, p. V–15). And today, the instruction is the same: “At the start of each inspection, the CSHO shall review the employer's injury and illness records (including the employer's OSHA 300 logs, 300A summaries, and 301 incident reports) for three prior calendar years” (see OSHA's Field Operations Manual, CPL 02–00–164, Chapter III, Paragraph VI.A.1 (April 14, 2020) available at https://www.osha.gov/​enforcement/​directives/​cpl-02-00-164).

And OSHA has always used the information in those records to guide the nature of its inspections (see, e.g., McLaughlin v. A.B. Chance Co., 842 F.2d 724 (4th Cir. 1988) (noting that during a complaint inspection about a particular machine, “it would be reasonable for the investigator to determine if there had been injuries from the use of said machine”)). Indeed, for many years, OSHA's inspections plans explicitly conditioned the scope of inspections on the data found in those records ( In re Establishment Inspection of Kohler Co., 935 F.2d 810 (7th Cir. 1991) (“OSHA applied to a federal magistrate for an administrative search warrant that would require Kohler to produce the records and to submit to a comprehensive inspection of its entire facility if those records revealed that Kohler's injury rate exceeded the national average for manufacturing concerns.”)). In the last five years OSHA has used information from establishments' 300A Forms submitted under the 2016 final rule to prioritize which workplaces to inspect through OSHA's Site-Specific Targeting program. It does so by using a neutral administrative scheme to identify hazards that OSHA wants to address through its enforcement resources. However, OSHA will not use the case-specific injury and illness information submitted to simply choose a particular employer to inspect outside of the neutral administrative scheme noted above (see Marshall v. Barlow's Inc., 436 U.S. 307 (1978)). Thus, the assertion by the Employers E-Recordkeeping Coalition, “that the principal reason that the data collected pursuant to this proposed rule is published by OSHA presumes and is based on a premise of employer fault,” is wrong (see Docket ID 0087).

OSHA continues to recognize that the mere fact of any particular injury or illness occurring is not an indication of employer fault. But the reports of those injuries and illnesses can provide important information about hazards that exist at workplaces, whether or not those hazards are addressed by existing OSHA standards. As explained elsewhere, this information can be useful not only to OSHA, but also to researchers, workers, and even other employers with similar facilities (see, e.g., Docket IDs 0030, 0045). For the same reasons, as discussed elsewhere in this preamble, publication of the submitted data is not intended to “shame” employers (see Docket ID 0081); it is merely to allow use of the data in ways that will promote occupational safety and health.

9. Confidentiality of Business Locations

One commenter was concerned about the consequences of disclosing business locations for certain establishments. Specifically, the National Retail Federation commented that some business locations need to remain confidential because “[m]any retailers deal with pharmaceuticals, hazardous materials, or other highly sought after and/or dangerous products,” and “[e]xposing the locations of these operations could leave them vulnerable to bad actors seeking the materials for their own use or sale on the black market” (Docket ID 0090).

In response, OSHA notes that it has long published certain information from employers' Form 300A, including business locations. As explained elsewhere, the agency began publishing information from establishments' electronic submissions of Form 300A annual summary data in 2020; in addition, beginning in 2009, OSHA published information from the establishments' submissions of the Form 300A to the OSHA Data Initiative (ODI), which was replaced by the current data collection. The information published from both data collections included establishments' addresses. Furthermore, OSHA is not aware of any instances of damage from bad actors as a result of data collected through the ITA or the ODI and published since 2009, and commenters did not provide any examples. Nor is OSHA aware of any law that classifies business addresses as confidential business information or personally identifiable information, and commenters have provided none.

Moreover, OSHA notes that the Environmental Protection Agency already publishes information about the location of workplaces with hazardous materials and chemicals. For example, facilities must inform local communities of the presence of hazardous chemicals at specific worksites under the Emergency Planning and Community Right-to-Know Act. Also, EPA maintains hazardous materials information in the Resource Conservation and Recovery Act Information (RCRAInfo), which provides a searchable public website for the identification of facilities that generate, handle, and store hazardous materials (see, e.g., the Toxic Release Inventory: https://www.epa.gov/​enviro/​tri-search and the Emergency Planning and Community Right-to-Know Act (EPCRA) Reporting Requirements: https://www.epa.gov/​epcra/​state-tier-ii-reporting-requirements-and-procedures). Given the availability of such information, OSHA does not expect that the minimal amount of information regarding hazardous materials that it may publish will lead to the problems envisioned by this commenter.

Finally, OSHA believes that the benefits of publishing this information outweigh the purported risks. As discussed in greater detail in Section III.B.4 of this Summary and Explanation, OSHA has identified a number of ways in which employees, researchers, consultants, and the general public may benefit from the publication of data from Forms 300 and 301, and if those groups do not have access to businesses' addresses, many of those benefits will not be realized. For example, injury and illness data may help job seekers make more informed decisions regarding their employment, but only if they can accurately identify their potential employers. Accordingly, OSHA declines to change its longstanding practices regarding publication of business locations.

10. Employer-Vaccine-Mandate-Related Concerns

OSHA also received a comment from an interested party who was concerned that non-OSHA actors will mischaracterize the injury and illness data which OSHA intends to publish on its websites as “vaccine-related,” especially if those injuries and illnesses occur in establishments with known vaccine mandates. Specifically, the National Retail Federation (NRF) commented that “throughout the COVID–19 pandemic and continuing beyond, various groups have targeted employers for implementing vaccine mandates in their workplaces. Such employers could face unwarranted attacks or unfair mischaracterizations of their workplace safety records due to vaccination policies. Sadly, we have already seen anti-vaccine advocates manipulate publicized workplace injuries and unjustly characterize them as vaccine-related. Employers who implemented vaccine mandates consistent with the Administration's wishes, should not be unfairly targeted by those who would eagerly mischaracterize the impact of mandates and policies” (Docket ID 0090).

OSHA understands this commenter's concern. However, OSHA published calendar year 2021 data from OSHA Form 300A on its website in April 2022, September 2022, and January 2023. The information made available in that release (like previous releases of the data from Form 300A) includes, among other things, company names and data regarding total number of deaths; total numbers of cases with days away from work and job transfers or restrictions, total number of other restrictions, and injury and illness types ( e.g., the total number of injuries, skin disorders, respiratory conditions, poisonings, and all other illnesses). If the groups referenced by NRF were going to use OSHA data to target the establishments with vaccine mandates, OSHA believes that they already had the opportunity to do so using the published 300A data. There is no such evidence of OSHA data being used for these kinds of attacks in the record, and NRF did not point to any such evidence. Moreover, the publication of case-specific data will provide more information about the injuries and illnesses occurring at establishments, perhaps making it more obvious that a mischaracterization of an injury or illness as vaccine-related is just that: a mischaracterization.

Finally, if NRF is suggesting that the groups referenced in its comment could somehow determine that a given employer or establishment had a vaccine mandate in place by viewing the Form 300 or 301 data which OSHA plans to make publicly available, OSHA thinks such a thing is unlikely. This final rule does not include a vaccination mandate for employees, nor does it require the collection and publication of information about vaccine mandates at a given establishment. Further, OSHA is currently not enforcing 29 CFR 1904's recording requirements in the case of worker side effects from COVID–19 vaccination. Thus, OSHA does not expect that any information regarding vaccine side effects will appear in establishment's injury and illness data. And NRF has not pointed to any other data or evidence that would be submitted and made public pursuant to this rulemaking that could alert the groups discussed above of an employer or establishment's vaccine mandate. Consequently, for the reasons discussed above, OSHA is not persuaded that the potential harm referenced by NRF is anything other than purely speculative.

11. Constitutional Issues and OSHA's Authority To Publish Information From Forms 300 and 301

a. The First Amendment

OSHA received two comments relating to the First Amendment of the U.S. Constitution. On the one hand, a comment from the U.S. Chamber of Commerce argues that OSHA's proposed rule would violate the First Amendment because it would force employers to submit their confidential and proprietary information for publication on a publicly available government online database (Docket ID 0088, Attachment 2). In its comment, the Chamber noted that the First Amendment protects both the right to speak and the right to refrain from speaking. The Chamber commented: “While OSHA's stated goal of using the information it collects from employers “to improve workplace safety and health,” 78 FR 67254, is unobjectionable, “significant encroachments on First Amendment rights of the sort that compelled disclosure imposes cannot be justified by a mere showing of some legitimate governmental interest.” Buckley v. Valeo, 424 U.S. 1, 64 (1976) (per curiam). Instead, where the government seeks to require companies to engage in the type of speech proposed here, the regulation must meet the higher standard of strict scrutiny: Meaning that it must be narrowly tailored to promote a compelling governmental interest. See United States v. Playboy Entm't Grp., Inc., 529 U.S. 803, 819 (2000). Once subjected to strict scrutiny, the publication provision of this Proposed Rule must fail because it is not narrowly tailored towards accomplishing a compelling government interest. See Playboy, 529 U.S. at 819. Under the narrow tailoring prong of this analysis, the regulation must be necessary towards accomplishing the government's interest. See, e.g., Republican Party of Minn. v. White, 536 U.S. 765, 775 (2002) (“[T]o show that the [requirement] is narrowly tailored, [the government] must demonstrate that it does not `unnecessarily circumscrib[e] protected expression.” ' (fourth alteration in original) (quoting Brown v. Hartlage, 456 U.S. 45, 54 (1982))).” (Docket ID 0088, Attachment 2) (footnote omitted).

In support of these arguments, the Chamber alleged that OSHA's proposal would undermine (not improve) workplace safety and health because it “would substantially deplete OSHA's resources.” In addition, the Chamber asserted that “even if OSHA were able to maintain this database and analyze this information in an effective and timely manner, there is no evidence that publication of this information will have any effect on workplace safety” (Docket ID 0088, Attachment 2).

On the other hand, Worksafe commented that the rule would merely compel employers to submit to OSHA information that they are already required to maintain about workplace incidents (Docket ID 0063). It further explained that this is a form of commercial speech, in which the speaker's constitutional interest in non-disclosure is minimal (Docket ID 0063 (citing Zauderer v. Office of Disciplinary Counsel, 471 U.S. 626, 651 (1985))). Additionally, Worksafe argued that OSHA could address First Amendment concerns by identifying the following in the final rule (1) OSHA's interest in the case-specific reports and publication, (2) how the rule advances that interest, and (3) why the rule is not unduly burdensome (Docket ID 0063).

After considering these comments, OSHA disagrees with the Chamber's assertion that this rulemaking violates the First Amendment. OSHA notes that, contrary to the Chamber's comment, the decision in Buckley v. Valeo only applies to campaign contribution disclosures and does not hold that other types of disclosure rules are subject to the strict scrutiny standard (see 424 U.S. 1, 64 (reasoning that campaign contribution disclosures “can seriously infringe on privacy of association and belief guaranteed by the First Amendment”)). Later cases also clarify that disclosure requirements only trigger strict scrutiny “in the electoral context” (see John Doe No. 1 v. Reed, 561 U.S. 186, 196 (2010)).

Further, OSHA agrees with WorkSafe that Zauderer is applicable to this rulemaking. In Zauderer, the Supreme Court upheld Ohio State rules requiring disclosures in attorney advertising relating to client liability for court costs (471 U.S. at 653). The Court declined to apply the more rigorous strict scrutiny standard, because the government was not attempting to “prescribe what shall be orthodox in politics, nationalism, religion, or other matters of opinion or force citizens to confess by word or act their faith therein” (471 U.S. at 651). Because it concluded the disclosure at issue would convey “purely factual and uncontroversial information,” the rule only needed to be “reasonably related to the State's interest in preventing deception of consumers” (id.). More recently, in American Meat Institute v. U.S. Dept. of Agriculture, the U.S. Court of Appeals for the D.C. Circuit held that the Zauderer case's “reasonably related” test is not limited to rules aimed at preventing consumer deception, and applies to other disclosure rules dealing with “purely factual and uncontroversial information” (760 F.3d 18, 22 (D.C. Cir. 2014) (en banc) (finding that the speakers' interest in non-disclosure of such information is “minimal”); see also NY State Restaurant Ass'n v. NYC Bd. Of Health, 556 F.3d 114, 133 (2d Cir. 2009) (accord), Pharmaceutical Care Mgmt. Ass'n v. Rowe, 429 F.3d 294, 310 (1st Cir. 2005) (accord), cert denied, 547 U.S. 1179 (2006)).

This rule only requires disclosure of purely factual and uncontroversial workplace injury and illness records that are already kept by employers. The rule does not violate the First Amendment because disclosure of workplace injury and illness records is reasonably related to the government's interest in assuring “so far as possible every working man and woman in the Nation safe and healthful working conditions” (29 U.S.C. 651(b)). Further, as discussed in more detail in Section III.B.4 of this Summary and Explanation, OSHA has determined that the collection and publication of this information will have a positive effect on worker safety and health. In addition, as discussed in Section III.B.14 of this Summary and Explanation, OSHA does not believe that its decision to devote a portion of its resources to collecting the workplace injury and illness data covered by this final rule will negatively impact worker safety and health. On the contrary, OSHA expects that the data submitted in response to the requirements put into place by this final rule will allow OSHA to allocate its resources in a more informed fashion. The remainder of the Chamber's comment addresses the requirement that the government “narrowly tailor” regulations that deal with essential rights, which, as explained above, does not apply to an employer's minimal interest in non-disclosure of purely factual and uncontroversial information.

b. The Fourth Amendment

The Plastics Industry Association (Docket ID 0086), as well as one private citizen commenter (Docket ID 0023), generally assert that the collection and publication of site- and case-specific data would violate employers' Fourth Amendment rights. However, as discussed above in Section II, Legal Authority, the Fourth Amendment protects against government searches and seizures of private property only when a person has a legitimate expectation of privacy related to the thing being searched or seized. There is little or no expectation of privacy for records of occupational injuries and illnesses kept in compliance with OSHA regulations, which employers are legally required to disclose to OSHA and others on request. Moreover, even if there were an expectation of privacy in these records, the Fourth Amendment prohibits only unreasonable incursions by the government. The test for reasonableness requires balancing the need to search against the invasion that the search entails (see Camara v. Mun. Ct. of City & Cnty. of San Francisco, 387 U.S. 523, 536–537 (1967)). The information submission requirement in this final rule is reasonable. As explained in Section II, Legal Authority, the submission requirement serves a substantial government interest in protecting the health and safety of workers, has a strong statutory basis, and uses reasonable, objective criteria for determining which employers must report information to OSHA. In addition, again, as noted above and below, the submission requirement results in little to no invasion of employer or establishment privacy given that employers must already retain these forms and provide them to multiple individuals and entities upon request.

OSHA also received a comment from the U.S. Chamber of Commerce (the Chamber) asserting that OSHA's use of injury and illness data submitted under the proposed rule for enforcement purposes would violate employers' Fourth Amendment rights. The Chamber argued that OSHA's use of the information collected for enforcement purposes will fail to constitute a “neutral administrative scheme” and will thus violate the Supreme Court's holding in Marshall v. Barlow's Inc., 436 U.S. 307 (1978) (Docket ID 0088, Attachment 2). Additionally, the Chamber maintained that the raw data to be collected under the proposed rule would fail to provide any defensible neutral predicate for enforcement decisions: “Under this Proposed Rule, OSHA will be able to target any employer that submits a reportable injury or illness for any reason the agency chooses, or for no reason at all, under this unlimited discretion it has sought to grant itself to “identify workplaces where workers are at great risk.” ” (Docket ID 0088, Attachment 2 (quoting 78 FR 67256)).

In response, OSHA notes that Barlow's concerned the question of whether OSHA must have a warrant to enter and inspect the nonpublic areas of a worksite without the employer's consent. Section 1904.41 of this final rule involves electronic submission of injury and illness recordkeeping data; no entry of premises or compliance officer decision-making is involved. Thus, the Barlow's decision provides very little support for the Chamber's sweeping Fourth Amendment objections (see Donovan v. Lone Steer, Inc., 464 U.S. 408, 414 (1984) (reasonableness of a subpoena is not to be determined on the basis of physical entry law, because subpoena requests for information involve no entry into nonpublic areas)). Moreover, the final rule is limited in scope and leaves OSHA with limited discretion. The recordkeeping information required to be submitted is highly relevant to accomplishing OSHA's statutory mission. The submission of recordkeeping data is accomplished through remote electronic transmittal, without any intrusion of the employer's premises by OSHA, and is not unduly burdensome. Also, as noted above, all of the injury and illness information establishments will be required to submit under this final rule will be taken from records employers are already required to create, maintain, post, and provide to employees, employee representatives, and government officials upon request, which means the employer has a reduced expectation of privacy in the information.

With respect to the issue of enforcement, OSHA disagrees with the Chamber's Fourth Amendment objection that the agency will target employers “for any reason” simply because they submit injury and illness data. Instead, OSHA plans to continue the practice of using a neutral-based scheme for identifying employers and industries for greater enforcement attention. More specifically, the agency will use the data submitted by employers under this final rule in essentially the same manner in which OSHA has used data from the ODI and the current collection of Form 300A data in all of its iterations of the Site-Specific Targeting (SST) program. The SST includes for selection establishments that meet pre-determined injury and illness rate thresholds. All establishments at or above the threshold are eligible for inspection. Establishments in this pool are then randomly selected for inspection. In the future, OSHA plans to analyze the recordkeeping data submitted by employers to identify injury and illness trends, establish neutral criteria to determine which employers may be inspected, and then make appropriate decisions regarding enforcement efforts based on those criteria. OSHA also notes that the agency currently uses establishment-specific fatality, injury, and illness reports submitted by employers under § 1904.39 to target enforcement and compliance assistance resources. As with the SST and National Emphasis programs, a neutral-based scheme is used to identify which establishments are inspected and which fall under a compliance assistance program. Accordingly, OSHA's using injury and illness recordkeeping data to target employers for inspection will not be arbitrary or unconstitutional under the Fourth Amendment.

c. The Fifth Amendment

One commenter raised concerns that the proposed rule would violate the Fifth Amendment's requirement that the Federal Government ensure equal protection. Specifically, Hunter Cisiewski commented that the proposal to remove the requirement from former § 1904.41(a)(1) for certain establishments with 250 or more employees to electronically submit Form 300A data, “would deprive workers in the affected industries of holding their employers accountable to produce workplace related injury data to OSHA while simultaneously providing this protection to workers in similar industries” and “presents no reason for why employees in these affected industries should no longer have the guarantee that their employers will report workplace injury and illness data to the governing agency” (Docket ID 0024).

As explained in Section III.A of this Summary and Explanation, OSHA has decided not to make the proposed change of restricting the universe of large establishments that are required to submit data from Form 300A. Instead, the agency will maintain the requirement for all establishments with 250 or more employees that are covered by part 1904 to submit the information from their OSHA Form 300A to OSHA, or its designee, once a year. Therefore, although OSHA disagrees with this commenter's assertion that the proposal would have violated the Fifth Amendment's guarantee of equal protection had it been finalized, the agency finds that this particular comment is moot.

d. OSHA's Authority To Publish Information Submitted Under This Rule

Several commenters asserted that OSHA lacks the statutory authority under the OSH Act to publish a database that makes submitted injury and illness recordkeeping data available to the general public (Docket IDs 0050, 0059, 0071, 0086, 0088, 0090). These commenters acknowledged that Sections 8 and 24 of the OSH Act provide the Secretary of Labor with authority to issue regulations requiring employers to maintain accurate records of work-related injuries and illnesses. However, according to these commenters, nothing in the OSH Act authorizes OSHA to publish establishment-specific injury and illness records on a public website. The National Retail Federation (NRF) stated: “NRF believes the NPRM itself is fundamentally flawed in that the agency does not have the statutory authority to publish the data as proposed” (Docket ID 0090). The National Propane Gas Association commented: “Lastly, the agency radically interprets its authority to justify the publicly accessible website. In the NPRM, OSHA argues that its general purpose justifies any rulemaking that presents the potential to improve safety. The general purpose of the agency to improve workplace safety is not equivalent to a foregone conclusion that any proposal by the agency will result in improvements to workplace safety. The NPRM fails to present information to demonstrate that public shaming is an effective means to improve workplace safety.” (Docket ID 0050).

Similarly, NAHB pointed to other statutes, such as the Federal Coal Mine Safety and Health Act of 1969, Public Law 91–173 (December 30, 1969), which it maintains provided more express authority to publish records than the OSH Act (Docket ID 0059). NAHB further argues that the language in the OSH Act only authorizes OSHA to publish analysis, not “raw data” (Docket ID 0059).

As OSHA stated in the 2016 final recordkeeping rule, the OSH Act provides ample statutory authority for OSHA to issue this final rule and publish the submitted data. As explained in Section II, Legal Authority, the following provisions of the OSH Act give the Secretary of Labor broad authority to issue regulations that address the recording and reporting of occupational injuries and illnesses.

Section 2(b)(12) of the Act states that one of the purposes of the OSH Act is to ensure safe and healthy working conditions through appropriate reporting procedures designed to further the objectives of the OSH Act and accurately characterize the nature of workplace safety and health hazards (29 U.S.C. 651(b)(12)).

Section 8(c)(1) requires employers to create and retain the records that OSHA has specified are necessary and appropriate either for the Act's enforcement or to develop information related to the underlying reasons for and prevention of work-related illnesses and accidents (29 U.S.C. 657(c)(1)). Section 8(c)(1) also requires employers to make such records available to the Secretary. The authorization to the Secretary to prescribe such recordkeeping regulations as he considers “necessary or appropriate” emphasizes the breadth of the Secretary's discretion in implementing the OSH Act. Section 8(c)(2) further tasks the Secretary with promulgating regulations which require employers to keep accurate records of, and to make periodic reports on, occupational illnesses, injuries, and deaths (29 U.S.C. 657(c)(2)).

The grant of authority in Section 8(g)(1) is particularly pertinent to OSHA's stated intention to publish the collected information online. Section 8(g)(1) authorizes the Secretary to compile, analyze, and publish, either in summary or detailed form, all reports or information the Secretary obtains under section 8 of the OSH Act. Section 8(g)(2) of the Act generally empowers the Secretary to promulgate any rules and regulations that the Secretary determines are necessary to perform the Secretary's duties under the OSH Act (29 U.S.C. 657(g)(2)).

Section 24 contains a related grant of regulatory authority. Section 24(a) directs the Secretary to create and maintain an effective program of collection, compilation and analysis of work-related safety and health statistics. In addition, Section 24(a) states that the Secretary shall compile accurate statistics on occupational illnesses and injuries (29 U.S.C. 673(a)). Finally, Section 24(e) provides that, based on the records the employers create and retain in accordance with Section 8(c) of the OSH Act, employers must file, with the Secretary, the reports prescribed by regulation as necessary to carry out the Secretary's functions under the OSH Act (29 U.S.C. 673(e)). Given the numerous statutory provisions authorizing and requiring OSHA to collect information about occupational safety and health, along with the provision (Section 8(g)(1)) specifically addressing the publication of such information, it is clear that Congress determined that both collection and publication of this information were critical to OSHA's mission of protecting the health and safety of the nation's workers.

In addition, as described in Section III.B of this Summary and Explanation, OSHA has made the determination that electronic submission and publication of injury and illness recordkeeping data are “necessary and appropriate” for the enforcement of the OSH Act and for gathering and sharing information regarding the causes or prevention of occupational accidents or illnesses. Where an agency is authorized to prescribe regulations “necessary” to implement a statutory provision or purpose, a regulation promulgated under such authority is valid “so long it is reasonably related to the enabling legislation” ( Morning v. Family Publication Service, Inc., 441 U.S. 356, 359 (1973)).

OSHA further notes that, contrary to comments made by some commenters, and as explained above, the final rule will not result in the publication of raw injury and illness recordkeeping data or the release of records containing personally identifiable information or confidential commercial and/or proprietary information. The release and publication of submitted injury and illness recordkeeping data will be conducted in accordance with applicable Federal law (see discussion above in this preamble). The purpose of increasing access to injury and illness report data is not to conduct public shaming, but rather to allow employers to compare their safety records to other employers, enable employees to gain greater awareness of the hazards and safety records in their workplaces without fear of retribution, and pursue the numerous other safety and health-related purposes discussed in this rulemaking.

Many commenters stated that collection and publication of detailed injury and illness data will support the OSH Act's goals of reducing occupational accidents and illnesses through greater understanding, prevention, and effective enforcement ( e.g., Docket IDs 0010, 0011, 0012, 0024, 0029, 0030, 0031, 0035, Attachment 2, 0045, Attachment 1, 0048, 0049, Attachment 1). The Seventeen AGs summarized the ways that publication of data will enhance the effectiveness of OSHA's efforts to achieve the purposes of the OSH Act: “Requiring the submission of certain data from Forms 300 and 301, in addition to the summary Form 300A, will provide the public with injury-specific data that is critical for helping workers, employers, regulators, researchers, and consumers understand and prevent occupational injuries and illnesses. . . . These [case-specific] fields paint a far more detailed picture of the nature and severity of workplace safety incidents and risks. The proposed rule recognizes the importance of this more detailed information, which will help OSHA and States better target their workplace safety and enforcement programs; encourage employers to abate workplace hazards; empower workers to identify risks and demand improvements; and provide information to researchers who work on occupational safety and health.” (Docket ID 0045).

OSHA agrees. In sum, publication of the data required to be submitted under this final rule is clearly within the broad authority granted the agency by the OSH Act.

OSHA also received comments arguing that the online posting of covered employers' injury and illness recordkeeping data violates the Confidential Information Protection and Statistical Efficiency Act of 2002 (CIPSEA) (Pub. L. 107–347, December 17, 2002) (Docket ID 0088, Attachment 2). For example, the Chamber of Commerce noted that CIPSEA prohibits BLS from releasing establishment-specific injury and illness data to the general public or to OSHA, and that OSHA has not adequately addressed how the release of part 1904 information under this rulemaking is consistent with the Congressional mandate expressed in the law.

In response, OSHA notes that CIPSEA provides strong confidentiality protections for statistical information collections that are conducted or sponsored by Federal agencies. The law prevents the disclosure of data or information in identifiable form if the information is acquired by an agency under a pledge of confidentiality for exclusively statistical purposes (see Section 512(b)(1)). BLS, whose mission is to collect, process, analyze, and disseminate statistical information, uses a pledge of confidentiality when requesting occupational injury and illness information from respondents under the BLS Survey.

The provisions of CIPSEA apply when a Federal agency both pledges to protect the confidentiality of the information it acquires and uses the information only for statistical purposes. Conversely, the provisions of CIPSEA do not apply if information is collected or used by a Federal agency for any non-statistical purpose. As noted elsewhere in this document, the information collected and published by OSHA in the final rule will be used for several non-statistical purposes, including for the targeting of OSHA enforcement activities. Therefore, the CIPSEA confidentiality provisions are not applicable to the final rule.

12. Administrative Issues

a. Public Hearing

The Chamber of Commerce recommended that OSHA hold formal public hearings throughout the United States for this rulemaking (Docket ID 0088, Attachment 2). The Chamber felt that, given both the burden on employers and the far-reaching implications of publishing confidential and proprietary information, formal public hearings were necessary to give people outside Washington, DC the opportunity to participate in the rulemaking process. Additionally, the National Propane Gas Association commented that OSHA should hold “public listening sessions to solicit more concepts from employers, employees, and other stakeholders” (Docket ID 0050).

OSHA considered these requests and is not persuaded that hearings or public listening sessions are required or necessary. First, as to whether a hearing is required, because this rulemaking involves a regulation rather than a standard, it is governed by the notice and comment requirements in the APA (5 U.S.C. 553) rather than Section 6 of the OSH Act (29 U.S.C. 655) and 29 CFR 1911.11. Section 6 of the OSH Act and 29 CFR 1911.11 only apply to promulgating, modifying, or revoking occupational safety and health standards. Therefore, the OSH Act's requirement to hold an informal public hearing (29 U.S.C. 655(b)(3)) on a proposed rule, when requested, does not apply to this rulemaking.

Similarly, Section 553 of the APA does not require a public hearing. Instead, it states that the agency must “give interested persons an opportunity to participate in the rulemaking through submission of written data, views, or arguments with or without opportunity for oral presentation” (5 U.S.C. 553(c)). In the NPRM, OSHA invited the public to submit written comments on all aspects of the proposal and received 87 comments in response (see 87 FR 18555). OSHA believes that interested parties had a full and fair opportunity to participate in the rulemaking and comment on the proposed rule through the submission of written comments. This belief is supported by the fact that OSHA extended the comment period for an additional thirty days based on requests from the public (87 FR 31793). With that extension, interested parties were afforded 92 days to review and comment on OSHA's proposal. OSHA did not receive any requests to further extend the comment period.

Second, as to the necessity of the hearing to provide interested parties outside of Washington, DC an opportunity to participate in the rulemaking process, or holding public listening sessions, OSHA does not believe it needs to do so for the same reasons it does not find that the APA requires a hearing. Specifically, the opportunity for notice and comment afforded by the NPRM was sufficient to both allow participation by interested parties and fully develop the record.

b. The Advisory Committee on Construction Safety and Health (ACCSH)

The National Association of Homebuilders (NAHB) commented that OSHA must seek input from the Advisory Committee on Construction Safety and Health (ACCSH) during this rulemaking “to better understand the impacts and consequences of its proposal” (Docket ID 0059).

As pointed out by NAHB in their comments, ACCSH is a continuing advisory body established under Section 3704(d) of the Contract Work Hours and Safety Standards Act (40 U.S.C. 3701 et seq., commonly known as the Construction Safety Act), to advise the Secretary of Labor and Assistant Secretary of Labor for Occupational Safety and Health in the formulation of construction safety and health standards and policy matters affecting federally financed or assisted construction. In addition, OSHA's regulation at 29 CFR 1912.3 provides that OSHA must consult with ACCSH regarding the setting of construction standards under the OSH Act.

OSHA notes that both the Construction Safety Act (40 U.S.C. 3704(a)) and 29 CFR 1912.3 only require OSHA to consult with ACCSH regarding the formulation of new construction “standards.” As discussed above, the requirements in 29 CFR part 1904 are regulations, not standards. Therefore, as NAHB itself acknowledged in its comment (“the statute and the agency's own regulations only require OSHA to consult with the ACCSH regarding the setting of construction standards, and not regulations ” (Docket ID 0059)), OSHA was not required to consult with ACCSH in formulating this final regulation. In addition, as noted in the NPRM, OSHA consulted and received advice from the National Advisory Council on Occupational Safety and Health (NACOSH) prior to issuing the proposed rule. NACOSH indicated its support for OSHA's efforts, in consultation with NIOSH, to modernize the system for collection of injury and illness data to assure that the data are timely, complete, and accurate, as well as accessible and useful to employees, employers, government agencies, and members of the public.

c. Reasonable Alternatives Considered

Associated Builders and Contractors commented that under the APA, OSHA is required “to consider reasonable alternatives to its proposed reversal of the current reporting requirements,” and asserts that “the failure to do so will likely lead to nullification upon judicial review” (Docket ID 0071). In response, OSHA notes that the Supreme Court has held that an agency is not required to “consider all policy alternatives in reaching [its] decision,” but when an agency rescinds a prior policy, it must consider the alternatives that are “within the ambit of the existing [policy]” ( Dep't of Homeland Security v. Regents of the Univ. of Cal., 140 S. Ct. 1891, 1913 (2020) (alterations in original)).

The commenter does not point to a particular policy alternative that OSHA failed to consider, nor is OSHA required to consider every possible policy alternative. To the extent the comment suggests that OSHA should have considered, as an alternative, maintaining the requirements of the 2019 rule, OSHA has complied with this requirement. As explained in the NPRM, OSHA proposed requiring establishments with 100 or more employees at any time during the previous calendar year, and in an industry listed in proposed appendix B to subpart E, to electronically submit certain information from OSHA Forms 300, 301, and 300A (87 FR 18537). This was a change from the 2019 final rule, which had removed the requirement for the annual electronic submission of 300 and 301 data to OSHA because of both the risk of disclosure of sensitive worker information and resource concerns. In the NPRM, OSHA explained that it had preliminarily determined that the reasons given in the preamble to the 2019 rule for the removal of the 300 and 301 data submission requirement were no longer compelling. The agency discussed in detail the ways in which the benefits of collecting data from the 300 and 301 forms outweighed the slight risk to employee privacy and explained how technological improvements have mitigated resource concerns (87 FR 18537–18542). The NPRM also explained the ways in which publication of 300 and 301 data may benefit interested parties and improve worker safety and health (87 FR 18542–18543). Furthermore, in Section III.B of this Summary and Explanation, OSHA has discussed these issues in further detail and responded to a number of comments opposing the new reporting requirement. By analyzing these issues and responding to comments, OSHA has weighed the proposal against maintaining the status quo and provided a well-reasoned explanation for its decision, which illustrates OSHA's consideration of alternatives to its proposal and fulfills its obligations under the APA.

OSHA also considered alternatives to several aspects of this final rule. In the preliminary economic analysis of the NPRM, the agency explained that appendix A is based on 2011–2013 injury rates from the SOII, and that OSHA was not proposing to modify appendix A because it took several years for the regulated community to understand which industries were required to submit information and which were not (87 FR 18552). However, OSHA asked for comment on a possible alternative: updating appendix A to reflect 2017–2019 injury rates, which would result in the addition of one industry and the removal of 13 (87 FR 18552–53). Additionally, OSHA explained that the 2016 final rule did not include a requirement to regularly update the list of designated industries in appendix A because it believed that moving industries in and out of the appendix would be confusing (87 FR 18553). The agency requested comment on another possible alternative: regularly updating the list of designated industries in proposed appendix B (87 FR 18553). In Section III.A of this Summary and Explanation, OSHA has responded to the comments received in response to the first alternative and provided explanations for its decision not to adopt the alternative. Likewise, in Section III.B of this Summary and Explanation, OSHA responded to comments received in response to the second alternative, and its decision not to adopt that alternative.

OSHA also proposed to change the requirement in § 1904.41(a)(1) that required establishments with 250 or more employees, in all industries routinely required to keep OSHA injury and illness records, to electronically submit information from their 300A to OSHA once a year. The proposal would have required this submission only for establishments in industries listed in appendix A, thus reducing the number of establishments required to electronically submit 300A data (see 87 FR 18536). The agency received many comments on the proposal, which overwhelmingly opposed it, and urged OSHA to retain the existing requirement for establishments with 250 or more employees that are normally required to report under part 1904 to submit data from their 300As. In Section III.A of this Summary and Explanation, these comments are discussed in greater detail, as is OSHA's explanation for rejecting the proposed change and retaining current reporting requirements for Form 300A data.

OSHA's presentation of proposed alternatives, analysis of comments, and ultimate decisions to reject those proposals illustrates OSHA's consideration of alternatives within the ambit of its current policy. For these reasons, OSHA has met its obligations under the APA to consider alternatives to its proposal.

IV. Final Economic Analysis and Regulatory Flexibility Certification

A. Introduction

As described above, OSHA is amending its recordkeeping regulations in 29 CFR part 1904 to revise the requirements for the electronic submission of information from employers' injury and illness recordkeeping forms. Specifically, OSHA is amending its recordkeeping regulation at § 1904.41 to require establishments with 100 or more employees in certain designated industries ( i.e., those on appendix B in subpart E of part 1904) to electronically submit information from their OSHA Forms 300 and 301 to OSHA once a year. This is the only new requirement of the final rule, and therefore the only one that imposes new costs on employers. The other main provisions in the final rule, which involve submission of data from the Form 300A annual summary, represent non-substantive changes to requirements that already exist. OSHA intends to post the data from the annual electronic submissions on a public website after identifying and removing information that could reasonably be expected to identify individuals directly, such as individuals' names and contact information.

Executive Orders 12866 and 13563 direct agencies to assess the costs and benefits of the intended regulation and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, and public health and safety effects; distributive impacts; and equity). Executive Order 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This rule is not an economically significant regulatory action under Section 3(f) of Executive Order 12866 and has been reviewed by the Office of Information and Regulatory Affairs in the Office of Management and Budget, as required by executive order.

As explained in this analysis, OSHA estimates that this rule will have economic costs of $7.7 million per year. These costs include $7.1 million per year to the private sector to become familiar with the rule's requirements, update software, and submit forms electronically to OSHA, and $0.6 million per year to the government for processing the data, updating and maintaining software, and providing additional IT support. OSHA estimates average costs of $136 per year for affected establishments (those with 100 or more employees in NAICS industries listed on appendix B of subpart E of part 1904), annualized over 10 years with a discount rate of seven percent.

The final rule is not a significant regulatory action under Executive Order 12866 Section 3(f)(1), and it is not a “major rule” under the Congressional Review Act (5 U.S.C. 801 et seq. ). The agency estimates that the rulemaking imposes far less than $100 million in annual economic costs. In addition, it does not meet any of the other criteria specified by the Congressional Review Act for an economically significant regulatory action or major rule.^[18] This Final Economic Analysis (FEA) addresses the costs, benefits, and economic impacts of the rule.

B. Changes From the Preliminary Economic Analysis (PEA) (Reflecting Changes in the Final Rule From the Proposal)

The final rule makes limited substantive changes to employer obligations when compared to the requirements that were costed as part of the proposed rule. These changes, as described in more detail below, are to the requirement for establishments with 250 or more employees to submit data from their 300A annual summaries to OSHA and to the industries included on appendix B to subpart E of part 1904.

More generally, the final rule does not add to or change any employer's obligation to complete, retain, and certify injury and illness records under OSHA's regulations at 29 CFR part 1904. The final rule also does not add to or change the recording criteria or definitions for these records. Nor does the final rule change the requirement to electronically submit information from the OSHA 300A Annual Summary. As discussed in Section III.A of the Summary and Explanation, the final rule does not remove the reporting requirement from any establishment that is currently required to electronically report Form 300A information to OSHA nor impose a new reporting requirement on any establishment that is not currently required to electronically report Form 300A information to OSHA.

1. Continued Submission of OSHA 300A Annual Summaries by Establishments With 250 or More Employees

In the NPRM, OSHA proposed removing the requirement for establishments with 250 or more employees in select industries to submit information from their OSHA 300A annual summary forms electronically. To reflect this proposed change, OSHA estimated in its PEA that the reduction in the number of establishments required to submit this information would result in a total annual cost savings of $27,077 (87 FR 18549). For this final rule, as explained in Section III.A of the Summary and Explanation, OSHA has decided not to make the proposed change and to retain the existing requirement. Therefore, these cost savings have been removed from the cost analysis.

2. Additional Appendix B Industries

In the NPRM, the agency proposed a selected list of industries, in appendix B, to designate which establishments with 100 or more employees would have to submit information from their OSHA Form 300 Log and Form 301 Incident Reports electronically. The industries on proposed appendix B were based on the average total case rate (TCR) of injuries and illnesses in each industry. Because the requirement for establishments in industries on appendix B to submit data from Forms 300 and 301 is a new requirement, OSHA analyzed the costs and impacts to establishments in those industries in the PEA. For the final rule, OSHA has decided to add additional industries to the list of industries that were on appendix B in the proposed rule; these additional industries are listed in Table 1, below. As explained in Section III.B.1 of the Summary and Explanation, OSHA has decided to add industries from appendix A that meet the criteria of having either a high DART rate (defined as 1.5 times the private industry DART rate) or a high fatality rate (defined as 1.5 times the private industry fatality rate). Employers that have 100 or more employees and are in an industry listed on final appendix B must submit information from their Forms 300 and 301 to OSHA, electronically, on an annual basis.

Table 1—Industries Added to Appendix B

2017 NAICS 4-digit	Industry	High DART rate criteria	High fatality rate criteria
1133	Logging	No	Yes.
1142	Hunting and Trapping	Yes	No.
3379	Other Furniture Related Product Manufacturing	Yes	No.
4239	Miscellaneous Durable Goods Merchant Wholesalers	No	Yes.
4853	Taxi and Limousine Service	No	Yes.
4889	Other Support Activities for Transportation	Yes	No.

With the additions in Table 1, above, the final appendix B to subpart E is as follows:

NAICS	Industry
1111	Oilseed and Grain Farming.
1112	Vegetable and Melon Farming.
1113	Fruit and Tree Nut Farming.
1114	Greenhouse, Nursery, and Floriculture Production.
1119	Other Crop Farming.
1121	Cattle Ranching and Farming.
1122	Hog and Pig Farming.
1123	Poultry and Egg Production.
1129	Other Animal Production.
1133	Logging.
1141	Fishing.
1142	Hunting and Trapping.
1151	Support Activities for Crop Production.
1152	Support Activities for Animal Production.
1153	Support Activities for Forestry.
2213	Water, Sewage and Other Systems.
2381	Foundation, Structure, and Building Exterior Contractors.
3111	Animal Food Manufacturing.
3113	Sugar and Confectionery Product Manufacturing.
3114	Fruit and Vegetable Preserving and Specialty Food Manufacturing.
3115	Dairy Product Manufacturing.
3116	Animal Slaughtering and Processing.
3117	Seafood Product Preparation and Packaging.
3118	Bakeries and Tortilla Manufacturing.
3119	Other Food Manufacturing.
3121	Beverage Manufacturing.
3161	Leather and Hide Tanning and Finishing.
3162	Footwear Manufacturing.
3211	Sawmills and Wood Preservation.
3212	Veneer, Plywood, and Engineered Wood Product Manufacturing.
3219	Other Wood Product Manufacturing.
3261	Plastics Product Manufacturing.
3262	Rubber Product Manufacturing.
3271	Clay Product and Refractory Manufacturing.
3272	Glass and Glass Product Manufacturing.
3273	Cement and Concrete Product Manufacturing.
3279	Other Nonmetallic Mineral Product Manufacturing.
3312	Steel Product Manufacturing from Purchased Steel.
3314	Nonferrous Metal (except Aluminum) Production and Processing.
3315	Foundries.
3321	Forging and Stamping.
3323	Architectural and Structural Metals Manufacturing.
3324	Boiler, Tank, and Shipping Container Manufacturing.
3325	Hardware Manufacturing.
3326	Spring and Wire Product Manufacturing.
3327	Machine Shops; Turned Product; and Screw, Nut, and Bolt Manufacturing.
3328	Coating, Engraving, Heat Treating, and Allied Activities.
3331	Agriculture, Construction, and Mining Machinery Manufacturing.
3335	Metalworking Machinery Manufacturing.
3361	Motor Vehicle Manufacturing.
3362	Motor Vehicle Body and Trailer Manufacturing.
3363	Motor Vehicle Parts Manufacturing.
3366	Ship and Boat Building.
3371	Household and Institutional Furniture and Kitchen Cabinet Manufacturing.
3372	Office Furniture (including Fixtures) Manufacturing.
3379	Other Furniture Related Product Manufacturing.
4231	Motor Vehicle and Motor Vehicle Parts and Supplies Merchant Wholesalers.
4233	Lumber and Other Construction Materials Merchant Wholesalers.
4235	Metal and Mineral (except Petroleum) Merchant Wholesalers.
4239	Miscellaneous Durable Goods Merchant Wholesalers.
4244	Grocery and Related Product Merchant Wholesalers.
4248	Beer, Wine, and Distilled Alcoholic Beverage Merchant Wholesalers.
4413	Automotive Parts, Accessories, and Tire Stores.
4422	Home Furnishings Stores.
4441	Building Material and Supplies Dealers.
4442	Lawn and Garden Equipment and Supplies Stores.
4451	Grocery Stores.
4522	Department Stores.
4523	General Merchandise Stores, including Warehouse Clubs and Supercenters.
4533	Used Merchandise Stores.
4543	Direct Selling Establishments.
4811	Scheduled Air Transportation.
4841	General Freight Trucking.
4842	Specialized Freight Trucking.
4851	Urban Transit Systems.
4852	Interurban and Rural Bus Transportation.
4853	Taxi and Limousine Service.
4854	School and Employee Bus Transportation.
4859	Other Transit and Ground Passenger Transportation.
4871	Scenic and Sightseeing Transportation, Land.
4881	Support Activities for Air Transportation.
4883	Support Activities for Water Transportation.
4889	Other Support Activities for Transportation.
4911	Postal Service.
4921	Couriers and Express Delivery Services.
4931	Warehousing and Storage.
5322	Consumer Goods Rental.
5621	Waste Collection.
5622	Waste Treatment and Disposal.
6219	Other Ambulatory Health Care Services.
6221	General Medical and Surgical Hospitals.
6222	Psychiatric and Substance Abuse Hospitals.
6223	Specialty (except Psychiatric and Substance Abuse) Hospitals.
6231	Nursing Care Facilities (Skilled Nursing Facilities).
6232	Residential Intellectual and Developmental Disability, Mental Health, and Substance Abuse Facilities.
6233	Continuing Care Retirement Communities and Assisted Living Facilities for the Elderly.
6239	Other Residential Care Facilities.
6243	Vocational Rehabilitation Services.
7111	Performing Arts Companies.
7112	Spectator Sports.
7131	Amusement Parks and Arcades.
7211	Traveler Accommodation.
7212	RV (Recreational Vehicle) Parks and Recreational Camps.
7223	Special Food Services.

3. Updated Data

The FEA has updated data used in the PEA to the most recent data available. The data from the PEA and the updated data used for this FEA appear in Table 2, below.

Table 2—Data in the PEA and the FEA

PEA estimates			FEA estimates
Name	Value	Source	Name	Value	Source
Base Wages SOC 19–5011	$37.55	BLS OEWS 5/2020	Base Wages SOC 19–5011 (safety specialist)	$37.86	BLS OEWS 5/2021.1
			Base Wages 15–1252 (software developer)	$58.17	BLS OEWS 5/2021.1
Fringe Benefits Civilian	0.312	BLS ECEC 6/2021	Fringe Benefits Civilian	0.310	BLS ECEC 9/2022.2
Base Wages GS–13 Step 6	$48.78	OMB FY 2020	Base Wages GS–13 Step 6	$55.06	OMB 2023.3
Fringe Benefits Government	0.381	BLS ECEC 6/2021	Fringe Benefits Government	0.381	BLS ECEC 9/2022.2
Appendix B Establishments	48,919	OSHA/OSA 2021	Appendix B Establishments	52,092	OSHA/OSA 2022.4
Total Submissions	718,316	OSHA/OSA 2021	Total Submissions	766,257	OSHA/OSA 2022.4
Manual Submission Time 300/301	10 minutes	PRA 04/22 5	Manual Submission Time 300/301	15 minutes	OSHA/OSA. 2022.4
1  BLS May 2021 Occupational Employment and Wage Statistics data, released March 31, 2022. https://www.bls.gov/​oes/​current/​oes195011.htm#nat. Accessed October 05, 2022.
2  BLS September 2022 Employer Costs for Employee Compensation, released December 15, 2022. https://www.bls.gov/​news.release/​pdf/​ecec.pdf. Accessed February 20, 2023.
3  OMB January 2023 Salary Table 2022–RUS. https://www.opm.gov/​policy-data-oversight/​pay-leave/​salaries-wages/​salary-tables/​pdf/​2023/​RUS_​h.pdf. Accessed February 22, 2023.
4  Docket ID 0103.
5  Recordkeeping and Reporting Occupational Injuries and Illnesses (29 CFR part 1904). OMB Control #1218–0176.

C. Cost

§ 1904.41(a)(2): Annual Electronic Submission of Information From OSHA Form 300 Log of Work-Related Injuries and Illnesses and OSHA Form 301 Injury and Illness Incident Report by Establishments With 100 or More Employees in Designated Industries

OSHA is retaining the same cost methodology in this FEA as in the PEA. In the PEA, the agency estimated the cost of electronic data submission per establishment by multiplying the hourly compensation (in dollars) of the person expected to submit the records electronically by the time required for the submission. OSHA then multiplied this cost per establishment by the estimated number of Appendix B establishments required to submit data, resulting in the total estimated cost of this part of the proposed rule.

OSHA also calculated the estimated cost for establishments to become familiar with the process of electronically submitting the required information. The total estimated cost of this part of the proposed rule was calculated by multiplying the hourly wages (in dollars) of the person expected to submit the records electronically by the time required to learn how to use OSHA's system. The resulting value was then multiplied by the number of establishments in appendix B (87 FR 18549–551).

1. Wages

a. Wage Estimates in the PEA

OSHA has retained the same wage assumptions and methodology from the PEA but has updated the figures to include current data. In the PEA, the agency estimated the compensation of the person expected to perform the task of electronic data submission, assuming that this task would be performed by an Occupational Health and Safety Specialist. As indicated in Table 2, above, the agency used BLS's Occupational Employment and Wage Statistics (OEWS) data to determine that the mean hourly wage for an Occupational Health and Safety Specialist was $37.55 per hour. Then, OSHA used June 2021 data from the BLS National Compensation Survey to derive a mean fringe benefit factor of 1.45 for civilian workers in general.^[19] OSHA then multiplied the mean hourly wage ($37.55) by the mean fringe benefit factor (1.45) to obtain an estimated total compensation (wages and benefits) for Occupational Health and Safety Specialists of $54.58 per hour ([$37.55 per hour] × 1.45). OSHA next applied a 17 percent overhead rate to the base wage ([$37.55 per hour] × 0.17), totaling $6.38 per hour.^[20] The $6.38 was added to the total compensation ($54.58), yielding a fully loaded wage rate of $60.96 [$54.58 + $6.38] per hour.

b. Comments on OSHA's Wage Estimates

Some commenters expressed the opinion that the wage rate estimates used in the PEA were too low. For example, the National Federation of Independent Business (NFIB) and the Chamber of Commerce commented that the potential impacts from OSHA publishing work-related injury and illness information would require that companies have senior executives and legal counsel review the logs for both employee privacy and reputational harm (Docket IDs 0036, 0088). The Chamber estimated that involving executives and legal counsel would increase the wage rate used for this analysis to $67.01 per hour (Docket ID 0088).

OSHA concludes that an appropriate wage rate has been used for this rule. While some companies may choose to involve executives or lawyers in the submission process, others will delegate duties to administrative assistants or office managers. OSHA considers the wage rate for Occupational Safety and Health Specialists to represent a rough average among the wages for various possible job categories that might submit the data under this rule.^[21] It should be emphasized, however, that this wage is intended to reflect only the cost of entering the data to submit it electronically to the agency—the employer is already responsible for recording the data correctly. If some employers consider it necessary for employees in very high wage categories to review the cases that are already required to be recorded, that is not an incremental cost of this rule.^[22] In addition, the Chamber of Commerce commented that OSHA is using an incorrect overhead estimate when calculating the loaded wage of the Occupational Health and Safety Specialist (Docket ID 0088). It argued that the correct factor for computation of overhead is 0.6949 (rather than OSHA's longstanding reliance on the PEA's 0.17 for overhead costs), which the commenter sourced from the Bureau of Economic Analysis, Table 7 (Relation of Gross Domestic Product, Gross National Income, and National Income). The Chamber of Commerce's overhead factor estimate would increase the overhead amount from $6.38 per labor hour to $26.09 per labor hour.

The agency believes the Chamber has incorrectly inflated the “overhead” cost factor by including what it refers to as a “profit opportunity cost element” (Docket ID 0088). The overhead rate that OSHA uses in this cost analysis (17 percent) is based on the EPA's “Wage Rates for Economic Analyses of the Toxics Release Inventory Program,” June 10, 2002. OSHA has used this overhead rate for several economic impact analyses previously, and it is a standard estimate for this agency, the Employment and Training Administration,^[23] the Wage and Hour Division,^[24] and the EPA.^[25] As expressed in a prior OSHA rule, OSHA does not believe the inclusion of “profit opportunity cost elements” in an overhead estimate is appropriate in the context of this economic analysis.^[26]

c. Wage Estimates in the FEA

For the final rule, OSHA has updated the fully loaded wages to $61.31 per hour, using the same calculation method as in the PEA and the updated data listed in Table 2, above.^[27] Specifically, OSHA multiplied the mean hourly wage ($37.86) by the mean fringe benefit factor (1.45) ^[28] to obtain an estimated total compensation (wages and benefits) for Occupational Health and Safety Specialists of $54.87 per hour ([$37.86 per hour] × 1.45). OSHA next applied a 17 percent overhead rate to the base wage ([$37.86 per hour] × 0.17), totaling $6.44.^[29] The $6.44 was added to the total compensation ($54.87) yielding a fully loaded wage rate of $61.31 [$54.87 + $6.44]. In response to comments, OSHA has added additional costs to the FEA that use loaded wages for a Software Developer at $94.19,^[30] based on an hourly base wage of $58.17, in the calculation of those costs.

2. Estimated Case Counts

In the PEA, based on the 2020 data collection of 2019 OSHA Form 300A data, OSHA estimated that establishments with 100 or more employees, in proposed appendix B industries, reported 718,316 cases to OSHA. The Phylmar Regulatory Roundtable (PRR) asserted, without pointing to specific support, that “industries required to submit have a history of higher incident rates” and questioned the average of 14.7 cases per establishment on this basis (Docket ID 0094). PRR stated that “it does not seem plausible that there are enough establishments with zero cases to bring the estimates this low.” In support, PRR described several large employers, with up to 12,000 employees each, that recorded more than 14.7 cases (up to 155 cases) in certain years. OSHA notes that it used the average number of cases submitted by establishments with 100 or more employees in NAICS industries on appendix B. PRR's limited examples do not disturb the calculated averages, which are based on data from affected establishments. OSHA used the average number of cases on Form 300A submissions across all affected establishments to represent the average number of cases an establishment would submit via manual entry. For this final rule, OSHA has updated the estimate of total cases reported by establishments with 100 or more employees in appendix B industries to 766,257 cases,^[31] as mentioned in Table 2, above. This estimate has been updated from the PEA. OSHA has expanded the number of establishments to include all establishments with at least 100 employees in industries that are on final appendix B, which includes six industries that were not included on proposed appendix B.

3. Familiarization

In the PEA, OSHA estimated that establishments would take 10 minutes, on average, to familiarize themselves with changes to the recordkeeping requirements in the proposed rule. Based on this, the agency calculated a one-time cost for familiarization of $497,033 [(48,919 establishments) × (10 minutes/establishment) × (1 hour/60 minutes) × ($60.96/hour)]. The number of establishments in the PEA was based on submissions in 2019 to the ITA for establishments that were in the proposed appendix B in the NPRM.

The U.S. Poultry and Egg Association, the North American Meat Institute, the Chamber of Commerce, and the Phylmar Regulatory Roundtable argued that OSHA undercounted the amount of time required to complete rule familiarization for the proposed rule (Docket IDs 0054, 0070, 0088, 0094). The Chamber of Commerce asserted that OSHA's estimate “ignores the familiarization time cost that establishments not covered will incur to determine their non-covered status, and it suggests an extremely optimistic but empirically baseless view of the time that will be required by those covered to read the rule, review its requirements relative to their current operations and procedures, identify and implement new policies and procedures to comply with the new rule, and to train administrative and operational employees in their new compliance duties” (Docket ID 0088). Other commenters claimed additional time would be required for processing by a corporate safety department subject matter expert (Docket ID 0054) and for “legal analysis” (Docket ID 0070).^[32]

For the establishments that do not need to submit the Form 300 and 301 data but must determine if they are subject to the requirement, the Chamber of Commerce estimated, based on unspecified sources, that the 1.9 million establishments with 10 to 99 employees will spend 5 minutes determining that they are not affected. According to the Chamber of Commerce, at $1.65 per minute, the total cost would be $15.9 million. Additionally, “for the 172,277 establishments with 100 or more employees, on average a 15-minute review by senior managers or in-house legal counsel may be able to answer the basic affected or not affected question for an aggregate familiarization cost of $4.3 million.” (Docket ID 0088).

Finally, the Chamber of Commerce asserted that rule familiarization is more complicated than OSHA estimates. The commenter believed that OSHA failed to consider that each establishment that has determined that it is subject to the reporting requirement “must now consider how the new requirements impact existing policies and procedures, what are the risks of reputational damage or of employee privacy violation liability and how can those risks be mitigated by changing policies and procedures” (Docket ID 0088). For the PEA's estimated 48,919 establishments required to comply with the new reporting requirement, the commenter estimates a lower bound estimate of 8 hours of professional time, which would result in an aggregate cost of $38.7 million. OSHA does not, however, require such considerations: the final rule has accounted for privacy concerns (comments on costs related to privacy are addressed later in this section) and, as discussed later, employers should already be familiar with the reporting system because they are using it to submit Form 300A data. Furthermore, the commenter's recommendation of an average of 8 hours per establishment vastly exceeds OSHA's traditional estimates of familiarization time. For comparison, in the 2016 final recordkeeping rule, OSHA included only 10 minutes for familiarization costs, which included the time for establishments to create accounts and enter basic establishment information in the ITA (see 81 FR 29680), none of which has to be done again for purposes of complying with the final rule at issue here.

OSHA disagrees that more than 10 minutes will be required for rule familiarization in this case. Under the existing recordkeeping rule, employers are already required to keep part 1904 injury and illness records. In addition, all establishments that will have to submit case-specific information from their Form 300 Log and 301 Incident Report under this rule are already required to submit establishment information from their Form 300A Annual Summary, using the same interface (the ITA) they will use to submit their case information. OSHA intends to notify all establishments required to submit data under the new rule of this new obligation. In addition, OSHA will update its online ITA application to be consistent with this final rule. Employers unsure about whether they are covered by this final rule can use this application (at https://www.osha.gov/​itareportapp) to immediately determine their data submission obligations. Thus, there will be no need for establishments to spend time to determine whether they are affected by the final rule or not. Altogether, OSHA concludes that 10 minutes is an appropriate amount of time for employers to become familiar with the rule (with assistance from OSHA's application or OSHA website materials, if necessary).

OSHA has decided to retain the assumptions and the methodology from the PEA for this final rule. Using the updated numbers reported in Table 2, above, OSHA now estimates the one-time cost for familiarization as $532,257, calculated as [(52,092 establishments) × (0.17 hours/establishment) ^[33] × ($61.31/hour)]. Annualizing this rate over ten years with a 7 percent discount rate yields an annual cost of $75,781 ^[34] to the private sector.

4. Record Submission

For the time required for the data submission in the PEA, OSHA used the estimated unit time requirements reported in OSHA's paperwork burden analysis for 29 CFR part 1904 Recording and Reporting Occupational Injuries and Illnesses (OMB Control Number 1218–0176). The agency estimated that it would take 10 minutes to submit information about each case manually; this estimate does not apply when establishments submit the records as batch files, because batch files are a means of submitting multiple cases at one time.

In the PEA, OSHA estimated that there would be 48,919 establishments reporting 718,386 cases total, or 14.7 cases per establishment, on average (87 FR 18549–50). The agency estimated that about half of all reporting establishments (24,460) would submit half of the total cases (359,193 cases) via one batch file per establishment.^[35] This yielded an estimated cost of $248,517 [(24,460 establishments) × (10 minutes/establishment) × (1 hour/60 minutes) × ($60.96/hour)]. The average cost per establishment was estimated to be $10.16 per establishment for establishments submitting via batch file.

OSHA then estimated that the other half of establishments (24,460) would manually submit each case from their establishment individually. Using the mean of 14.7 cases per establishment (718,386 total cases divided by 48,919 total establishments) and an estimated time of 10 minutes per case, OSHA estimated 147 minutes per establishment to submit records electronically, on an individual case basis. This produced a total cost for manual submission of $3,649,520 [(24,460 establishments) × (0.17 hours/case) ^[36] × (14.7 cases) × ($60.96/hour)], or $149 per establishment]. Finally, OSHA summed the estimated batch-file submissions ($248,517) and manual submission ($3,649,520), which resulted in estimated total cost of $3,898,037 to submit the 718,316 records.

Dow, the Chamber of Commerce, and the Phylmar Regulatory Roundtable (PRR) commented that OSHA is underestimating the amount of time required for an establishment to submit Form 300A information (Docket IDs 0054, 0088, 0094). Dow said that establishments must spend time to “locate the website, create an account, retrieve password, read instructions, gather, and prepare incident information etc.” (Docket ID 0054). The commenter indicated that it would take more than 10 minutes per case per establishment. Specifically, it would take 1–2 hours to prepare the submission, and 15–20 minutes per case to input the information because there are more than 25 fields that must be filled in. Dow added that when the submission is completed via batch file, 1–2 hours is required to generate and review the reports for submission, even if it only takes 10 minutes to actually upload the 300A data. It asserted that this time estimate will only increase with additional forms (Docket ID 0054).

The Chamber of Commerce commented that OSHA's reporting burden estimate of 10 minutes per case is not based on empirical data. It indicated that this reporting burden should be inclusive of the following activities: compiling, analyzing, preparing, reviewing internally, and submitting the data electronically. The Chamber's estimate was 60 minutes per case using a blended management and professional rate. It maintained that its higher time estimate accounted for the “necessity for internal review of each case and of the final compiled reports by various levels of management and internal legal counsel.” The Chamber added that its “more realistic estimate of aggregate internal labor time for preparation and review increases the previous calculation of $11.9 million to $71.1 million. (718,386 cases × 60 minutes per case × $1.65 per minute).” Finally, the Chamber suggested that firms would need to hire outside legal counsel to complete their review process which the Chamber estimated would increase costs by $4.8 million ($6.67 per minute of outside legal counsel time) for the total estimated 718,386 cases (Docket ID 0088).

The National Federation of Independent Businesses and the Precision Machined Products Association commented on the differences in small and medium employers compared to large employers (Docket IDs 0036, 0055). These commenters noted that small and medium employers typically cannot afford the experts, accountants, and lawyers needed to comply with regulations. Additionally, they asserted that small and medium employers do not have the resources or technology to submit batch files and therefore must manually input each case. The Precision Machined Products Association added that the cost per submission for small and medium companies is closer to double what OSHA estimated in the PEA (Docket ID 0055).

The North American Meat Institute, the Plastics Industry Association, the Employers E-Recordkeeping Coalition, and the Chamber of Commerce specifically cited time spent on quality assurance as a concern (Docket IDs 0070, 0086, 0087, and 0088). The Plastics Industry Association wrote that “the cost of quality assurance procedures necessary to ensure compliance with a proposed rule must be treated as a component of the burden hours required by the rule. The audit is, in effect, not a voluntary measure, but one that needs to be incurred to ensure compliance and avoid over-reporting” (Docket ID 0086). The Chamber of Commerce focused on the risk associated with publicly posting these injury and illness records, which in turn would result in increased “pre-submission due diligence” (Docket ID 0088).

OSHA concludes that more information must be submitted from the Form 300 Log and Form 301 Incident Report than from the Form 300A Annual Summary. Therefore, the agency is adjusting the estimated time required to manually submit electronic records from 10 minutes per case per establishment to 15 minutes per case per establishment. Given the additional amount of information required, OSHA believes that a 50 percent increase in the burden estimate is sufficient. OSHA notes, however, that employers are likely to spend less time, because employers will likely only copy and paste information from existing forms into the fields in OSHA's ITA. Employers for which it takes longer per case to submit the information could choose instead to transmit all their data in one batch-file submission.

OSHA disagrees with commenters' assertions that the final rule necessitates the use of additional experts, accountants, senior managers, physicians, or lawyers beyond those employers currently engage to comply with existing recordkeeping and submission requirements under part 1904. The final rule does not change employer obligations beyond the requirement that establishments electronically submit specific illness and injury information that the establishment already records. Furthermore, there is a requirement in § 1904.32 for employers to verify the entries on the Form 300 Log to ensure that they are complete and accurate. Section 1904.32 also requires a company executive to certify the Form 300A once it is completed, by examining the Form 300 Log. Costs to perform these verification and certification tasks were accounted for in the previous rule that imposed these requirements (see 66 FR 6092–93). Thus, OSHA's expectation is that employers have already taken measures to ensure the information employers have recorded and will be submitted is accurate. Any due diligence or audit measures an establishment chooses to take should predate this rule and should not be attributed as an additional cost specific to this rule. Finally, OSHA's estimate of an hourly wage for the recordkeeper submitting the data is based on the assumption that this task is performed by a safety and health specialist who is already familiar with the establishment's safety and health records.

While OSHA is not requiring submission via batch filing, OSHA disagrees that smaller companies affected by this rule do not have the capability to do batch file submissions. Currently, approximately half of all establishments that are required to submit their records electronically do so using batch files, and an analysis of that information shows that smaller establishments actually use batch file submission more frequently than some categories of larger establishments.^[37] Further, OSHA believes that the time estimated to manually upload the required information is appropriate for small, medium, and large employers. It is also worth reiterating that the new requirement to submit data from the Form 300 and Form 301 only affects establishments with more than 100 employees, so the smallest employers are not affected.

A couple of commenters argued that OSHA should account for additional costs for compliance due to the necessity of maintaining two sets of records as a result of the final rule's submission requirements (Docket IDs 0042, 0058). As the Louisiana Chemical Association said, “[b]esides the out-of-pocket expenses associated with compliance, there are other administrative burdens, for example, the duplicative work of maintaining two sets of 300 and 301 forms (a hard copy and one form for electronic submission with redacted information)” (Docket ID 0042).

This rule does not, however, require duplicative recordkeeping. As noted in Section III.B of the Summary and Explanation, OSHA cautions employers against including personally identifiable information on the Forms 300 and 301 when they initially fill out those forms. The forms themselves contain language about confidentiality of personal information and indicate that PII should not be included. To the extent employers choose to include PII on those forms despite these warnings, it is per a decision by the employer. Such data can be excluded during data submission to the extent it is on the employer's forms. Furthermore, as described elsewhere in this preamble, OSHA is taking multiple steps to protect against the publication of any information that could reasonably be expected to identify individuals directly, including not collecting certain information and using de-identification software to remove any such information that is submitted by employers.

OSHA has decided to retain the methodology from the PEA for estimating the cost of data submission but has added an additional 5 minutes (an increase from 10 to 15) per submitted case for establishments that do not submit batch files and has updated other data to more recent figures. Using the updated data in Table 2, above, OSHA calculated a new average cost per establishment for batch file submitters of $10.22 per establishment. Additionally, OSHA calculated an updated cost to those submitting manually of $242.41 per establishment. That yields a total cost for electronic submission of OSHA Forms 300 and 301 of $133.46 per establishment on average,^[38] or a total of $6.9 million annually, to submit the currently estimated 766,257 records.

The calculations above are based on an estimated 52,092 establishments reporting 766,257 cases total, or 15.82 cases per establishment submitting manually and 13.48 cases per establishment reporting with batch-files. An estimated 47 percent of all reporting establishments (24,668) submitting via batch file would submit 43 percent of the total cases (332,498 cases), at an estimated total cost of $252,048 [(24,668 establishments) × (0.17 hours/establishment) ^[39] × ($61.31/hour)], or $10.22 per establishment on average for batch file submission. For the other 53 percent of establishments (27,424) that OSHA estimates would manually submit each case, using OSHA's assumption of a mean of 15.82 cases per establishment and the increased time of 15 minutes per case, the result is an estimated 237 minutes per establishment to submit their information electronically each year. This produces a total cost for manual submission of $6,647,982 [(27,424 establishments) × (0.25 hours/case) ^[40] × (15.82 cases) × ($61.31/hour)], or $242.41 per establishment for manual submission.

As suggested in the PEA, the agency believes that this approach likely overestimates costs, because while OSHA's estimates reflect manual entry of the data for nearly half of establishments, in the agency's experience, as indicated previously, nearly half of the covered establishments were already submitting data to the ITA by uploading a batch file in 2019. This percentage will likely increase over time as a result of this rule. As indicated elsewhere in the FEA, OSHA expects more of the cases to be submitted by batch file once this rule goes into effect, because OSHA expects companies with many establishments and/or many cases will have computer systems that can export their part 1904 injury and illness recordkeeping data into an easily uploaded file format.^[41]

The agency notes that some establishments will have no recordable injuries or illnesses in a given year; thus, their time and cost burden for submission under this rule will be zero. In contrast, establishments with many recordable injuries and illnesses could have a time burden of significantly more than the average of about four hours if they enter the data manually. OSHA believes that establishments with many cases are likely to submit a single batch file, while establishments that only have a few cases are more likely to submit cases manually than by batch file.^[42]

5. Custom Forms

OSHA received multiple comments regarding the difficulty of submitting electronic records when the establishments use custom forms for their recordkeeping. The International Bottled Water Association, the Plastics Industry Association, the Employers E-Recordkeeping Coalition, and the Phylmar Regulatory Roundtable (PRR) explained that forms such as California Form 502025 require most, or all of, the same information as the OSHA forms (Docket IDs 0076, 0086, 0087, 0094). PRR noted that forms such as 502025 contain other information that is PII and are organized differently, both of which mean that manual entry will take longer than 10 minutes (Docket ID 0094). PRR added that significant additional time is required to review and ensure PII and sensitive information is not included. The North American Meat Institute said that current use of other forms would require significant administrative burden to translate the required information into the online form (Docket ID 0070).

OSHA notes that § 1904.29(a) states that employers must use the OSHA 300 Log, 301 Incident Report, and 300A Annual Summary—or equivalent forms—when recording injuries and illnesses under part 1904. Section 1904.29(b)(4) further states that an equivalent form is one that has the same information, is just as readable and understandable, and is completed using the same instructions as the OSHA form it replaces. As discussed earlier in the summary and explanation of the rule, OSHA acknowledges that while it may be possible to avoid duplication in recording by reliance on equivalent forms, it will be necessary in some cases for reporting to re-enter that information into a system that is compatible with OSHA's system. OSHA is aware, for instance, that for reporting, many employers use an insurance form instead of the Form 300 or the Form 301 or supplement an insurance form by adding any additional information required by OSHA. The agency notes, however, that use of a custom form for recordkeeping does not change the information the employer copies into the electronic system to comply with OSHA data submission requirements, including the submission requirements included in this final rule. To the extent that an insurance form or other form includes information not relevant to OSHA reporting, it would not increase the time and cost for OSHA reporting. Where relevant, the employer may just skip inapplicable sections of a custom form when submitting their information to OSHA. Therefore, the time for transmitting the information from the Forms 300 and 301 is just the time to manually copy the required information into OSHA's system, regardless of which form the information is recorded on initially. In addition, the use of custom forms that can capture information for multiple purposes does not prevent employers from designing those forms so that they can export the appropriate data and submit their data to OSHA via batch file.

While OSHA did not find compelling evidence to increase the estimated compliance costs based on potential difficulties companies face from using custom forms, the agency has increased, by 50 percent, the estimated time it takes to submit records manually in response to comments received on other issues. This increased time could be considered as accounting for costs associated with using custom forms in the event employers face costs due to this issue. Elements of this discussion run parallel to and may interface with the discussion of potential software upgrades, discussed below.

6. Batch-File Submissions

In the PEA, OSHA estimated that half of all respondents would upload their logs in one batch-file submission. The Strategic Organizing Center (SOC) expressed strong agreement with OSHA's assumption that larger, more sophisticated users will use batch file submission (Docket ID 0079). It added that OSHA's cost estimates, which rely on this assumption, are appropriate and that OSHA is correct to not assume widespread use of manual-entry submission. Further, SOC agreed that OSHA's assumption that half of employers will submit records manually “may result in an overestimate of the total and per-establishment costs of this part of the proposed rule” (Docket ID 0079).

The Chamber of Commerce disagreed with OSHA's PEA assumption that half of the 48,919 affected establishments will be able to “drastically reduce their report submission times and costs by using a `batch' process of submitting multiple individual case records through an electronic portal that OSHA will provide.” Specifically, it stated that the assumption is not realistic because the portal has not yet been built or tested. The Chamber further argued that it would be more reasonable to assume, at least for the first year of submission and maybe for subsequent years, that “all 48,919 affected establishments will upload the required case information manually or will have to delete various fields to accommodate data OSHA does not want to collect.” This would double the cost of data submission (Docket ID 0088).

Data from 2019 on usage of batch uploads for OSHA 300A information indicates that data for approximately 47 percent of establishments were already being submitted via batch files (Docket ID 0103). For the purposes of the FEA, OSHA estimates that the usage of batch files submissions will at least continue at the same rate as was the case in 2019 (47 percent). However, as noted above, OSHA believes it is likely that batch filing will increase as a result of the requirements associated with this rule. As a comment from the Laborers Health Safety Fund of North America emphasized, electronic recordkeeping and data submission is a more cost-effective way for establishments to meet OSHA standards (Docket ID 0080). Additionally, Eastern Research Group (ERG) (Docket ID 0105) interviewed a number of commercial aftermarket software vendors who remarked that the number of users of their software is rapidly growing.

Notwithstanding the agency's belief that electronic submission will become increasingly common, OSHA has decided to adjust its projected estimate from the PEA, that 50 percent of establishments would submit their Form 300 and Form 301 information via a single batch file, based on OSHA's analysis of existing data collected in 2019. These data show that approximately 47 percent ^[43] of establishments submitted their records by batch file in 2019. However, to the extent that more employers continue to adopt this time-saving technology, the cost of submission will decrease, and the average reporting costs will be below OSHA's cost estimate in this FEA.

7. Software/System Upgrades Needed

The PEA did not include a cost for employers to upgrade their systems in order to submit their files electronically or in batch files. OSHA received several comments on this topic. Electric Boat, the International Bottled Water Association, and the Employers E-Recordkeeping Coalition indicated that software currently used by employers does not easily facilitate transmission of 300 and 301 information to OSHA (Docket IDs 0028, 0076, 0087). The Employers E-Recordkeeping Coalition stated that the “costs to modify the internal software, purchase new software, automate injury and illness recordkeeping, audit the records, and in many instances, manually key in huge volumes of data would cost hundreds of thousands of dollars” (Docket ID 0087). Electric Boat stated that proprietary recordkeeping software for OSHA logs is not compatible with requirements to upload to OSHA and that large companies may have many cases in their logs. It further maintained that a requirement to manually enter data for each case would be “very difficult, costly and potentially inaccurate due to transcription errors” (Docket ID 0028). For employers not currently using software, Electric Boat surmised that information for the Form 301 incident report is often recorded on handwritten forms at individual establishments, and thus the time and resources needed to transition to a fully automated system would be considerable.

The U.S. Poultry and Egg Association, the Employers E-Recordkeeping Coalition, the Chamber of Commerce, the National Retail Federation, and the Flexible Packaging Association, and Phylmar Regulatory Roundtable wrote about increased costs due to either reprogramming recordkeeping software to meet OSHA's format or investing in new software altogether (Docket IDs 0053, 0087, 0088, 0090, 0091, 0094). The U.S. Poultry and Egg Association commented that OSHA's analysis “does not consider that some employers utilize proprietary electronic recordkeeping systems that would require program changes, possibly at a high cost, so that the information could be electronically submitted to OSHA” (Docket ID 0053). The Phylmar Regulatory Roundtable (Docket ID 0094) stated that two or three days of labor would be necessary to reconfigure the coding and modify programs currently used to electronically upload Form 300A to include submission of Forms 300 and 301. The Chamber of Commerce addressed the issue of small businesses that do not have electronic recordkeeping programs in place and was concerned that small businesses would not be able to afford the software (Docket ID 0088).

OSHA believes that employers who use custom software for their recordkeeping will incur some, though limited, additional costs to upgrade custom computer systems. OSHA also believes that employers who use commercially available software are unlikely to incur any costs.^[44] Many establishments required to submit injury and illness data from their Form 300A already use software to submit that data.^[45] The larger employers that have created their own custom software, instead of relying on commercially available software, likely have IT employees already on staff that conduct system upgrades as part of their daily routine. For these companies, existing IT staff can conduct any software upgrades needed, and OSHA has included a discussion of these costs below. If upgrading systems is cost prohibitive for an establishment, the establishment can still submit the required information from their part 1904 forms manually, which is accounted for in OSHA's estimates.

Nonetheless, after a full consideration of comments, and notwithstanding the possibility that switching to commercial aftermarket software might be more economical, OSHA recognizes that there may be an incremental cost to modifying custom software unique to the rule. While comments provided limited guidance on what the cost of updating software may be, including how many firms might be affected, the agency determined that 20 hours of reprogramming is a reasonable time for the task (Docket ID 0104). This estimate also corresponds to the estimate submitted in the comment by the Phylmar Regulatory Roundtable of 2–3 days (Docket ID 0094).^[46]

OSHA also estimates that the group of firms affected by the custom software modification costs is a limited set. OSHA found that approximately 40 percent of employers who must report injuries currently already use software to report the files,^[47] and the number is growing. The agency believes the set of firms using customized software to report cases is not a randomly distributed group but sorts heavily by the size of the firm. The agency examined the current universe of firms currently electronically batch-filing injury reports via its ITA system and found that of the 716 firms reporting for affected establishments, approximately 36 percent are reporting for only one establishment (Docket ID 0106). OSHA believes the cost of updating custom software would predominantly affect only the other 64 percent of firms (456) that represent more than one establishment and report data using batch files (ITA cite). Those 456 firms also account for a disproportionate number of cases reported to the agency. For those 456 firms to upgrade their software, the agency assumes that this work would be performed by a software engineer at the wage rate ($94.19) referenced in Table 2. The FEA therefore calculated the cost of custom software as $859,042 [(456 firms) × (20 hours) × ($94.19/hour)], or $122,308 annualized over 10 years at a 7 percent discount rate.^[48]

As indicated previously, employers are not required to modify their software to comply with the standard, but for very large employers, this might be their least-cost method for compliance. As laid out earlier in the analysis, other employers might decide that for purposes of OSHA compliance, it makes more sense to employ commercially available software, or even manually enter the cases. Therefore, issues of software modification do not raise questions of technological feasibility, as discussed later in the analysis, nor do they pose questions of economic feasibility.

8. Other Costs

OSHA also received comments on other potential cost items, addressed below.

a. Harm to Reputation

OSHA received multiple comments stating that OSHA should include costs to capture the argued negative reputational effects to companies after OSHA publishes their illness and injury information. The Plastics Industry Association and the Chamber of Commerce commented on the potential liabilities associated with publishing these work-related injury reports (Docket IDs 0086, 0088). The Plastics Industry Association noted the “unknown consequences of public shaming and misuse of the information” that could lead to reputational damage (Docket ID 0086).

Related comments are covered in Section III.G of the Summary and Explanation, but the agency emphasizes here that there is insufficient basis for altering the economic analysis to reflect this issue. Regarding reputational and civil liability damages, OSHA disagrees that the mere posting of injury and illness recordkeeping data on a publicly available website will adversely impact an employer's reputation. As the Note to § 1904.0 of OSHA's recordkeeping regulation makes clear, the recording or reporting of a work-related injury, illness, or fatality does not mean that an employer or employee was at fault, that an OSHA rule has been violated, or that the employee is eligible for workers' compensation or other benefits. In addition, OSHA already publishes data from the Form 300A that is collected through the ITA, as well as establishment-specific, case-specific information about reported work-related fatalities, hospitalizations, amputations, and losses of an eye (see https://www.osha.gov/​severeinjury and https://www.osha.gov/​fatalities). Despite online publication of this information for a number of years, commenters did not provide any examples of harm to reputation occurring as a result, nor did they provide any examples of misuse of the data that has already been published.

b. Additional Time Needed To Review for PII

As an adjunct to the earlier discussion regarding quality assurance concerns and the appropriate wage rate for the cost of submitting cases, some commenters also suggested that it will take additional time to remove PII from case files before they are submitted. As in that discussion, OSHA reiterates that this is an action that should already be addressed when the cases are recorded under existing practices to meet existing recordkeeping requirements at § 1904.4, § 1904.29, and § 1904.41.^[49] Therefore, this is not a new cost of this rule, and the agency is not including cost for privacy checks in the Final Economic Analysis.

c. Company Name

One commenter, the National Demolition Association, stated that the final rule's new requirement for establishments to submit their company name as part of their data submissions would impose an additional administrative and financial burden on employers. This commenter argued that the requirement, which is in final § 1904.41(b)(10), “would be particularly onerous and complex for employers who have multiple establishments and limited staff resources to comply with the additional administrative paperwork and reporting requirements” (Docket ID 0060).

Submission of an establishment's company name is not expected to be particularly time consuming. First, most establishments are already including their company names as part of their 300A data submissions, so this new requirement will only affect

establishments that are using only codes to identify their establishments. Second, establishments that are not already submitting their company name only have to input that one additional field, and they have to do that only one time if they are doing a batch file submission ( i.e., once per batch file).^[50] Regardless, the time necessary to include the company name is included in the 15 minutes OSHA has estimated as the time necessary to complete one submission.^[51]

d. Training Costs

The U.S. Poultry and Egg Association, Dow, the North American Meat Institute, the Motor and Equipment Manufacturers Association, the Chamber of Commerce, and the National Retail Federation commented that training costs should be included in the cost analysis (Docket IDs 0053, 0054, 0070, 0088, 0090). The U.S. Poultry and Egg Association wrote that the analysis “does not consider additional training of staff that might be required, nor does the rule consider costs associated with training existing and new staff on the variety of state and federal privacy laws that could be impacted by employers now knowing that the information they submit will necessarily be made available worldwide” (Docket ID 0053). The Chamber of Commerce commented on the need for training managers on how to comply with reporting formats, schedules, and procedures, as well as training for additional staff “to cover multiple shifts, absences, and internal review needs.” The Chamber further stated that time would be needed to “train administrative and operational employees in their new compliance duties” (Docket ID 0088).

OSHA concludes that additional training should not be necessary either to fill in a web form with information that has already been recorded, or to transmit records from an existing electronic recordkeeping system with which the employee is already familiar. Employees have already been trained on how to record injuries and illnesses on the Forms 300 and 301, pursuant to other previously existing requirements under part 1904. Thus, OSHA has already accounted for the time required to learn how to keep the records themselves. Any time required to learn how to submit the Form 300 and Form 301 data to the ITA (the only new requirement in this rule) is already included in OSHA's rule familiarization time estimate, described above.^[52]

D. Effect on Prices

An anonymous commenter commented, “This is unnecessary overreach which is going to cost employers and cost the tax payers additional resources to process the collected data . . . It will only cost employers more, who will charge the consumer more” (Docket ID 0025). OSHA disagrees. As discussed throughout this section, the costs to comply with the final rule for individual employers are expected to be about $136 per establishment to submit the Form 300 and 301 data. Costs at this level of magnitude are not expected to lead to price increases or raise issues of economic feasibility.^[53]

E. Budget Costs to the Government

In the PEA, OSHA included an estimate of the costs of the new requirement to the government because these costs represent a significant fraction of the total costs of the new requirement. OSHA received estimates for the costs from the U.S. Department of Labor Office of the Chief Information Officer (DOL OCIO). OSHA estimated that modification of the reporting system hardware and software infrastructure to accept submissions of Form 300 and 301 data would have an initial one-time cost of $1.2 million. If annualized over 10 years at a 7 percent discount rate, the $1.2 million total cost would equal $170,853 per year, or if annualized at 3 percent, it would be $140,677 per year. The agency also estimated $201,128 as the annual cost of additional IT transactions necessary to implement this rule ($0.28 per case times 718,316 cases for additional internal IT support services). Finally, OSHA estimated that annual help desk support costs would increase by $25,000. This estimate was based on the annual help desk support costs under the 300A submission provisions. This resulted in a total cost to the government, annualized over 10 years at a 7 percent rate, of $397,001.^[54]

OSHA sought comment on this methodology and cost estimate and received no responses. After consideration, OSHA has decided to maintain the framework used in the proposal but has updated the estimate to account for the current wage rate indicated in Table 2, above. Therefore, OSHA retained the estimate of $1.2 million for the one-time cost of modifying the reporting system hardware and software infrastructure to accept submissions of Form 300 and 301 data. If annualized over 10 years at a 7 percent discount rate, the $1.2 million total cost would equal $170,853 per year. If annualized at 3 percent, it would be $140,677 per year. The agency also estimated $128,716 as the annual cost of additional IT transactions necessary to implement this rule ($0.28 per case times 459,701 cases for additional internal IT support services). Next, the agency estimated $204,485, based on 2023 wages, for OSHA to hire an additional IT Specialist. Finally, OSHA estimated that annual help desk support costs will increase by $50,000. Summing these figures, and assuming a seven percent discount rate, results in a total annualized cost to the government of $554,054.

F. Total Cost

Summing the estimated batch-file submission ($252,048) and manual submission ($6,647,982) costs results in an estimated total cost of $6,900,030 to submit 766,257 records. Combined with the annualized cost of $75,781 per year for familiarization, and $122,308 for software upgrade cost to employers submitting batch-files using custom computer software, estimated above (at 7 percent), the estimated total annual private-sector cost of this part of the final rule is $7,098,120. To obtain the estimated average cost of submission per establishment of $136.26, OSHA divided the total estimated cost of submission ($7,098,120) by the estimated number of establishments that would be required to submit data (52,092 establishments). Total costs are detailed in Table 3, below.^[55 56]

Table 3—Total Cost Summary

Cost element	Annual cost	One-time cost
Annual electronic submission of OSHA Form 300 Log and OSHA Form 301 Incident Report by establishments with 100 or more employees in designated industries	$6,900,030	$0
One-Time Rule Familiarization Cost	NA	532,257
Annualized 10 yr at 7%	75,781	NA
Annualized 10 yr at 3%	62,397	NA
One-Time Software Upgrade	NA	859,042
Annualized 10 yr at 7%	122,308	NA
Annualized 10 yr at 3%	100,706	NA
Total Private Sector Costs * **	7,098,120	1,391,299
Average Cost per 52,092 Establishments	136	NA
Processing of annual electronic submissions of OSHA 300/301	128,360	0
Annual Contractor Software Support	50,000	0
Annual Government Software Support	204,485	0
One-Time Software Design and Development	NA	1,200,000
Annualized 10 yr at 7%	170,853	NA
Annualized 10 yr at 3%	140,677	NA
Total Government Costs * **	553,698	1,200,000
Total *	7,651,818	2,591,299
* One-time costs are annualized and appear in annual cost column; the one-time cost is not an additional cost.
** Annualized over 10 years at 7%.

G. Benefits

As explained in the PEA and elaborated on elsewhere in this preamble, in particular in Section III.B of the Summary and Explanation, the main purpose of the final rule is to prevent worker injuries and illnesses through the collection and use of timely, establishment- and case-specific injury and illness data. With the information obtained through this rule, OSHA, employers, employees, employee representatives, State and local agencies, consultants, and researchers will be better able to identify and mitigate workplace hazards and thereby prevent worker injuries and illnesses. The final rule will support OSHA's statutory directive to assure safe and healthful working conditions for working people by providing for appropriate reporting procedures regarding occupational safety and health that will help achieve the objectives of the OSH Act (29 U.S.C. 651(b); (b)(12)).

The number of workers in the U.S. who are injured or made ill on the job remains unacceptably high, and the importance of this final rule lies largely in increasing access to information to better enable OSHA and other organizations to prevent workplace injuries and illnesses. According to BLS's Survey of Occupational Injuries and Illnesses (SOII), in 2021, employees experienced 2.6 million recordable nonfatal injuries and illnesses at work.^[57] This number is widely recognized to be an undercount of the actual number of occupational injuries and illnesses that occur annually.^[58] As described extensively above in Section III.B of the Summary and Explanation, the final rule will increase the agency's ability to focus resources on those workplaces where workers are at greatest risk. Even with improved targeting, OSHA Compliance Safety and Health Officers can inspect only a small proportion of the nation's workplaces each year, and it would take many decades to inspect each covered workplace in the nation even once. As a result, to reduce worker injuries and illnesses, it is of great importance for OSHA to leverage its resources for workplace safety at the many thousands of establishments in which workers are being injured or made ill but which OSHA does not have the resources to inspect.

As discussed in more detail in Section III, Summary and Explanation, the final rule will help OSHA prevent worker injuries and illnesses by greatly expanding OSHA's access to the establishment-specific, case-specific information employers are already required to record under part 1904. The provisions requiring regular electronic submission of case-specific injury and illness data will allow OSHA to obtain a much larger data set of establishment-specific, case-specific information about injuries and illnesses in the workplace. This information will help OSHA use its enforcement and compliance assistance resources more effectively by enabling OSHA to identify the workplaces where workers are at greatest risk. In addition, OSHA will be able to use the information to identify emerging hazards, support an agency response, and reach out to employers whose workplaces might include those hazards.

In addition to OSHA obtaining better information, this information will be available to employers, employees, members of the public, employee representatives, trade associations, and workplace safety and health professionals, among others. This increased access and transparency of information about workplace injuries and illnesses can be used by all interested parties to better understand workplace hazards and improve occupational safety and health. OSHA also expects the information to improve research on the occurrence and prevention of workplace hazards, injuries, and illnesses.

In response to the PEA, the National Propane Gas Association and the Chamber of Commerce said that OSHA should quantify benefits for the rule (Docket IDs 0050, 0088, Attachments). The National Propane Gas Association stated that OSHA “does not provide any details as to how publicly available information could improve workplace safety” and argued that OSHA should “provide concrete benchmarks to define the safety improvements that the agency expects to be met by publicly accessible case-specific, establishment-specific information” (Docket ID 0050). The Chamber of Commerce said that OSHA “makes no attempt to estimate or quantify the purported economic benefits of this Proposed Rule; instead, it asserts that these benefits will `significantly exceed the annual costs,' ” going on to say that OSHA did not “explain how electronic quarterly reporting or the creation of a public database that will publish the private and confidential information of employers and employees will provide any increase in workplace safety” (Docket ID 0088).^[59]

The agency respectfully disagrees about quantifying the economic benefits. Quantifying benefits is not always feasible in practice. However, the infeasibility of quantifying benefits does not demonstrate a lack of benefits. In contrast to the occupational safety and health standards the agency promulgates, quantifying benefits for a recordkeeping regulation is particularly challenging.^[60] OSHA notes that the commenters did not attempt to themselves quantify the benefits of the proposed rule, nor did commenters propose any approach that would allow the agency to effectively quantify those benefits in order to compare them against the costs.

H. Economic Feasibility

In the PEA, OSHA preliminarily concluded that the proposed rule would be economically feasible and received no comment specifically on this conclusion. After further consideration, OSHA has concluded that the final rule will be economically feasible. Under the final rule, for establishments with 100 or more employees in the industries designated in appendix B, the average additional cost of electronically submitting information from the OSHA Forms 300 and 301 will be roughly $136 per year. These costs will not affect the economic viability of these establishments.

I. Regulatory Flexibility Certification

The requirement in the final rule requiring the electronic submission of Form 300 and 301 information from establishments with 100 or more employees in designated industries will affect some small entities, as determined by the definitions of small entity used by the Small Business Administration (SBA). In some sectors, such as construction, where SBA's definition only includes relatively smaller firms, there are unlikely to be many entities with establishments with 100 or more employees that meet SBA small entity definitions. In other sectors, such as manufacturing, many SBA-defined small entities will be subject to this rule. Thus, this part of the final rule will affect only a small percentage of all SBA-defined small entities.^[61] However, because some SBA-defined small entities will be affected, especially in manufacturing, OSHA has examined the impacts of this final rule on small businesses.

OSHA did not convene a Small Business Advocacy Review panel under the Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA Panel) for this rule. At least one commenter, the Chamber of Commerce, argued that OSHA should have convened a SBREFA Panel to further evaluate the effect of the proposed rule on small businesses (Docket ID 0088). The commenter said that the panel was particularly important because “the vast majority of employers and establishments that will be affected by this Proposed Rule's electronic-only reporting requirements will be small businesses, many of which do not currently record injuries electronically.” This commenter offered no evidence to support its assertion that the majority of the employers and establishments affected would be small businesses, nor did it offer evidence that small businesses do not currently record injuries electronically.

OSHA considers the possibility of disproportionate impacts on small businesses when deciding whether a Small Business Advocacy Review (SBAR) panel is warranted. Because OSHA preliminarily determined that the proposed rule would not result in a significant impact on a substantial number of small businesses (see 87 FR 18553), OSHA determined that a SBREFA panel was not required for this rule. Nothing in the record has disturbed OSHA's preliminary determination that this rule will not have a significant impact on a substantial number of small businesses. Therefore, OSHA does not believe a SBREFA panel was required for this rule.

OSHA's typical procedure for assessing the significance of final rules on small businesses is to first determine if costs are greater than one percent of revenues or five percent of profits for the average firm. If so, OSHA conducts an additional assessment. To meet this level of significance at an estimated annual average cost of $136 per affected establishment per year (including annualized familiarization costs), annual revenues for an establishment with 100 or more employees would have to be less than $13,627 (or less than $136 per employee, assuming 100 employees), and annual profits would have to be less than $2,725 (or less than $28 per employee, assuming 100 employees). There are no impacted industries that have average revenues of less than $13,627.^[62] Furthermore, integrating those data with profit data from the 2013 Corporation Source Book ^[63] indicates there are no impacted industries earning less than $2,725 in profit per establishment among establishments with 5 or more employees.^[64] These are extremely unlikely combinations of revenues and profits for firms of this size and would only occur for a very small number of firms in severe financial distress. As indicated, OSHA's cost estimates would have to be in error by more than an order of magnitude to reach these thresholds.^[65]

As a result of these considerations, per Section 605 of the Regulatory Flexibility Act (5 U.S.C. 605), OSHA certifies that the final rule will not have a significant economic impact on a substantial number of small entities. Thus, OSHA has not prepared a final regulatory flexibility analysis.

V. OMB Review Under the Paperwork Reduction Act of 1995

A. Overview

The final “Improve Tracking Workplace Injury and Illness” rule contains information collection (paperwork) requirements that are subject to review by the Office of Management and Budget (OMB) under the Paperwork Reduction Act of 1995 (PRA), 44 U.S.C. 3501 et seq., and OMB regulations, 5 CFR part 1320. The PRA defines a collection of information as “the obtaining, causing to be obtained, soliciting, or requiring the disclosure to third parties or the public, of facts or opinions by or for an agency, regardless of form or format.” 44 U.S.C. 3502(3)(A). The aforementioned regulations mandate that the Department consider the impact of paperwork and other information collection burdens imposed on the public. Under the PRA, a Federal agency generally cannot conduct or sponsor a collection of information and the public will generally not be penalized for not responding to an information collection, unless it is approved by OMB and the agency displays a currently valid OMB Control Number. See 44 U.S.C. 3507 and 3512, 5 CFR 1320.5(a) and 1320.6.

On March 30, 2022, OSHA published a notice of proposed rulemaking (NPRM) (87 FR 18528) to amend its occupational injury and illness recordkeeping regulation to require establishments with 100 or more employees in certain designated industries to be able to electronically submit information from their OSHA Forms 300, 301, and 300A once a year. OSHA prepared and submitted an Information Collection Request (ICR) to OMB, proposing to revise certain collection requirements currently contained in the package, as required under 44 U.S.C. 3507(d). The proposed rule invited the public to submit comments to OMB, in addition to OSHA, on the proposed collections of information. On May 25, 2022, OSHA published a second Federal Register notice (87 FR 31793), extending the comment period to allow the public an additional 30 days to comment on the proposed rule and the information collection requirements contained in the proposed rule. OSHA received 87 public comments.

In accordance with the PRA (44 U.S.C. 3506(c)(2)), OSHA solicited public comments on the collection of information contained in the 2022 proposed rule. OSHA encouraged commenters to submit their comments on the information collection requirements contained in the proposed rule under docket number OSHA–2021–0006, along with their comments on other parts of the proposed rule. In addition to generally soliciting comments on the collection of information requirements, the proposed rule indicated that OSHA and OMB were particularly interested in comments that addressed the following:

• Whether the collection of information is necessary for the proper performance of the agency's functions, including whether the information is useful;
• The accuracy of OSHA's estimate of the burden (time and cost) of the collection of information, including the validity of the methodology and assumptions used;
• The quality, utility, and clarity of the information collected; and
• Ways to minimize the compliance burden on employers, for example, by using automated or other technological techniques for collecting and transmitting information.

On May 5, 2022, OMB issued a Notice of Action (NOA) assigning the proposal's ICR a new control number, 1218–0279, to be used in future ICR submissions. OMB noted that this action had no effect on any current approvals. OMB also noted that the NOA is not an approval to conduct or sponsor the information collection contained in the revision proposal. Finally, OMB requested that, “[p]rior to publication of the final rule, [OSHA] should provide a summary of any comments related to the information collection and their response, including any changes made to the ICR as a result of comments. In addition, the agency must enter the correct burden estimates.” OSHA did not receive any comments in response to the proposed ICR submitted to OMB for review. However, the agency did receive 87 comments related to the proposed rule.

Concurrent with publication of this final rule, the Department of Labor submitted the final ICR, containing the full analysis and description of the burden hours and costs associated with the final rule, to OMB for approval. A copy of this ICR is available at http://www.reginfo.gov/​public/​do/​PRAOMBHistory?​ombControlNumber=​1218-0279 (this link will become active on the day following publication of the final rule). OSHA will publish a separate notice in the Federal Register that will announce the results of that review. This notice will also include a list of OMB-approved information collection requirements and total burden hours and costs imposed by the new regulation.

B. Summary of Information Collection Requirements

As required by 5 CFR 1320.5(a)(1)(iv) and 1320.8(d)(2), the following paragraphs provide information about this ICR.

1. Title: Improve Tracking Workplace Injury and Illness.

2. Description of the ICR: This final rule revises the currently approved Recordkeeping and Reporting Occupational Injuries and Illnesses Information Collection and changes the existing information collection requirements currently approved by OMB.

3. Brief Summary of the Information Collection Requirements.

Under “Information Requirements on Recordkeeping and Reporting Occupational Injuries and Illnesses,” OMB Control Number 1218–0176, OSHA currently has OMB approval to conduct an information collection that requires covered employers to, among other things, record each recordable employee injury and illness on an OSHA Form 300, which is the “Log of Work-Related Injuries and Illnesses,” or equivalent. In addition, employers must also prepare a supplementary OSHA Form 301 “Injury and Illness Incident Report” or equivalent that provides additional details about each case recorded on the OSHA Form 300, and, at the end of each year, employers are required to prepare a summary report of all injuries and illnesses on the OSHA Form 300A, which is the “Summary of Work-Related Injuries and Illnesses,” and post the form in a visible location in the workplace.

Under 29 CFR 1904.41, certain employers were only required to electronically submit injury and illness information from their OSHA Forms 300A (the summary) annually. OSHA did not receive establishment-specific, case-specific, injury and illness data. For the purposes of the PRA, the final rule makes two changes to § 1904.41.

First, OSHA newly requires all establishments that have 100 or more employees and are in certain designated industries to electronically submit information from the OSHA Form 300 and 301 to OSHA or OSHA's designee. This is in addition to the current requirement for these establishments to electronically submit information from the OSHA Form 300A. Each establishment subject to this provision will require time to familiarize themselves with the reporting website. This change is similar to requirements contained in OSHA's Improve Tracking of Workplace Injuries and Illnesses final rule, 81 FR 29624 (May 12, 2016) which were removed by the Tracking of Workplace Injuries and Illnesses final rule, 84 FR 380 (January 25, 2019).

Second, OSHA newly requires establishments that are required to electronically report information from their injury and illness records to OSHA under part 1904, to include their company name as part of the submission. No additional paperwork burden is associated with the provision.

In addition, Docket exhibit OSHA–2021–006–0004 shows an example of an expanded interface to collect case-specific data. Screenshots of this interface can also be viewed on OSHA's website at http://www.osha.gov/​recordkeeping/​proposed_​data_​form.html.

4. OMB Control Number: 1218–0279 .

5. Affected Public: Business or other for-profit.

6. Total Estimated Number of Respondents: 52,092.

7. Frequency of Responses: Annually.

8. Total Estimated Number of Responses: 475,943.

9. Average Time per Response: Average time per response varies from 10 minutes for establishments using batch file submission to 237 minutes for establishments using manual submission.

10. Total Estimated Annualized Burden Hours): 118,485.

11. Total Estimated Costs (Capital-Operation and Maintenance): 0.

VI. Unfunded Mandates

OSHA reviewed this final rule according to the Unfunded Mandates Reform Act of 1995 (UMRA) (2 U.S.C. 1501 et seq.), as well as Executive Order 13132 (64 FR 43255 (Aug. 4, 1999)). As discussed above in Section IV, Final Economic Analysis, the agency has determined that this final rule does not include any Federal mandate that may result in increased expenditures by State, local, and Tribal governments, or increased expenditures by the private sector, of $100 million or more in any one year. In addition, OSHA's regulations do not apply to State and local governments except in States that have elected voluntarily to adopt a State Plan approved by OSHA. Consequently, this final rule does not meet the definition of a “federal intergovernmental mandate” (see 2 U.S.C. 1502, 658(5)). Therefore, for the purposes of the UMRA, the agency certifies that this final rule does not mandate that State, local, or Tribal governments adopt new, unfunded regulatory obligations of, or increase expenditures by the private sector by, $100 million or more in any year.

VII. Federalism

OSHA reviewed this final rule in accordance with Executive Order 13132 (64 FR 43255 (Aug. 4, 1999)), regarding federalism. E.O. 13132 requires that Federal agencies, to the extent possible, refrain from limiting State policy options, consult with States before taking actions that would restrict States' policy options, and take such actions only when clear constitutional authority exists and the problem is of national scope.

Section 18(a) of the OSH Act states that nothing in the Act shall prevent any State agency or court from asserting jurisdiction under State law over an occupational safety or health issue with respect to which no standard is in effect under Section 6 of the Act (29 U.S.C. 667(a)). Because this rulemaking involves a “regulation” issued under Sections 8 and 24 of the OSH Act (29 U.S.C. 657, 673), and not an “occupational safety and health standard” issued under Section 6 of the OSH Act (29 U.S.C. 655), the rule will not preempt State law under Section 18(a) (see 29 U.S.C. 667(a)). The effect of the final rule on States and territories with OSHA-approved occupational safety and health State Plans is discussed in Section VIII, State Plans.

VIII. State Plans

Pursuant to Section 18 of the OSH Act (29 U.S.C. 667) and the requirements of 29 CFR 1904.37, 1902.3(j), 1902.7, 1953.4(b), and 1956.10(i), within 6 months after publication of the final OSHA rule, State Plans must promulgate occupational injury and illness recording and reporting requirements that are substantially identical to those in 29 CFR part 1904. State Plans must have the same requirements as Federal OSHA for determining which injuries and illnesses are recordable and how they are recorded (29 CFR 1904.37(b)(1)). All other part 1904 injury and illness recording and reporting requirements (for example, industry exemptions, reporting of fatalities and hospitalizations, record retention, or employee involvement) that are promulgated by State Plans may be more stringent than, or supplemental to, the Federal requirements, but, because of the unique nature of the national recordkeeping program, States must consult with OSHA and obtain approval of such additional or more stringent reporting and recording requirements to ensure that they will not interfere with uniform reporting objectives (29 CFR 1904.37(b)(2)).

There are 29 State Plans. The States and territories that cover both private sector and public sector employers are Alaska, Arizona, California, Hawaii, Indiana, Iowa, Kentucky, Maryland, Michigan, Minnesota, Nevada, New Mexico, North Carolina, Oregon, Puerto Rico, South Carolina, Tennessee, Utah, Vermont, Virginia, Washington, and Wyoming. Connecticut, Illinois, Maine, Massachusetts, New Jersey, New York, and the Virgin Islands have OSHA-approved State Plans that apply to State and local government employees only.

IX. National Environmental Policy Act

OSHA has reviewed the provisions of this final rule in accordance with the requirements of the National Environmental Policy Act (NEPA) of 1969 (42 U.S.C. 4321 et seq.), the Council on Environmental Quality (CEQ) NEPA regulations (40 CFR parts 1500–1508), and the Department of Labor's NEPA Procedures (29 CFR part 11). As a result of this review, OSHA has determined that the final rule will have no significant adverse effect on air, water, or soil quality, plant or animal life, use of land, or other aspects of the environment.

X. Consultation and Coordination With Indian Tribal Governments

OSHA reviewed this final rule in accordance with Executive Order 13175 (65 FR 67249 (Nov. 9, 2000)) and determined that it does not have “tribal implications” as defined in that order. The rule does not have substantial direct effects on one or more Indian Tribes, on the relationship between the Federal Government and Indian Tribes, or on the distribution of power and responsibilities between the Federal Government and Indian Tribes.

List of Subjects in 29 CFR Part 1904

• Health statistics
• Occupational safety and health
• Reporting and recordkeeping requirements

Authority and Signature

This document was prepared under the direction of Douglas L. Parker, Assistant Secretary of Labor for Occupational Safety and Health, U.S. Department of Labor, 200 Constitution Avenue NW, Washington, DC 20210. It is issued under Sections 8 and 24 of the Occupational Safety and Health Act (29 U.S.C. 657, 673), Section 553 of the Administrative Procedure Act (5 U.S.C. 553), and Secretary of Labor's Order No. 8–2020 (85 FR 58393 (Sept. 18, 2020)).

Signed at Washington, DC, on July 12, 2023.

Douglas L. Parker,

Assistant Secretary of Labor for Occupational Safety and Health.

For the reasons stated in the preamble, OSHA amends part 1904 of chapter XVII of title 29 as follows:

PART 1904—[AMENDED]

Subpart E—Reporting Fatality, Injury and Illness Information to the Government

1. The authority citation for part 1904, subpart E, is revised to read as follows:

Authority: 29 U.S.C. 657, 673, 5 U.S.C. 553, and Secretary of Labor's Order No. 08–2020 (85 FR 58393, Sept. 18, 2020) or 1–2012 (77 FR 3912, Jan. 25, 2012), as applicable.

2. Amend § 1904.41 as follows:

a. Revise paragraphs (a)(1) and (2) and (b)(1);

b. Add paragraphs (b)(9) and (10); and

c. Revise paragraph (c).

The revisions and additions read as follows:

§ 1904.41

Electronic submission of Employer Identification Number (EIN) and injury and illness records to OSHA.

* * * * *

(a) * * *

(1) Annual electronic submission of information from OSHA Form 300A Summary of Work-Related Injuries and Illnesses. (i) If your establishment had 20–249 employees at any time during the previous calendar year, and your establishment is classified in an industry listed in appendix A to subpart E of this part, then you must electronically submit information from OSHA Form 300A Summary of Work-Related Injuries and Illnesses to OSHA or OSHA's designee. You must submit the information once a year, no later than the date listed in paragraph (c) of this section of the year after the calendar year covered by the form.

(ii) If your establishment had 250 or more employees at any time during the previous calendar year, and this part requires your establishment to keep records, then you must electronically submit information from OSHA Form 300A Summary of Work-Related Injuries and Illnesses to OSHA or OSHA's designee. You must submit the information once a year, no later than the date listed in paragraph (c) of this section of the year after the calendar year covered by the form.

(2) Annual electronic submission of information from OSHA Form 300 Log of Work-Related Injuries and Illnesses and OSHA Form 301 Injury and Illness Incident Report by establishments with 100 or more employees in designated industries. If your establishment had 100 or more employees at any time during the previous calendar year, and your establishment is classified in an industry listed in appendix B to subpart E of this part, then you must electronically submit information from OSHA Forms 300 and 301 to OSHA or OSHA's designee. You must submit the information once a year, no later than the date listed in paragraph (c) of this section of the year after the calendar year covered by the forms.

* * * * *

(b) * * *

(1) Does every employer have to routinely make an annual electronic submission of information from part 1904 injury and illness recordkeeping forms to OSHA? No, only three categories of employers must routinely submit information from these forms. The first category is establishments that had 20–249 employees at any time during the previous calendar year, and are classified in an industry listed in appendix A to this subpart; establishments in this category must submit the required information from Form 300A to OSHA once a year. The second category is establishments that had 250 or more employees at any time during the previous calendar year, and are required by this part to keep records; establishments in this category must submit the required information from Form 300A to OSHA once a year. The third category is establishments that had 100 or more employees at any time during the previous calendar year, and are classified in an industry listed in appendix B to this subpart; establishments in this category must also submit the required information from Forms 300 and 301 to OSHA once a year, in addition to the required information from Form 300A. Employers in these three categories must submit the required information by the date listed in paragraph (c) of this section of the year after the calendar year covered by the form (for example, 2024 for the 2023 form(s)). If your establishment is not in any of these three categories, then you must submit the information to OSHA only if OSHA notifies you to do so for an individual data collection.

* * * * *

(9) If I have to submit information under paragraph (a)(2) of this section, do I have to submit all of the information from the recordkeeping forms? No, you are required to submit all of the information from the forms except the following:

(i) Log of Work-Related Injuries and Illnesses (OSHA Form 300): Employee name (column B).

(ii) Injury and Illness Incident Report (OSHA Form 301): Employee name (field 1), employee address (field 2), name of physician or other health care professional (field 6), facility name and address if treatment was given away from the worksite (field 7).

(10) My company uses numbers or codes to identify our establishments. May I use numbers or codes as the establishment name in my submission? Yes, you may use numbers or codes as the establishment name. However, the submission must include a legal company name, either as part of the establishment name or separately as the company name.

(c) Reporting dates. Establishments that are required to submit under paragraph (a)(1) or (2) of this section must submit all of the required information by March 2 of the year after the calendar year covered by the form(s) (for example, by March 2, 2024, for the forms covering 2023).

* * * * *

3. Revise appendix A to subpart E to read as follows:

Appendix A to Subpart E of Part 1904—Designated Industries for § 1904.41(a)(1)(i) Annual Electronic Submission of Information From OSHA Form 300A Summary of Work-Related Injuries and Illnesses by Establishments With 20–249 Employees in Designated Industries

NAICS	Industry
11	Agriculture, Forestry, Fishing and Hunting.
22	Utilities.
23	Construction.
31–33	Manufacturing.
42	Wholesale Trade.
4413	Automotive Parts, Accessories, and Tire Stores.
4421	Furniture Stores.
4422	Home Furnishings Stores.
4441	Building Material and Supplies Dealers.
4442	Lawn and Garden Equipment and Supplies Stores.
4451	Grocery Stores.
4452	Specialty Food Stores.
4522	Department Stores.
4523	General Merchandise Stores, including Warehouse Clubs and Supercenters.
4533	Used Merchandise Stores.
4542	Vending Machine Operators.
4543	Direct Selling Establishments.
4811	Scheduled Air Transportation.
4841	General Freight Trucking.
4842	Specialized Freight Trucking.
4851	Urban Transit Systems.
4852	Interurban and Rural Bus Transportation.
4853	Taxi and Limousine Service.
4854	School and Employee Bus Transportation.
4855	Charter Bus Industry.
4859	Other Transit and Ground Passenger Transportation.
4871	Scenic and Sightseeing Transportation, Land.
4881	Support Activities for Air Transportation.
4882	Support Activities for Rail Transportation.
4883	Support Activities for Water Transportation.
4884	Support Activities for Road Transportation.
4889	Other Support Activities for Transportation.
4911	Postal Service.
4921	Couriers and Express Delivery Services.
4922	Local Messengers and Local Delivery.
4931	Warehousing and Storage.
5152	Cable and Other Subscription Programming.
5311	Lessors of Real Estate.
5321	Automotive Equipment Rental and Leasing.
5322	Consumer Goods Rental.
5323	General Rental Centers.
5617	Services to Buildings and Dwellings.
5621	Waste Collection.
5622	Waste Treatment and Disposal.
5629	Remediation and Other Waste Management Services.
6219	Other Ambulatory Health Care Services.
6221	General Medical and Surgical Hospitals.
6222	Psychiatric and Substance Abuse Hospitals.
6223	Specialty (except Psychiatric and Substance Abuse) Hospitals.
6231	Nursing Care Facilities (Skilled Nursing Facilities).
6232	Residential Intellectual and Developmental Disability, Mental Health, and Substance Abuse Facilities.
6233	Continuing Care Retirement Communities and Assisted Living Facilities for the Elderly
6239	Other Residential Care Facilities.
6242	Community Food and Housing, and Emergency and Other Relief Services.
6243	Vocational Rehabilitation Services.
7111	Performing Arts Companies.
7112	Spectator Sports.
7121	Museums, Historical Sites, and Similar Institutions.
7131	Amusement Parks and Arcades.
7132	Gambling Industries.
7211	Traveler Accommodation.
7212	RV (Recreational Vehicle) Parks and Recreational Camps.
7223	Special Food Services.
8113	Commercial and Industrial Machinery and Equipment (except Automotive and Electronic) Repair and Maintenance.
8123	Drycleaning and Laundry Services.

4. Add appendix B to subpart E to read as follows:

Appendix B to Subpart E of Part 1904—Designated Industries for § 1904.41(a)(2) Annual Electronic Submission of Information From OSHA Form 300 Log of Work-Related Injuries and Illnesses and OSHA Form 301 Injury and Illness Incident Report by Establishments With 100 or More Employees in Designated Industries

NAICS	Industry
1111	Oilseed and Grain Farming.
1112	Vegetable and Melon Farming.
1113	Fruit and Tree Nut Farming.
1114	Greenhouse, Nursery, and Floriculture Production.
1119	Other Crop Farming.
1121	Cattle Ranching and Farming.
1122	Hog and Pig Farming.
1123	Poultry and Egg Production.
1129	Other Animal Production.
1133	Logging.
1141	Fishing.
1142	Hunting and Trapping.
1151	Support Activities for Crop Production.
1152	Support Activities for Animal Production.
1153	Support Activities for Forestry.
2213	Water, Sewage and Other Systems.
2381	Foundation, Structure, and Building Exterior Contractors.
3111	Animal Food Manufacturing.
3113	Sugar and Confectionery Product Manufacturing.
3114	Fruit and Vegetable Preserving and Specialty Food Manufacturing.
3115	Dairy Product Manufacturing.
3116	Animal Slaughtering and Processing.
3117	Seafood Product Preparation and Packaging.
3118	Bakeries and Tortilla Manufacturing.
3119	Other Food Manufacturing.
3121	Beverage Manufacturing.
3161	Leather and Hide Tanning and Finishing.
3162	Footwear Manufacturing.
3211	Sawmills and Wood Preservation.
3212	Veneer, Plywood, and Engineered Wood Product Manufacturing.
3219	Other Wood Product Manufacturing.
3261	Plastics Product Manufacturing.
3262	Rubber Product Manufacturing.
3271	Clay Product and Refractory Manufacturing.
3272	Glass and Glass Product Manufacturing.
3273	Cement and Concrete Product Manufacturing.
3279	Other Nonmetallic Mineral Product Manufacturing.
3312	Steel Product Manufacturing from Purchased Steel.
3314	Nonferrous Metal (except Aluminum) Production and Processing.
3315	Foundries.
3321	Forging and Stamping.
3323	Architectural and Structural Metals Manufacturing.
3324	Boiler, Tank, and Shipping Container Manufacturing.
3325	Hardware Manufacturing.
3326	Spring and Wire Product Manufacturing.
3327	Machine Shops; Turned Product; and Screw, Nut, and Bolt Manufacturing.
3328	Coating, Engraving, Heat Treating, and Allied Activities.
3331	Agriculture, Construction, and Mining Machinery Manufacturing.
3335	Metalworking Machinery Manufacturing.
3361	Motor Vehicle Manufacturing.
3362	Motor Vehicle Body and Trailer Manufacturing.
3363	Motor Vehicle Parts Manufacturing.
3366	Ship and Boat Building.
3371	Household and Institutional Furniture and Kitchen Cabinet Manufacturing.
3372	Office Furniture (including Fixtures) Manufacturing.
3379	Other Furniture Related Product Manufacturing.
4231	Motor Vehicle and Motor Vehicle Parts and Supplies Merchant Wholesalers.
4233	Lumber and Other Construction Materials Merchant Wholesalers.
4235	Metal and Mineral (except Petroleum) Merchant Wholesalers.
4239	Miscellaneous Durable Goods Merchant Wholesalers.
4244	Grocery and Related Product Merchant Wholesalers.
4248	Beer, Wine, and Distilled Alcoholic Beverage Merchant Wholesalers.
4413	Automotive Parts, Accessories, and Tire Stores.
4422	Home Furnishings Stores.
4441	Building Material and Supplies Dealers.
4442	Lawn and Garden Equipment and Supplies Stores.
4451	Grocery Stores.
4522	Department Stores.
4523	General Merchandise Stores, including Warehouse Clubs and Supercenters.
4533	Used Merchandise Stores.
4543	Direct Selling Establishments.
4811	Scheduled Air Transportation.
4841	General Freight Trucking.
4842	Specialized Freight Trucking.
4851	Urban Transit Systems.
4852	Interurban and Rural Bus Transportation.
4853	Taxi and Limousine Service.
4854	School and Employee Bus Transportation.
4859	Other Transit and Ground Passenger Transportation.
4871	Scenic and Sightseeing Transportation, Land.
4881	Support Activities for Air Transportation.
4883	Support Activities for Water Transportation.
4889	Other Support Activities for Transportation.
4911	Postal Service.
4921	Couriers and Express Delivery Services.
4931	Warehousing and Storage.
5322	Consumer Goods Rental.
5621	Waste Collection.
5622	Waste Treatment and Disposal.
6219	Other Ambulatory Health Care Services.
6221	General Medical and Surgical Hospitals.
6222	Psychiatric and Substance Abuse Hospitals.
6223	Specialty (except Psychiatric and Substance Abuse) Hospitals.
6231	Nursing Care Facilities (Skilled Nursing Facilities).
6232	Residential Intellectual and Developmental Disability, Mental Health, and Substance Abuse Facilities.
6233	Continuing Care Retirement Communities and Assisted Living Facilities for the Elderly.
6239	Other Residential Care Facilities.
6243	Vocational Rehabilitation Services.
7111	Performing Arts Companies.
7112	Spectator Sports.
7131	Amusement Parks and Arcades.
7211	Traveler Accommodation.
7212	RV (Recreational Vehicle) Parks and Recreational Camps.
7223	Special Food Services.

* * * * *

Footnotes

1.  All employers covered by the OSH Act are covered by OSHA's recordkeeping and reporting requirements found in 29 CFR part 1904. However, there are several exceptions to OSHA's recordkeeping requirements that apply unless OSHA or the Bureau of Labor Statistics (BLS) informs them in writing that they must keep records (29 CFR 1904.1(a)(1), 1904.2(a)(1)). For example, employers with ten or fewer employees, as well as businesses with establishments in certain industries, are partially exempt from keeping OSHA injury and illness records (29 CFR 1904.1, 1904.2). The provision excepts most employers covered by the OSH Act. All employers covered by the OSH Act, including those that are partially exempt from keeping injury and illness records, are still required to report work-related fatalities, in-patient hospitalizations, amputations, and losses of an eye to OSHA within specified timeframes under 29 CFR 1904.39.

2.  OSHA has determined that it is necessary and appropriate to require certain establishments to electronically submit case-specific, establishment-specific data from their Forms 300 and 301 to OSHA. Any claimed reliance interest in the prior policy, which did not contain that requirement, is outweighed by the significant benefits to occupational safety and health, discussed in Section III.B.4 of the Summary and Explanation, that OSHA expects to accrue from this rule (see Regents of the Univ. of California, 140 S. Ct. at 1914 (it is “the agency's job” to determine “in the particular context before it, that other interests and policy concerns outweigh any reliance interests”)).

3.  As noted in the NPRM, OSHA proposed to remove NAICS 7213, Rooming and Boarding Houses, from appendix A (see 87 FR 18536, n.7). Employers in NAICS 7213 are not required to routinely keep OSHA injury and illness records, per the part 1904 non-mandatory appendix A to subpart B. This NAICS industry group was mistakenly included in appendix A to subpart E when OSHA published its 2016 final rule (see 81 FR 29642). OSHA received no comments objecting to the removal of NAICS 7213 from appendix A to subpart E and thus has excluded this industry group from the final version of this appendix.

4.  See https://www.bls.gov/​iif/​nonfatal-injuries-and-illnesses-tables/​soii-summary-historical/​supplemental-table-1-2019-national.xlsx for the TCR table and https://www.bls.gov/​iif/​nonfatal-injuries-and-illnesses-tables/​soii-summary-historical/​supplemental-table-2-2019-national.xlsx for the DART table.

5.  OSHA, like other Federal agencies, is responsible for protecting personally identifiable information (PII) in accordance with law and policy. Throughout this preamble, OSHA identifies and discusses multiple ways in which the agency fulfills this responsibility.

6.  The OSHA Integrated Management Information System (IMIS) was designed in 1991 as an information resource for in-house use by OSHA staff and management, and by State agencies which carry out federally approved OSHA programs. It was replaced by the OSHA Information System (OIS) as the primary repository of OSHA's data, starting in 2012.

7.  OSHA notes some of the issues noted in this paragraph are addressed below in Section III.E of the Summary and Explanation, on section 1904.41(b)(10). However, OSHA sees some utility in reviewing this issue in this part of the preamble as well.

8.  In this preamble, OSHA generally uses the phrases “information that could reasonably be expected to identify individuals directly” and “information that could reasonably be expected to identify individuals indirectly,” rather than the broader term “personally identifiable information” (PII) to aid interested parties in understanding precisely what type of information OSHA is referring to in the discussion. The information referred to in both phrases can be considered PII.

9.  The inclusion of links to particular items or references to particular companies or products is not intended to reflect their importance, nor is it intended to endorse any views, or products, or services.

10.  OSHA notes that the 2019 final rule contemplated two levels of manual case-by-case review of submitted data (84 FR 400). In this rulemaking, the agency finds that such review is not necessary. OSHA will guard against the publication of information which could directly identify or lead to the identification of workers using the measures discussed above, including the use of automated de-identification technology, supplemented with some manual review of the data. OSHA finds that these measures appropriately mitigate employee-privacy-related concerns.

11.  The only report OSHA has received regarding actual reidentification of employees from data released by OSHA is discussed below. And, as noted in that discussion, it is not clear from the report that the information which caused the reidentification is comparable to the information that would be released pursuant to this rulemaking ( e.g., the size of the establishment where the identified employees worked, the information that caused them to be reidentified). Given that uncertainty and the fact that OSHA has been releasing information from establishments' Forms 300 and 301 in response to FOIA requests for many years, this single report does not persuade the agency that the benefits of this rulemaking are outweighed by what OSHA believes is a minimal risk to employee privacy.

12.  It also does not necessarily follow that an agency could not have made a different, non-arbitrary-and-capricious decision based on the record before the agency at the time it made its original decision. This is part of the reason why reviewing courts do not substitute their judgment for that of the agency: at times, more than one reasonable decision could follow from a given record.

13.  See “Deep neural networks for worker injury autocoding”, Alexander Measure, U.S. Bureau of Labor Statistics, draft as of 9/18/2017 (Ex. 96).

14.  See https://www.bls.gov/​iif/​automated-coding/​deep-neural-networks.pdf.

15.  Measure, Alexander. “Six Years of Machine Learning in the Bureau of Labor Statistics.” Advances in Business Statistics, Methods and Data Collection, Jan. 2023, pp. 561–72.

16.   https://www.bls.gov/​iif/​automated-coding.htm.

17.  Note that, as explained in the Privacy Impact Assessment (Docket ID 0107), establishments that submit their data by uploading a csv file (see III.B.14.e Data Submission) will include the Date of Birth field in the csv file, and the csv files will be temporarily stored in a secure, encrypted folder on the Department's IT network (see III.B.9 Risk of cyber attack) for technical support purposes only, and purged on a regular basis.

18.  The Chamber of Commerce objected to the preliminary finding that this rule is not an economically significant regulatory action under Executive Order 12866 (Ex. 88), arguing that the first-year costs of compliance require such a finding. This assertion is based on the Chamber of Commerce's own estimates of the costs of compliance with this rule, which are significantly higher than OSHA's. The Chamber estimates first-year costs of $130 million, whereas OSHA's estimated annual costs in the FEA to affected employers are just over $7 million. The Chamber of Commerce's more specific comments regarding costs are discussed throughout this section.

19.  Fringe benefit factor calculated as [1/(1–0.312)], where 0.312 is the proportion of the average total benefits constituted by fringe benefits among civilian workers in all industries, as reported on Table 2 of the BLS's ECEC report, June 2021: https://www.bls.gov/​news.release/​archives/​ecec_​09162021.pdf.

20.  Seventeen percent is OSHA's standard estimate for the overhead cost incurred by the average employer.

21.  This wage category has also been widely used for similar administrative purposes for other OSHA rulemakings, without controversy ( e.g., the 2016 recordkeeping rulemaking—see 81 CFR 29675).

22.  One commenter even suggested the physicians may be needed to determine whether injuries were work-related now that the injury and illness reports will be made public (Docket ID 0088). However, like related discussions elsewhere in this FEA, this obligation ( i.e., the need to determine work-relatedness of an injury) existed prior to this rule. Because it is not an additional cost created by this rule, it is not included.

23.  See ETA Final Rule, Adverse Effect Wage Rate Methodology for the Temporary Employment of H–2A Nonimmigrants in Non-Range Occupations in the United States, 88 FR 12760, 12788 (Feb. 28, 2023).

24.  See Wage and Hour Division Final Rule, Increasing the Minimum Wage for Federal Contractors, 86 FR 67126, 67205 (Nov. 24, 2021).

25.  For an example of an earlier OSHA economic analysis that used the EPA overhead rate, see OSHA's final rule on Walking-Working Surfaces and Personal Protective Equipment (Fall Protection Systems) at 81 FR 82494, 82931 (Nov. 18, 2016).

26.  As noted in a previous related Federal Register notice (see 81 FR 29683), in principal, the labor costs of affected workers reflect the opportunity costs of that labor.

27.  See Docket ID 0103 for a spreadsheet with the full calculations. Slight discrepancies in results are likely due to rounding.

28.  The fringe benefit factor was calculated as [1/(1–0.310)], where 0.310 is the proportion of average total benefits constituted by fringe benefits among civilian workers in all industries, as reported on Table 2, above.

29.  Seventeen percent is OSHA's standard estimate for the overhead cost incurred by the average employer.

30.  For BLS Occupational Code 15–1252 “Software Developer,” total compensation is $84.30 ($58.17 mean hourly wage + $26.13 fringe benefits) plus $9.89 in overhead [$58.17 × 0.17].]

31.  OSHA's estimate of injury and illness cases is based on calendar year 2019 data submitted to the agency through the Injury Tracking Application (ITA) (Docket ID 0106). Establishments with 100 or more employees in appendix B industries reported a total of 766,257 recordable fatalities, injuries, and illnesses for that year.

32.  One of those commenters suggested that OSHA include costs for creating training materials and conducting training sessions as part of familiarization (Docket ID 0054). Another made a more general statement that the agency's estimate for rule familiarization did not account for the time it will take to prepare or implement OSHA's proposed changes or develop processes to comply with the new requirements (Docket ID 0094). These elements are discussed under Training later in this analysis.

33.  0.17 hours is a rounded value representing 10 minutes, or 10/60th of an hour, per establishment.

34.  $62,397 annualized over ten years with a 3 percent discount rate.

35.  Form 300A data submitted to OSHA through the Injury Tracking Application (ITA) for 2019 indicated that almost half of establishments (47 percent) were already submitting their data by batch file at that time (Docket ID 0103).

36.  0.17 hours is a rounded value representing 10 minutes, or 10/60th of an hour, per case.

37.  For example, 2019 Form 300A data submitted to OSHA through the ITA indicate that establishments with 100–199 employees submitted 50% of data by batch file, which was higher than the percentage submitted by batch file for employers with 500 or more employees (Docket ID 0103).

38.  The average cost per establishment to submit the Form 300 and 301 data to OSHA ($133.46) was calculated as [(Cost per establishment to submit batch files ($10.22) × establishments submitting batch files (24,668)) + (Cost per establishment to submit individual files ($242.41) × establishments submitting cases manually (27,424,))]/Total establishments (52,092).

39.  0.17 hours is a rounded value representing 10 minutes, or 10/60th of an hour, per establishment.

40.  0.25 hours represents 15 minutes, or 15/60th of an hour, per case.

41.  OSHA's assumption that batch files are submitted on a per establishment basis may overestimate the costs of the rule, as batch files are typically submitted at the firm level on behalf of multiple establishments. As documented in the accompanying spreadsheet (Docket ID 0103), if OSHA assumed that batch files are submitted by firms rather than establishments, the costs would be a fraction of the estimate presented here—approximately $7,316 annually, as opposed to the estimated $252,048.

42.  For example, data submitted from 2019 Form 300A to OSHA through the ITA shows submissions from 52,092 establishments with 100+ employees. The information for these establishments was submitted by 18,156 users. Of those, 716 users submitted the data for 24,668 establishments and 332,498 recordable cases using batch files (Docket ID 0103).

43.  This percent was calculated by dividing the 24,668 establishments submitting individual 300/301 data manually ( i.e., not by batch file) by the 52,092 total establishments submitting data (Docket ID 0103).

44.  OSHA believes employers who already own and use commercially available software are unlikely to face any additional costs because aftermarket software vendors will need to upgrade their software to ensure the software does not become irrelevant to the needs of their customers. Research conducted by ERG indicates that software vendors plan to upgrade software free of charge (Docket ID 0104). The business model selected by the software vendors means that they will inherently incur some minor costs as a result of providing a service without charge. The record is not sufficient for OSHA to provide a quantitative estimate of what those costs would be, but the fact that the vendors chose to offer this service without charge makes it clear that providing this update would not pose any threat to the economic stability of the software vendor industry.

45.  The use of recordkeeping software provides significant advantages in terms of streamlining recordkeeping and data submission capabilities. Specifically, software is available that produces OSHA-ready reports for work-related injuries and illnesses; generates files in the exact format required for the OSHA ITA; and offers additional features, including ways to capture near-misses and hazards of all types, detailed incident investigations, and the root cause of an injury.

46.  The agency has also performed a sensitivity analysis to recognize that some of the more complex software in the typically larger firms, with many establishments, might take as much as 50 hours to reprogram, depending on the complexity of the software (Docket ID 0103). These estimates assume there are not time savings from bundling these software updates with others needed to maintain and update the software, or efficiencies to be gained from incorporating commercial software.

47.  Docket ID 0105.

48.  $100,706 annualized over 10 years at a 3 percent discount rate.

49.  Additionally, OSHA will use software capable of detecting and redacting PII not redacted by establishments.

50.  As OSHA said in the NPRM, OSHA's review of five years of electronically submitted Form 300A data indicates that many large firms with multiple establishments use codes for the Establishment Name field in their submission (87 FR 18546). This is the type of employer this new requirement will likely apply to and, because they are large firms submitting for multiple establishments, they are likely submitting via batch file. This means that company name would only need to be inputted once.

51.  To the extent the commenter is arguing that determining a firm's legal name is administratively difficult or would take substantial time, OSHA presumes that employers know their company names and has included no cost for that.

52.  This approach is also consistent with that taken in OSHA's 2016 final recordkeeping rule, which also required electronic submission of injury and illness data to OSHA (see 81 FR 29674).

53.  As discussed in the Regulatory Flexibility Certification, the costs would be no more than approximately .01% of revenues ($136 costs/$13,627 being the 1% threshold of revenues), implying a negligible price increase, if any, to recoup the increase in costs.

54.  When preparing the final rule, the agency found inadvertent discrepancies between the written text of the PEA that was in the Federal Register notice for the NPRM (87 FR 18550–51) and the spreadsheet (Ex. 2) used to calculate the estimated governmental costs in the PEA. The agency describes those discrepancies here for the purposes of transparency. The annual cost of IT transactions was listed in the spreadsheet as $107,309 rather than $201,128 in the Federal Register notice. Annual help desk support costs were listed as $50,000 in the spreadsheet and $25,000 in the Federal Register notice. And, the cost of an additional IT Specialist was included in the spreadsheet (at an estimated $181,162) but omitted from the discussion in the Federal Register notice. Whereas the total costs to the government reported in the spreadsheet were $509,324, the total costs to the government in the Federal Register notice were $397,001. Because the costs listed in the spreadsheet are more inclusive of the universe of estimated costs, the estimates in the FEA are derived from those costs.

55.  OSHA has determined that the other new regulatory provisions in this final rule, such as § 1904.41(b)(1) (which is a clarifying provision), § 1904.41(b)(9) (which sets out which data should be excluded from submissions), § 1904.41(b)(10) (which requires employers to provide their company name as part of their submission), and § 1904.41(c) (which sets the submission deadline), do not impose costs beyond those accounted for in the costs of submission and familiarization discussed in this FEA.

56.  One commenter, the US Poultry & Egg Association, objected to OSHA's estimate of costs and suggested that OSHA should “conduct a pilot program (preferably on Federal Government agencies) to determine the actual cost of compliance” (Ex. 53). OSHA has a long history of estimating costs of its regulations and standards without the need for a pilot program. It is confident that the estimates in this rulemaking, which carefully consider comments from interested parties, are sufficient to accurately characterize the costs of compliance for employers.

57.  See “Employer-Reported Workplace Injuries and Illnesses—2021”, news release from the Bureau of Labor Statistics/U.S. Department of Labor, November 9, 2022 ( https://www.bls.gov/​news.release/​pdf/​osh.pdf).

58.  See, e.g., Leigh JP, Du J, McCurdy SA. An estimate of the U.S. government's undercount of nonfatal occupational injuries and illnesses in agriculture. Ann Epidemiol. 2014 Apr; 24(4):254–9 ( https://pubmed.ncbi.nlm.nih.gov/​24507952/​); Spieler EA, Wagner GR. Counting matters: Implications of undercounting in the BLS survey of occupational injuries and illnesses. Am J Ind Med. 2014 Oct; 57(10):1077–84 ( https://onlinelibrary.wiley.com/​doi/​10.1002/​ajim.22382).

59.  Note that the agency did not propose quarterly reporting; the proposed rule envisioned annual reporting, and the final rule similarly will require annual reporting.

60.  For the difference between a standard and a regulation, please see the discussion in Section II, Legal Authority.

61.  The portion of the rule that addresses the submission of Form 300A information does affect smaller entities, as establishments with 20 or more employees are required to electronically submit Form 300A information. However, because this final rule makes no substantive changes to that submission requirement, which was enacted as part of the 2016 final rule, there are no new costs for entities with fewer than 100 employees.

62.  The average revenue numbers were obtained from the 2017 Economic Census. This is the most current information available from this source, which OSHA considers to be the best available source of revenue data for U.S. businesses. OSHA adjusted these figures to 2019 dollars using the Bureau of Economic Analysis's GDP deflator, which is OSHA's standard source for inflation and deflation analysis. These average revenue figures would include any non-profits falling within the affected industries.

63.  Profits were calculated as profit rates multiplied by revenues. The before-tax profit rates that OSHA used were estimated using corporate balance sheet data from the 2013 Corporation Source Book (Internal Revenue Service, 2013; https://www.irs.gov/​statistics/​soi-tax-stats-corporation-source-book-publication-1053). The IRS discontinued the publication of these data after 2013, and therefore the most current years available are 2000–2013. The most recent version of the Source Book represents the best available evidence for these data on profit rates.

64.  While descriptive of most establishments in these industries, this figure would significantly underestimate the profits of the average affected establishment covered by this rule, which only affects those with 100 or more employees.

65.  The lowest potential threshold of impact (for profits) is $2,725 per establishment. The agency estimates an average cost per establishment of $136. It would need to be approximately 20 times higher to reach this threshold.