2018-16059. Tracking of Workplace Injuries and Illnesses

AGENCY:

Occupational Safety and Health Administration (OSHA), Labor.

ACTION:

Proposed rule.

SUMMARY:

This proposed rule would amend OSHA's recordkeeping regulation by rescinding the requirement for establishments with 250 or more employees to electronically submit information from OSHA Forms 300 and 301. These establishments will continue to be required to submit information from their Form 300A summaries. OSHA is amending its recordkeeping regulations to protect sensitive worker information from potential disclosure under the Freedom of Information Act (FOIA). OSHA has preliminarily determined that the risk of disclosure of this information, the costs to OSHA of collecting and using the information, and the reporting burden on employers are unjustified given the uncertain benefits of collecting the information. OSHA believes that this proposal maintains safety and health protections for workers while also reducing the burden to employers of complying with the current rule. OSHA seeks comment on this proposal, particularly on its impact on worker privacy, including the risks posed by exposing workers' sensitive information to possible FOIA disclosure. In addition, OSHA is proposing to require covered employers to submit their Employer Identification Number (EIN) electronically along with their injury and illness data submission.

DATES:

Comments must be submitted by September 28, 2018.

ADDRESSES:

You may submit comments, identified by docket number OSHA-2013-0023, or regulatory information number (RIN) 1218-AD17, by any of the following methods:

Electronically: You may submit comments electronically at https://www.regulations.gov/​,, which is the federal e-rulemaking portal. Follow the instructions on the website for making electronic submissions;

Fax: If your submission, including attachments, does not exceed 10 pages, you may fax it to the OSHA docket office at [phone];

Regular mail, express mail, hand delivery, or messenger/courier service (hard copy): You may submit your materials to the OSHA Docket Office, Docket No. OSHA-2013-0023, Room N-3653, U.S. Department of Labor, 200 Constitution Avenue NW, Washington, DC 20210; telephone: [phone] (TTY [phone]). OSHA's Docket Office accepts deliveries (hand deliveries, express mail, and messenger/courier service) from 10 a.m. to 3 p.m. ET, weekdays.

Instructions for submitting comments: All submissions must include the docket number (Docket No. OSHA-2013-0023) or the RIN (RIN 1218-AD17) for this rulemaking. Because of security-related procedures, submission by regular mail may result in significant delay. Please contact the OSHA docket office (telephone: [phone]; email: [e-mail]) for information about security procedures for making submissions by hand delivery, express delivery, and messenger or courier service.

All comments, including any personal information you provide, are placed in the public docket without change and will be made available online at https://www.regulations.gov. Therefore, OSHA cautions you about submitting personal information such as Social Security Numbers and birthdates.

Docket: To read or download submissions in response to this Federal Register document, go to docket number OSHA-2013-0023, at https://www.regulations.gov. All submissions are listed in the https://www.regulations.gov index. However, some information (e.g., copyrighted material) is not publicly available to read or download through that website. All submissions, including copyrighted material, are available for inspection at the OSHA docket office.

Electronic copies of this Federal Register document are available at https://www.regulations.gov. This document, as well as news releases and other relevant information, is available at OSHA's website at http://www.osha.gov.

FOR FURTHER INFORMATION CONTACT:

 

For press inquiries: Frank Meilinger, OSHA Office of Communications, telephone: [phone]; email: [e-mail].

For general and technical information on the proposed rule: Amanda Edens, Director, Directorate of Technical Support and Emergency Management, telephone: [phone]; email: [e-mail].

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Background

A. Introduction

B. Regulatory History

II. Legal Authority

III. Summary and Explanation of the Proposed Rule

A. Description of Proposed Revisions to Section 1904.41

1. Section 1904.41(a)(1)—Annual Electronic Submission of OSHA Part 1904 Records by Establishments With 250 or More Employees

2. Section 1904.41, Paragraphs (b)(1)-(8)—Implementation

3. Employer Identification Number

B. Additional Questions

IV. Preliminary Economic Analysis and Regulatory Flexibility Certification

A. Introduction

B. Cost Savings

C. New Costs (From the EIN Collection)

D. Net Cost Savings

E. Benefits

F. Economic Feasibility

G. Regulatory Flexibility Certification

V. Office of Management and Budget (OMB) Review Under the Paperwork Reduction Act of 1995

VI. Unfunded Mandates

VII. Federalism

VIII. State Plan States

IX. Public Participation

A. Public Submissions

B. Access to Docket

Amendments to Part 1904

References and Exhibits

In this preamble, OSHA references documents in Docket No. OSHA-2013-0023, the docket for this rulemaking. The docket is available at https://www.regulations.gov,, the Federal e-rulemaking Portal.

References to documents in this rulemaking docket are given as “Ex.” followed by the document number. The document number is the last sequence of numbers in the Document ID Number on https://www.regulations.gov.

The exhibits in the docket, including public comments, supporting materials, meeting transcripts, and other documents, are listed on https://www.regulations.gov. All exhibits are listed in the docket index on https://www.regulations.gov. However, some exhibits (e.g., copyrighted material) are not available to read or download from that web page. All materials in the docket are available for inspection at the OSHA Docket Office, Room N-3653, U.S. Department of Labor, 200 Constitution Avenue NW, Washington, DC 20210; telephone [phone].

I. Background

A. Introduction

OSHA's regulation at 29 CFR part 1904 requires employers to collect a variety of information on occupational injuries and illnesses. Much of this information may be sensitive for workers, including descriptions of their injuries and the body parts affected. Under OSHA's regulation, employers with more than 10 employees in most industries must keep those records at their establishments. Employers covered by these rules must record each recordable employee injury and illness on an OSHA Form 300, the “Log of Work-Related Injuries and Illnesses,” or equivalent. Covered employers must also prepare a supplementary OSHA Form 301, the “Injury and Illness Incident Report” or equivalent, to provide additional details about each case recorded on the OSHA Form 300. OSHA requires employers to provide these records to others under certain circumstances, but imposes limits on the disclosure of personally identifying information.^[1] Finally, at the end of each year, these employers are required to prepare a summary report of all injuries and illnesses on the OSHA Form 300A, the “Summary of Work-Related Injuries and Illnesses,” and post the form in a visible location in the workplace.

Form 301 in particular requires the collection of much sensitive information about each individual worker's job-linked illness or injury, information an employer must collect with or without the worker's consent. While some of the information is likelier to be regarded as particularly sensitive—namely, descriptions of injuries and the body parts affected—most of the form's questions seek answers that should not be lightly disclosed, including:

• Was employee treated in an emergency room?
• Was employee hospitalized overnight as an in-patient?
• Date of birth.
• Date of injury.
• What was the employee doing just before the incident occurred? Describe the activity, as well as the tools, equipment, or material the employee was using. Be specific. Examples: “climbing a ladder while carrying roofing materials”; “spraying chlorine from hand sprayer”; “daily computer key-entry.”
• What happened? Tell us how the injury occurred. Examples: “When ladder slipped on wet floor, worker fell 20 feet”; “Worker was sprayed with chlorine when gasket broke during replacement”; “Worker developed soreness in wrist over time.”
• What was the injury or illness? Tell us the part of the body that was affected and how it was affected; be more specific than “hurt,” “pain,” or “sore.” Examples: “strained back”; “chemical burn, hand”; “carpal tunnel syndrome.”
• What object or substance directly harmed the employee? Examples: “concrete floor”; “chlorine”; “radial arm saw . . . ”

Form 300 requires employers to log much of this individual information—notably, descriptions of injuries and the body parts affected—for each individual worker and incident. Form 300A, by contrast, merely summarizes incident data without any traceable connection to individual workers.

In the May 2016 final rule (81 FR 29624), the recordkeeping regulation was revised to require establishments with 250 or more employees to electronically submit information from the OSHA Forms 300, 300A, and 301 to OSHA annually. Establishments in certain industries with 20-249 employees are required only to electronically submit information from only the OSHA Form 300A—the summary form. This proposed rule would amend OSHA's recordkeeping regulation by rescinding the requirement for establishments with 250 or more employees to electronically submit information from the OSHA Forms 300 and 301—the individual forms.

As discussed below, OSHA proposes this amendment to the 2016 rule to protect worker privacy, having re-evaluated the utility of routinely collecting Form 300 and 301 data. The injury and illness data electronically submitted to OSHA from Form 300A (which submission the 2016 rule requires, and which this proposal would not change) gives OSHA a great deal of information to use in identifying high-hazard establishments for enforcement targeting. To that end, OSHA has designed a targeted enforcement mechanism for industries experiencing higher rates of injuries and illnesses based on the summary data. By contrast, OSHA has provisionally determined that electronic submission of Forms 300 and 301 adds uncertain enforcement benefits, while significantly increasing the risk to worker privacy, considering that those forms, if collected by OSHA, could be found disclosable under FOIA. In addition, to gain (uncertain) enforcement value from the case-specific data, OSHA would need to divert resources from other priorities, such as the utilization of Form 300A data, which OSHA's experience has shown to be useful.

OSHA seeks comment on this proposal. In addition, OSHA asks for public comment on whether to require covered employers to submit their EIN along with their injury and illness data submission.

This proposed rule is expected to be an E.O. 13771 deregulatory action, with annualized net cost savings estimated at $8.2 million. Details on OSHA's cost and cost savings estimates for this proposed rule can be found in the Preliminary Economic Analysis (PEA).

Under the current recordkeeping rule, the initial deadline for electronic submission of information from OSHA Forms 300 and 301 by covered establishments with 250 or more employees was July 1, 2018. However, OSHA will not enforce this deadline without further notice while this rulemaking is underway.

B. Regulatory History

OSHA's regulations on recording and reporting occupational injuries and illnesses (29 CFR part 1904) were first issued in 1971 (36 FR 12612, July 2, 1971). These regulations require the recording of work-related injuries and illnesses that involve death, loss of consciousness, days away from work, restriction of work, transfer to another job, medical treatment other than first aid, or diagnosis of a significant injury or illness by a physician or other licensed health care professional (29 CFR 1904.7).

On July 29, 1977, OSHA amended these regulations to partially exempt businesses having ten or fewer employees during the previous calendar year from the requirement to record occupational injuries and illnesses (42 FR 38568). On December 28, 1982, OSHA amended these regulations to partially exempt establishments in certain lower-hazard industries from the requirement to record occupational injuries and illnesses (47 FR 57699). OSHA also amended the recordkeeping regulations in 1994 (Reporting of Fatality or Multiple Hospitalization Incidents, 59 FR 15594) and 1997 (Reporting Occupational Injury and Illness Data to OSHA, 62 FR 6434). Under the authority in Section 1904.41 added by the 1997 final rule, OSHA began requiring certain employers to submit only their 300A data to OSHA annually through the OSHA Data Initiative (ODI). The purpose of the ODI was to collect data on injuries and acute illnesses attributable to work-related activities in the private sector from approximately 80,000 establishments in selected high-hazard industries. The Agency used these data to calculate establishment-specific injury and illness rates and, in combination with other data sources, to target enforcement and compliance assistance activities.

On January 19, 2001, OSHA issued a final rule amending its requirements for the recording and reporting of occupational injuries and illnesses (29 CFR parts 1904 and 1902), along with the forms employers use to record those injuries and illnesses (66 FR 5916). The final rule also updated the list of industries that were partially exempt from recording occupational injuries and illnesses.

On September 18, 2014, OSHA again amended the regulations to require employers to report work-related fatalities and severe injuries—in-patient hospitalizations, amputations, and losses of an eye—to OSHA and to allow electronic reporting of these events (79 FR 56130). The final rule also revised the list of industries that are partially exempt from recording occupational injuries and illnesses.

On May 12, 2016, OSHA amended the regulations on recording and reporting occupational injuries and illness to require employers to annually submit injury and illness information that employers were already required to keep under part 1904 (81 FR 29624) to OSHA electronically. Establishments with 250 or more employees in industries that are routinely required to keep records are required to electronically submit information from their OSHA Forms 300, 300A, and 301 to OSHA or OSHA's designee once a year, and establishments with 20 to 249 employees in certain designated industries are required to electronically submit information from their OSHA annual summary (Form 300A) to OSHA or OSHA's designee once a year. In addition, that final rule requires employers, upon notification, to electronically submit information from part 1904 recordkeeping forms to OSHA or OSHA's designee. These provisions became effective on January 1, 2017.

On November 24, 2017, OSHA amended the recordkeeping regulation to extend the initial submission deadline for 2016 Form 300A data described in 29 CFR 1904.41(c)(1) from July 1, 2017, to December 15, 2017 (82 FR 55761).

II. Legal Authority

OSHA is issuing this proposed rule pursuant to authority expressly granted by sections 8 and 24 of the Occupational Safety and Health Act (the “OSH Act” or “Act”) (29 U.S.C. 657, 673). Section 8(c)(1) of the Act requires each employer to “make, keep and preserve, and make available to the Secretary [of Labor] or the Secretary of Health and Human Services, such records regarding his activities relating to this Act as the Secretary . . . may prescribe by regulation as necessary or appropriate for the enforcement of this Act or for developing information regarding the causes and prevention of occupational accidents and illnesses” (29 U.S.C. 657(c)(1)). Section 8(c)(2) directs the Secretary to prescribe regulations “requiring employers to maintain accurate records of, and to make periodic reports on, work-related deaths, injuries and illnesses other than minor injuries requiring only first aid treatment and which do not involve medical treatment, loss of consciousness, restriction of work or motion, or transfer to another job” (29 U.S.C. 657(c)(2)). Finally, section 8(g)(2) of the OSH Act broadly empowers the Secretary to “prescribe such rules and regulations as he may deem necessary to carry out [his] responsibilities under this Act” (29 U.S.C. 657(g)(2)).

Section 24 of the OSH Act (29 U.S.C. 673) contains a similar grant of authority. This section requires the Secretary to “develop and maintain an effective program of collection, compilation, and analysis of occupational safety and health statistics” and “compile accurate statistics on work injuries and illnesses which shall include all disabling, serious, or significant injuries and illnesses” (29 U.S.C. 673(a)). Section 24 also requires employers to “file such reports with the Secretary as he shall prescribe by regulation” (29 U.S.C. 673(e)). These reports are to be based on “the records made and kept pursuant to section 8(c) of this Act” (29 U.S.C. 673(e)).

Further support for the Secretary's authority to require employers to keep and submit records of work-related illnesses and injuries can be found in the Congressional Findings and Purpose at the beginning of the OSH Act (29 U.S.C. 651). In this section, Congress declares the overarching purpose of the Act is “to assure so far as possible every working man and woman in the Nation safe and healthful working conditions” (29 U.S.C. 651(b)). One of the ways in which the Act is meant to achieve this goal is “by providing for appropriate reporting procedures . . . [that] will help achieve the objectives of this Act and accurately describe the nature of the occupational safety and health problem” (29 U.S.C. 651(b)(12)). Importantly, the statute does not require this information to be reported to OSHA.

The OSH Act authorizes the Secretary of Labor to issue two types of occupational safety and health rules: Standards and regulations. Standards aim to correct particular identified workplace hazards, while regulations further the general enforcement and detection purposes of the OSH Act (see Workplace Health & Safety Council v. Reich, 56 F.3d 1465, 1468 (D.C. Cir. 1995) (citing Louisiana Chemical Ass'n v. Bingham, 657 F.2d 777, 781-82 (5th Cir. 1981)); United Steelworkers of America v. Auchter, 763 F.2d 728, 735 (3d Cir. 1985)). Recordkeeping requirements promulgated under the Act are characterized as regulations (see 29 U.S.C. 657 (using the term “regulations” to describe recordkeeping requirements)). An agency may revise a prior rule if it provides a reasoned explanation for the change. See Motor Vehicle Mfrs. Ass'n v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 42 (1983).

III. Summary and Explanation of the Proposed Rule

OSHA proposes to protect worker privacy by ending the electronic collection of case-specific forms (which OSHA has preliminarily determined adds uncertain enforcement value, but poses a potential privacy risk under FOIA) while continuing the collection of summary forms (which adds significant enforcement value, with little privacy risk). OSHA has reevaluated the utility of the Form 300 and 301 data for OSHA enforcement efforts and preliminarily determined that its (uncertain) enforcement value does not justify the reporting burden on employers, the burden on OSHA to collect, process, analyze, distribute, and programmatically apply the data, and—especially—the risks posed to worker privacy. Specifically, OSHA is proposing to amend its recordkeeping regulations by removing the part 1904 requirement that became effective on January 1, 2017, for the annual electronic submission of injury and illness information contained in OSHA Forms 300 and 301. This amendment would avoid the risks posed by making those forms into government records that could be found disclosable under FOIA.

OSHA is only seeking comment on the proposed changes to § 1904.41, and not on any other aspects of part 1904.

A. Description of Proposed Revisions to Section 1904.41

1. Section 1904.41(a)(1)—Annual Electronic Submission of Part 1904 Records by Establishments With 250 or More Employees

OSHA proposes to amend § 1904.41(a)(1) to remove the requirement for establishments with 250 or more employees that are required to routinely keep injury and illness records to electronically submit information from the OSHA Form 300 (Log of Work-Related Injuries and Illnesses) and OSHA Form 301 (Injury and Illness Incident Report) to OSHA or OSHA's designee once a year. Under the proposed rule, § 1904.41(a)(1) would only require these establishments to electronically submit information from the OSHA Form 300A (Summary of Work-Related Injuries and Illnesses). As explained below, OSHA believes that this change would better protect worker privacy from the risk of FOIA disclosure, while retaining the lion's share of the enforcement benefits realized by the 2016 rule.

a. Collecting Forms 300 and 301's Individual Injury and Illness Data Risks Worker Privacy

Electronic submission of Forms 300 and 301 puts the federal government in the position of collecting information that workers may deem quite sensitive, including descriptions of their injuries and the body parts affected. OSHA has preliminarily determined that its collection of these individual forms' information poses a non-trivial risk of compelled disclosure—endangering worker privacy—under FOIA.

As records in federal possession, Forms 300, 300A, and 301 could be subject to disclosure under FOIA if a court determines that no exemptions to FOIA apply. Although the Department believes that the information in these forms should be held exempt under FOIA, there remains a meaningful risk that a court may ultimately disagree and require disclosure. That risk remains so long as there is a non-trivial chance that any court in any of the nation's 94 federal judicial districts might issue a final disclosure order after the exhaustion of all available appeals. In the Department's view, that risk is not a reason to stop collecting Form 300A summaries, because their collection offers significant enforcement value with little privacy risk. However, OSHA has re-evaluated the utility of routinely collecting the Form 300 and 301 data for enforcement purposes, given that it has already designed a targeted enforcement mechanism using the summary data, and given the resources that would be required to collect, process, analyze, distribute, and programmatically apply the case-specific data in a meaningful way. Therefore, OSHA believes that the risk of disclosure under FOIA is a persuasive reason not to collect individual case information from Forms 300 and 301, as that collection offers only uncertain enforcement value while putting workers' privacy at risk.

Nor is that risk speculative. In 2017, an organization invoked FOIA to request that the Department produce electronically-submitted information from Forms 300, 300A, and 301. The Department explained to the requester that it had not begun collecting Forms 300 and 301, and that Form 300A is exempt from disclosure under FOIA. The requester then sued the Department to compel disclosure of electronic information from Form 300A (and presumably would have demanded production of information from Forms 300 and 301, had the Department started collecting them). Although the Department strongly believes that Form 300A is exempt from disclosure under FOIA, the plaintiff's complaint is non-frivolous (cf. Fed. R. Civ. P. 11). It is accordingly possible that the adjudicating court could order disclosure of information in Form 300A. After the exhaustion of any appeals, that order would establish a precedent that other courts may find persuasive in potential future litigation over information in Forms 300 and 301.

That risk of potential compelled disclosure is illustrated by a case in which the Department was ordered to disclose OSHA records collecting its individual inspectors' exposures to beryllium. Finkel v. U.S. Dep't of Labor, No. 05-5525, 2007 WL 1963163 (D.N.J. June 29, 2007). In that case, the Department produced de-identified test results, but the court ultimately determined that more identifying information needed to be disclosed, despite FOIA's exemption for “information . . . in personnel, medical or similar files . . . [whose] release would constitute a clearly unwarranted invasion of personal privacy.” Arieff v. U.S. Dep't of Navy, 712 F.2d 1462, 1466 (D.C. Cir. 1983), quoted in Finkel, 2007 WL 1963163, at *8. While the Department believes that Finkel would be distinguishable from any future cases seeking FOIA disclosure of information from individual Forms 300 and 301, it is reasonably foreseeable that a court could find it persuasive nonetheless.

And as the Finkel case suggests, it may not be possible to fully redact all identifying information in a way that would eliminate privacy risk. Releasing case-specific data to a member of the public could result in the inadvertent release of personally identifiable information (PII) or re-identification of the data with a particular individual. Although automated systems exist to scrub PII from the data (see “Text De-Identification For Privacy Protection: A Study of its Impact on Clinical Text Information Content,” Stéphane M. Meystre et al., Journal of Biomedical Informatics 50 (2014) 142-150, Ex. 2061), it is not possible to guarantee the non-release of PII. Simson L. Garfinkel states “de-identification approaches based on suppressing or generalizing specific fields in a database cannot provide absolute privacy guarantees, because there is always a chance that the remaining data can be re-identified using an auxiliary dataset.” (see “De-Identification of Personal Information,” p. 5, Simson L. Garfinkel, NISTIR 8053, October 2015, Ex. 2060). Similarly, Mehmet Kayaalp observed, “The de-identification process minimizes the risk of re-identification but has no claim to make it impossible.” (see “Modes of De-identification,” p. 2, Mehmet Kayaalp, MD, Ph.D., U.S. National Library of Medicine, National Institutes of Health, 2017, Ex. 2062). In addition, de-identification is not the same as anonymization. That is, even after all PII has been removed, there is the chance that somebody could re-identify some of the data by linking the fully de-identified data back to the specific person.

Unless the U.S. Supreme Court (or sufficient circuit-court precedent, at least) were to definitively affirm that the information in Forms 300 and 301 is exempt from FOIA disclosure, there remains a real risk that the private, sensitive information from those forms could be disclosed regardless of the Department's attempts to keep it private.^[2] In the Department's view, that risk to worker privacy is unacceptable.

b. Collecting Forms 300 and 301 Has Uncertain Enforcement Benefits

As its preamble explains, two of the benefits of the May 2016 final rule are more effective identification and targeting of workplace hazards by OSHA and better evaluations of OSHA interventions. See 81 FR 29685. According to the preamble, establishment-specific injury and illness data would allow for analyses that were not possible with the data available before the 2016 rule took effect. The establishment-specific data, the preamble concluded, would allow OSHA to evaluate different types of programs, initiatives, and interventions in different industries and geographic areas, enabling the agency to become more effective and efficient.

OSHA reaffirms those benefits—as to the collection of information from the summary Form 300A. Collection of the summary data gives OSHA the information it needs to identify and target establishments with high rates of work-related injuries and illnesses. OSHA has collected summary 300A data for 2016 from 214,574 establishments. With those data, OSHA has already designed a targeted enforcement mechanism for industries experiencing higher rates of injuries and illnesses. OSHA plans to further refine this approach by using the greater volume of 2017 summary data OSHA expects to collect, as explained in the margin.^[3]

OSHA's use of summary data has a lengthy track record in enforcement, as well. Before the 2016 rule, OSHA had collected these data for 17 years under its OSHA Data Initiative (ODI) and used them to identify and target high-rate establishments through the Site-Specific Targeting (SST) Program. OSHA stopped the ODI in 2013 and the SST in 2014, but those prior programs have still given it considerable experience with using 300A data for targeting.

Conversely, OSHA has no prior experience with using the case-specific Form 300 and 301 data to identify and target establishments. OSHA is unsure as to how much benefit such data would have for targeting, or how much effort would be required to realize those benefits. OSHA estimates ^[4] that establishments with 250 employees or more would report data from approximately 775,210 Form 301s annually, a total volume three times the number of Form 300As whose data was uploaded for 2016, while also presenting finer-grained information than that captured by Form 300A. To gain (speculative, uncertain) enforcement value from the case-specific data, OSHA would need to divert resources from other priorities, such as the utilization of Form 300A data, which OSHA's long experience has shown to be useful.^[5]

OSHA's current priority is to assure better compliance with the existing reporting requirements for severe injuries and fatalities and for 300A data, and to develop and assess intervention programs based on these data. OSHA estimates, for example, that over 100,000 establishments failed to submit their 2016 Form 300A data as required by the 2016 rule, and is currently taking steps aimed at reducing the number of non-responders for the 2017 reporting year.^[6] Similarly, in the September 18, 2014, final rule that updated the severe injury reporting requirements under 29 CFR part 1904.39, OSHA estimated that more than 100,000 reports of in-patient hospitalizations and amputations would be made to the Agency. In calendar year 2017, fewer than 16,000 incidents were reported.^[7 8] OSHA intends to use available data sources (e.g., workers compensation records) to identify and categorize employers who are non-compliant with the reporting requirements. This information can then be used to focus training and outreach efforts for improving compliance with these reporting requirements. But for the time being, given OSHA's enforcement focus on its readily-usable 300A and severe injury data and its uncertainty about the extent of the benefits from collecting 300 and 301 data, the Department has re-evaluated the utility of the Form 300 and 301 data to OSHA for enforcement purposes and preliminarily determined that its (uncertain) enforcement value does not justify the reporting burden on employers, the burden on OSHA to collect, process, analyze, distribute, and programmatically apply the data, and—especially—the risks posed to worker privacy.

c. Comments

OSHA welcomes comments from the public on the benefits and disadvantages of removing the requirement for employers with 250 or more employees to submit the data from OSHA Forms 300 and 301 to OSHA electronically on an annual basis, including the usefulness of the data for enforcement targeting, the burden on employers of submitting that data, and the risks its collection poses to worker privacy.

2. Section 1904.41, Paragraphs (b)(1)-(8)

Paragraphs (b)(1) through (8) of § 1904.41 currently address implementation of the electronic submission requirements for the information on OSHA Forms 300, 301, and 300A. OSHA is proposing to reconcile these provisions with the removal of the annual electronic submission requirement for the information on OSHA Forms 300 and 301 in proposed § 1904.41(a), as explained above. Therefore, the proposed provisions in paragraphs (b)(1)-(8) would provide for the implementation of electronic submission requirements only for the information on OSHA Form 300A.

OSHA invites public comment on these proposals during the comment period.

3. Employer Identification Number

OSHA limited the proposed data collection in its 2013 NPRM (78 FR 67254) to Improve Tracking of Workplace Injuries and Illnesses to records that employers were already required to collect under part 1904. Accordingly, the May 2016 final rule only required the electronic submission of such records. These records do not include the EIN.

OSHA now seeks comment on this proposal to add a requirement for employers to submit their EIN along with their injury and illness data because the Agency believes such a requirement could reduce or eliminate duplicative reporting. Collecting EINs would increase the likelihood that the Bureau of Labor Statistics (BLS) would be able to match data collected by OSHA under the electronic reporting requirements to data collected by BLS for the Survey of Occupational Injury and Illness (SOII). The BLS records contain the EINs for establishments, and including the EIN in the OSHA collection will increase the accuracy of matching the OSHA-collected data to the BLS-collected data. The ability to accurately match the data is critical for evaluating how BLS might use OSHA-collected data to supplement the SOII, which in turn would enhance the ability of OSHA and other users of the SOII data to identify occupational injury and illness trends and emerging issues. Furthermore, the ability of BLS to match the OSHA-collected data also has the potential to reduce the burden on employers who are required to report injury and illness data both to OSHA (for the electronic recordkeeping requirement) and to BLS (for the SOII). OSHA and BLS are also collaborating to identify technological approaches to reduce respondent burden. This collaboration includes exploring changes to both data collection systems as well as real-time sharing of OSHA data with BLS, with the goal of streamlining the reporting process for respondents covered under both collections.

The SOII is an establishment survey and is a comprehensive source of national estimates of nonfatal injuries and illnesses that occur in the workplace. The SOII collects data on non-fatal injuries and illnesses for each calendar year from a sample of employers based on recordable injuries and illnesses as defined by OSHA in 29 CFR part 1904. Using data from the survey, BLS estimates annual counts and rates by industry and state for workers in private industry and state and local government. In addition, the SOII provides details about the most severe injuries and illnesses (those involving days away from work), including characteristics of the workers involved and details of the circumstances surrounding the incident, using data collected on Forms 300A and 301 from the sampled establishments (see BLS Handbook of Methods: https://www.bls.gov/​opub/​hom/​soii/​home.htm).

Given the limitations of matching establishments across databases, there is currently no methodological approach to completely match establishments that currently submit data under both OSHA's collection of injury and illness data under § 1904.41 and the BLS data collection for the SOII. BLS cannot provide its collected data to OSHA because the Confidential Information Protection and Statistical Efficiency Act of 2002 (Pub. L. 107-347, 116 Stat. 2899 (2002)) prohibits BLS from releasing establishment-specific data to either OSHA or the general public. Although OSHA can provide the data it collects to BLS, without the EIN it is very difficult to match the establishments in OSHA's data collection to the establishments in BLS's data collection. Not having the EIN increases the resources necessary to produce the match and reduces the accuracy of the match.

Including the EIN in the electronic reporting to OSHA would improve BLS's ability to accurately match the OSHA-collected data with the SOII data. After evaluation of the accuracy of the data matching, it may be possible for BLS to use the OSHA-collected data in the generation of occupational injuries and illnesses estimates, reducing burden on employers. If the EIN is not collected and the data from the two sources cannot be accurately matched, reducing this burden becomes nearly impossible. Collecting the EIN would thus accord with a recommendation in the 2018 National Academy of Sciences, Engineering, and Medicine report on A Smarter National Surveillance System for Occupational Safety and Health in the 21st Century: “To avoid duplicate reporting, OSHA and BLS should integrate data-collection efforts so that employers selected in the annual BLS sample for SOII but reporting electronically to OSHA need not make separate reports to BLS” (see Ex. 2063).

Including the EIN as part of electronic reporting might also improve the quality and utility of the collected data. For example, OSHA could use the EIN to identify errors such as multiple submissions of data from the same establishment and to link multiple years of data submissions from the same establishment. The EIN could also be used to match against other databases that contain this identifier to add additional characteristics to the data. For example, submissions could be linked to the OSHA Information System (OIS) to identify the previous enforcement history of the establishment when the inspection records contain the EIN.

OSHA notes that EINs do not have the same level of protection as Social Security numbers. For example, any publicly-traded company must put its EIN on public filings with the U.S. Securities and Exchange Commission. Within DOL, the Employee Benefits Security Administration (EBSA) discloses EINs associated with filings of the Annual Returns/Reports of Employee Benefit Plans (Form 5500); EIN is a searchable field on EBSA's “Form 5500/5000-SF Filing Search” web page (see https://www.efast.dol.gov/​welcome.html), and the search results are listed in ascending order by EIN. Other agencies also make EINs public in filings, such as the Federal Communications Commission's Commission Registration System (CORES). Businesses also have to share EINs with contractors and clients for tax reporting, such as filing an IRS Form 1099. As a result, DOL has not generally withheld EINs from disclosure.

OSHA invites public comment on the advantages and disadvantages of requiring employer submission of EINs and on whether employers required to electronically report information to OSHA under part 1904 would consider the EIN to be exempt from disclosure, either as confidential business information or for another reason.

B. Additional Questions

OSHA seeks comments and data from the public regarding the proposed rule to remove the requirement for establishments with 250 or more employees that are required to routinely keep injury and illness records to electronically submit information from the OSHA Form 300 and 301 and to add the requirement for covered establishments to submit their EIN. More specifically, the following questions are relevant to this rulemaking:

1. What risks to worker privacy are posed by the electronic collection of information from Forms 300 and 301 from establishments with 250 or more workers? How likely are these risks to materialize? How could OSHA make them less likely, and what resources would be required? Given the limitations identified above, what are the benefits of electronically collecting this information?

2. Besides the Bureau of Labor Statistics, what other agencies or organizations in the public and private sectors use automated coding (autocoding) systems for text data in data collections?

3. Besides the Department of Health and Human Services, what other agencies and organizations in the public and private sectors use automated de-identification systems to remove PII from text data before making the data available to the public? What challenges have they faced in using those systems to keep PII protected?

4. Would employers required to electronically report information to OSHA under part 1904 consider the EIN to be exempt from disclosure, either as confidential business information or for another reason? Are there any circumstances where the EIN would be considered Personally Identifiable Information (PII)? OSHA also seeks comments on privacy concerns that might arise from employers submitting their EIN.

OSHA is only seeking comment on the proposed changes to § 1904.41 in this NPRM, and not on any other aspects of part 1904.

IV. Preliminary Economic Analysis and Regulatory Flexibility Certification

A. Introduction

E.O. 12866 and E.O. 13563 require that OSHA estimate the benefits, costs, and net benefits of proposed and final regulations. Executive Orders 12866 and 13563, the Regulatory Flexibility Act (5 U.S.C. 601-612) and the Unfunded Mandates Reform Act (UMRA) (2 U.S.C. 1501-1571) also require OSHA to estimate the costs, assess the benefits, and analyze the impacts of certain rules that the Agency promulgates. Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety, and other effects; distributive impacts; and equity). Executive Order 13563 emphasizes the importance of quantifying both costs and benefits, reducing costs, harmonizing rules, and promoting flexibility.

This proposed rule would protect worker privacy and reduce costs for employers and OSHA by amending OSHA's recordkeeping regulation to remove the requirement for the annual electronic collection of information from OSHA Forms 300 and 301. OSHA estimates that the rule would have net cost savings of $8.28 million per year at a 3 percent discount rate, including $8.23 million per year for the private sector and $52,754 per year for the government. Annualized at a 7 percent discount rate, the proposed rule would have net cost savings of $8.25 million per year, including $8.18 million per year for the private sector and $64,070 per year for the government. Annualized at a perpetual 7 percent discount rate, the proposed rule would have net cost savings of $8.35 million per year. As explained above, OSHA has preliminarily determined that the electronic collection of information in the OSHA 300 and 301 forms poses risks to worker privacy and additional cost to employers and OSHA that outweigh the uncertain enforcement benefits of collecting it.

The proposed rule is not an “economically significant regulatory action” under E.O. 12866 or UMRA (2 U.S.C. 1532(a)), and it is not a “major rule” under the Congressional Review Act (CRA) (5 U.S.C. 801 et seq.). The Agency estimates that the rulemaking imposes far less than $100 million in annual economic costs. In addition, it does not meet any of the other criteria specified by UMRA or CRA for a significant regulatory action or major rule.

B. Cost Savings

For this PEA, OSHA relied on the Final Economic Analysis (FEA) in the May 2016 final rule (81 FR 29624), updated to include more recent data and some modifications in OSHA's methodology. OSHA obtained the estimated cost of electronic data submission by multiplying the compensation per hour of the person expected to perform the task of electronic data submission by the time required to submit the data.

As in the 2016 FEA, OSHA selected an employee in the occupation of Industrial Health and Safety Specialist and Technician as being at the appropriate salary level. The mean hourly wage for Standard Occupational Classification (SOC) code 29-9011, Industrial Health and Safety Specialists, in the May 2016 data from the BLS Occupational Employment Survey (OES), was $34.85.^[9] (The mean hourly wage used in the 2016 FEA was $33.88, using May 2014 data from OES.) This was the raw wage and did not include the other fringe benefits that make up full hourly compensation or overhead costs calculated in this document. Through the current electronic collection of 300A data, OSHA is collecting data on the occupations of employees responsible for submitting data. This information is collected as a part of the sign-up process where establishments create their user accounts; one of the fields for a new user is their job title. OSHA may use these data to revise the estimates in the final rule. In addition, OSHA welcomes comment on whether “Industrial Health and Safety Specialist and Technician” is the appropriate salary level for the employee performing this task.

The June 2017 data from the BLS National Compensation Survey ^[10] reported a mean fringe benefit factor of 1.44 for workers in private industry. (The mean fringe benefit factor used in the 2016 FEA was the same, using December 2014 data from the BLS National Compensation Survey.) OSHA multiplied the mean hourly wage by the mean fringe benefit factor to obtain an estimated total compensation (wages and benefits) for Industrial Health and Safety Specialists of $50.18 per hour ($34.85 × 1.44). The estimated total compensation (wages and benefits) used in the 2016 FEA was $48.78 per hour, so this estimate in this PEA represents an increase of 3 percent, due to the increase in the mean hourly wage.

OSHA recognizes that not all firms assign the responsibility for recordkeeping to an Industrial Health and Safety Specialist. For example, a smaller firm may use a bookkeeper or a plant manager, while a larger firm may use a higher-level specialist. However, OSHA believes that the calculated cost of $50.18 per hour is a reasonable estimated total hourly compensation for a typical record keeper.

Additionally, after publishing the May 2016 final rule, the Department of Labor determined that it is appropriate in some circumstances to account for overhead expenses as part of the methodology used to estimate the costs and economic impacts of OSHA regulations. Therefore, for this PEA, OSHA is updating the projected costs of the requirement for establishments with 250 or more employees to submit the information from OSHA Forms 300 and 301 to OSHA, as reflected in the 2016 FEA, by adding an overhead rate equivalent to 17 percent of base wages. For this PEA, OSHA included an overhead rate when estimating the marginal cost of labor in its primary cost calculation. Overhead costs are indirect expenses that cannot be tied to producing a specific product or service. Common examples include rent, utilities, and office equipment. Unfortunately, there is no general consensus on the cost elements that fit this definition. The lack of a common definition has led to a wide range of overhead estimates. Consequently, the treatment of overhead costs needs to be case-specific. OSHA adopted an overhead rate of 17 percent of base wages. This is consistent with the overhead rate used for sensitivity analyses in the FEA in support of the 2017 final rule delaying the deadline for submission of 300A data (82 FR 55761) and the FEA in support of OSHA's 2016 final standard on Occupational Exposure to Respirable Crystalline Silica.^[11] For example, to calculate the total labor cost for an Industrial Health and Safety Specialist, Standard Occupational Classification (SOC) code 29-9011, three components are added together: base wage ($34.85) + fringe benefits ($15.33, derived as 44% of $34.85) + applicable overhead costs ($5.92, derived as 17% of $34.85). This increases the labor cost of the fully-loaded hourly wage for an Industrial Health and Safety Specialist to $56.10.

For time required for the data submission in this PEA, OSHA uses the same estimated unit time requirements as reported by BLS in its paperwork burden analysis for the Survey of Occupational Injuries and Illnesses (SOII) (OMB Control Number 1220-0045, expires December 31, 2018). BLS estimated 10 minutes per recordable injury/illness case for electronic submission of the information on Form 300 (Log of Work-Related Injuries and Illnesses) and Form 301 (Injury and Illness Incident Report). In addition, in the 2016 FEA, OSHA estimated 2 minutes more time than the BLS paperwork burden, for a total of 12 minutes per recordable case (10 minutes per case for Form 301 entries plus 2 minutes per case for entry of Form 300 log entries), to account for the differences between BLS and OSHA submission requirements.

The proposed rule would remove the requirement for establishments with 250 or more employees to report information from OSHA Forms 300 and 301. To estimate the number of injuries and illnesses that would be reported by covered establishments with 250 or more employees under the current rule, OSHA assumed that the total number of recordable cases in establishments with 250 or more employees is proportional to the establishments' share of employment within each industry.^[12] OSHA then used the most recent SOII data to estimate that, without the proposed rule, covered establishments with 250 or more employees would report 775,210 injury and illness cases per year.^[13] The cost per case is estimated at $11.22 (12/60 × $56.10), and the total cost is $8,699,173 ($11.22 per case × 775,210 cases).^[14] Therefore, the proposal to remove the requirement to submit the information from OSHA Form 300 and 301 to OSHA electronically would result in a total cost savings to the private sector of $8,699,173.^[15]

The 2016 FEA also included government costs for the rule because creating a reporting and data collection system was a significant fraction of the total costs of the regulation. Not collecting the case-specific data from OSHA Form 300 and 301 would generate a small additional cost savings for the government because that portion of the reporting and data collection system has not yet been created and would not have to be created under the proposed rule. OSHA estimates a lump sum savings from not creating the software to collect the 300 and 301 data to be $450,000. Annualized at 3 percent over 10 years, this would represent a savings to the government of $52,754 per year. OSHA also annualized the cost savings at 7 percent over 10 years, and using this discount rate, the cost savings would be slightly higher: $64,070.

C. New Costs (From the EIN Collection)

Establishments would be newly required to submit the employer's EIN along with the employer's electronic data submission. Some employees given this task would already know their employer's EIN from their other duties, but others would need to spend some time finding out this information. OSHA estimates an average of 5 minutes for an employee to find out his or her employer's EIN and to enter it on the submission form. Hence the unit cost for a submission would be the wage of the employee who submitted the information multiplied by his or her time plus overhead, or $4.68 [(5/60) × $56.10].

The electronic reporting system is designed to retain information about each establishment based on the login information, including the EIN. Therefore, employers would only have to provide OSHA their EIN once, so this would not be a recurring cost. However, it would be an additional one-time cost for employers who are newly reporting data because, for example, the establishment is new or the employer newly reached the reporting threshold for employment size. OSHA has estimated that each year there will be about 10.15 percent more establishments that will be required to report their EIN. This 10.15 percent figure is derived from the U.S. Census Bureau Statistics of U.S. Businesses (SUSB), specifically the employment change data set ^[16] which show the increase in U.S. business establishments from 2014 to 2015. In 2015 there were 689,819 new establishments, out of a total 6,795,201 establishments. Dividing the first figure by the second gives a change of about 10.15 percent.

To calculate the total estimated costs for covered establishments to provide their EINs, OSHA used establishment and employment data from the U.S. Census County Business Patterns (CBP).^[17] The three categories of included establishments are (1) all establishments with 250 or more employees in industries that are required to routinely keep OSHA injury and illness records, (2) establishments with 20-249 employees in certain high-hazard industries, as defined in the Appendix to the May 2016 final rule, and (3) farms and ranches with 20 or more employees. CBP data do not include numbers of farms and ranches with 20 or more employees, so in the May 2016 final rule, OSHA used data from the 2012 Census of Agriculture. Updated data from the 2017 Census of Agriculture are not available at this time, so OSHA will continue to use a count of 20,623 farms with 20 or more employees. CBP data show that there are 36,903 establishments with 250 or more employees in industries required to routinely keep records and 405,666 establishments with 20-249 employees in the designated high-hazard industries. Combining these figures with 20,623 farms and ranches results in a total of 463,192 establishments that would be required to submit an EIN under the proposed rule. With a cost per establishment of $4.68, the total first year cost of providing EINs would be $2,165,751 (463,192 × $4.68).^[18] When this cost is annualized over ten years, the annualized cost at a 3 percent discount rate is $253,892 and at a 7 percent discount rate the cost is $308,354.

There are 463,192 establishments (including establishments with more than 250 employees, those with 20-249 employees in certain NAICS codes, and farms with more than 20 employees) that would be subject to reporting their EIN in the first year under this proposal. With 10.15 percent new establishments each year, there will be an additional 47,012 establishments each year. The cost for those establishments will be $4.68 × 47,012 or $219,858. This cost does not occur in the first year. OSHA annualized 9 years of new establishment costs over ten years, which results in annualized costs of $213,262 at a discount rate of 3 percent and $204,468 at a 7 percent discount rate.

The EIN data field is already included in the reporting system design, so there would be no additional government costs associated with submittal of the EIN.

D. Net Cost Savings

The cost savings of the proposed rule, the new costs associated with collecting the EIN, and the net total cost savings are shown in Table 1. Combining the cost savings to the private sector and to the government, the estimated total annual cost savings from the proposed rule would be $8,751,927 at a 3 percent discount rate and $8,763,243 at 7 percent discount rate. The additional costs to the private sector from collection of the EIN are estimated to be $467,194 at a 3 percent discount rate and $512,822 at 7 percent discount rate. The net cost savings for this proposal are estimated to be $8,284,733 at a 3 percent discount rate and $8,250,421 at 7 percent discount rate.

Table I—Total Cost Savings and Total Additional Costs of the Proposed Rule

Cost savings element	Annual cost savings
Cost savings for eliminating electronic submission of part 1904 records by establishments with 250 or more employees (Total Private Sector Savings)	$8,699,173
Total Government Cost Savings, 3 percent discount rate over ten years	52,754
Total Government Cost Savings, 7 percent discount rate over ten years	64,070
Total Cost Savings per year, 3 percent discount rate over ten years	8,751,927
Total Cost Savings per year, 7 percent discount rate over ten years	8,763,243

New costs from EIN collection	Cost
First Year EIN Cost	$2,165,751
Annualized First Year Costs, 3 percent discount rate over ten years	253,892
Annualized First Year Costs, 7 percent discount rate over ten years	308,354
Subsequent Annual EIN Costs (from new establishments), starting in second year	219,858
Subsequent annual EIN Cost Annualized at a 3 percent discount rate over ten years	213,262
Subsequent annual EIN Cost Annualized at a 7 percent discount rate over ten years	204,468
Annualized Total EIN Cost, 3 percent discount rate over ten years	467,194
Annualized Total EIN Cost, 7 percent discount rate over ten years	512,822
Net Cost Savings, 3 percent discount rate over ten years	8,284,733
Net Cost Savings, 7 percent discount rate over ten years	8,250,421

There could be substantial cost savings from requiring covered employers to include the EIN in their reporting. There is roughly a 40% overlap between the BLS SOII sample and private sector establishments required to report to OSHA. If OSHA collected Form 300A from all covered private sector units and BLS were able to fully match these units and use them in generating SOII estimates, the reduction in duplication would represent approximately 15,000 hours of respondent burden. In its SOII paperwork burden analysis, BLS estimates the total cost of submitting this form for private sector establishments to be $891,000. The potential cost savings for avoiding duplication is 40 percent of this value—$356,000. Considering that the cost savings for avoiding duplication is perpetual, the total net savings for adding the EIN is estimated to be $2,648,850 at a 3 percent discount rate and $126,294 at 7 percent discount rate in a perpetual time horizon.

E. Benefits

The value of worker privacy is impossible to quantify, but no less significant because of that fact. This proposed rule would protect worker privacy by preventing routine government collection of information that may be quite sensitive, including descriptions of workers' injuries and the body parts affected, and thereby avoiding the risk that such information might be publicly disclosed under FOIA.

OSHA further believes that the collection of individual information from Forms 300 and 301 could add enforcement benefits, but those benefits are uncertain and difficult to quantify. As noted above, these benefits are uncertain because OSHA lacks experience with the use of that information and is not sure about how many resources it would take to make meaningful use of that information. The loss of these uncertain benefits is also impossible to quantify.

OSHA has preliminarily determined that the (substantial) benefits to worker privacy outweigh the (uncertain) foregone benefits to enforcement. It welcomes public comment on this determination, including on its preliminary conclusions that neither worker privacy nor enforcement benefits can be meaningfully quantified.

F. Economic Feasibility

Removing the requirement for establishments with 250 or more employees to submit the information from OSHA Forms 300 and 301 to OSHA annually would reduce costs and so would have no negative feasibility effects. The EIN requirement would cost an estimated $4.68 per establishment, still leaving a large overall reduction in costs, and so would be economically feasible. Hence, OSHA concludes that the proposed rule is economically feasible.

G. Regulatory Flexibility Certification

The current requirement for annual electronic submission of information from OSHA Forms 300 and 301 affects only a very small minority of small firms. In many industry sectors, there are no small firms with at least 250 employees. Even in those industry sectors where the definition of small firm includes some firms with at least 250 employees, the overwhelming majority of small firms have fewer than 250 employees. However, there will be some small firms affected in some industries. Removing this requirement as proposed would result in a cost savings of, on average, $236 per establishment for each establishment with 250 or more employees affected by the 2016 Final Rule. This number is derived by dividing the total cost savings of $8,699,173 by 36,903 affected establishments with 250 or more employees. Such a small amount of cost savings would not have a significant impact on a firm with 250 or more employees.

As above, removing the requirement for establishments with 250 or more employees to submit the information from OSHA Forms 300 and 301 annually to OSHA would reduce costs, and the estimated cost of the EIN requirement is $4.68 per establishment, a negligible amount. Hence, per § 605 of the Regulatory Flexibility Act, OSHA certifies that this proposed rule will not have a significant economic impact on a substantial number of small entities.

V. OMB Review Under the Paperwork Reduction Act of 1995

This proposed rule would revise an existing collection of information, as defined and covered by the Paperwork Reduction Act of 1995 (PRA) and its implementing regulations, that is subject to review by OMB under the PRA (44 U.S.C. 3501-3521) and OMB regulations (5 CFR part 1320). The PRA requires that agencies obtain approval from OMB before conducting any collection of information (44 U.S.C. 3507). The PRA defines a “collection of information” as “the obtaining, causing to be obtained, soliciting, or requiring the disclosure to third parties or the public of facts or opinions by or for an agency regardless of form or format” (44 U.S.C. 3502(3)(A)).

OSHA's existing recordkeeping forms consist of the OSHA 300 Log, the 300A Summary, and the 301 Incident Report. These forms are contained in the Information Collection Request (ICR) (paperwork package) titled 29 CFR part 1904 Recording and Reporting Occupational Injuries and Illnesses, which OMB approved under OMB Control Number 1218-0176.

The proposed rule would affect the ICR estimates as follows:

1. Establishments that are subject to the part 1904 requirements and have 250 or more employees would no longer be required to electronically submit information recorded on their OSHA Forms 300 and 301 to OSHA once a year.

2. Establishments subject to the data collection would provide one additional data element, the EIN.

The burden hours for the electronic reporting requirements under § 1904.41 if revised as proposed are estimated to be 136,641 per year. There are no capital costs for this collection of information.

More specifically, this action proposes to amend the recordkeeping regulation to remove the requirement for establishments that are required to keep injury and illness records under part 1904, and that had 250 or more employees in the previous year, to electronically submit to OSHA or OSHA's designee case characteristic information from the OSHA Form 300 (Log of Work-Related Injuries and Illnesses) and OSHA Form 301 (Injury and Illness Incident Report) once a year. Under the proposed rule, these establishments would only be required to submit summary information from the OSHA Form 300A. There are approximately 37,000 establishments that would no longer be subject to a requirement to submit the information on OSHA Forms 300 and 301 for approximately 775,000 injury and illness cases under the proposed rule. OSHA used 2015 SOII data (https://www.bls.gov/​iif/​oshwc/​osh/​os/​ostb4734.pdf) to estimate that, without the proposed rule, covered establishments with 250 or more employees would report 775,210 injury and illness cases per year.) Also, OSHA requests comment on requiring 463,000 employers to submit their EIN to OSHA.

The table below presents the components of the collection that comprise the ICR estimates.

	Estimated burden under current reporting requirements			Estimated burden under proposed reporting requirements
	Number of cases	Unit hours per case	Total burden hours	Number of cases	Unit hours per case	Total burden hours
§ 1904.41(a)(1)—Create a new account	3,690	0.167	616	3,690	0.167	616
§ 1904.41(a)(1)—provide EIN	0	0.083	0	36,903	0.083	3,063
§ 1904.41(a)(1)—electronic submission of OSHA Form 300A data by establishments with 250 or more employees	36,903	0.167	6,163	36,903	0.167	6,163
§ 1904.41(a)(1)—electronic submission of injury and illness case data by establishments with 250 or more employees	775,210	0.2	155,042	0	0.2	0
§ 1904.41(a)(2)—Create a new account	40,567	0.167	6,775	40,567	0.167	6,775
§ 1904.41(a)(2)—provide EIN	0	0.083	0	426,285	0.083	35,382
§ 1904.41(a)(2)—electronic submission of OSHA Form 300A data by establishments with 20 or more employees but fewer than 250 employees in designated industries	385,383	0.167	64,359	385,383	0.167	64,359
§ 1904.41(a)(2)—electronic submission of OSHA Form 300A data by establishments with 20 or more employees but fewer than 250 employees in designated industries—with no internet connection	20,283	1	20,283	20,283	1	20,283
§ 1904.41(a)(3)—Electronic submission of part 1904 records upon notification	0	0	0	0	0	0
Total burden hours			253,238			136,641

As required by 5 CFR 1320.5(a)(1)(iv) and 1320.8(d)(2), the following paragraphs provide information about this ICR.

1. Title: Recording and Reporting Occupational Injuries and Illnesses (29 CFR part 1904).

2. Number of respondents: 1,002,912.

3. Frequency of responses: Annually.

4. Number of responses: 5,839,692.

5. Average time per response: 22 minutes.

6. Estimated total burden hours: 2,136,953 hours.

7. Estimated costs (capital-operation and maintenance): $0.

Members of the public may comment on the paperwork requirements in this proposed regulation by sending their written comments to the Office of Information and Regulatory Affairs, Attn: OMB Desk Officer for the Department of Labor, OSHA (Regulation Identifier Number (RIN) 1218-AD17), Office of Management and Budget, Room 10235, Washington, DC 20503; telephone: [phone]; fax: [phone] (these are not toll-free numbers); email: [e-mail]. Please limit the comments to only the proposed changed provisions of the recordkeeping rule related to information collection (i.e., proposed § 1904.41).

OSHA also encourages commenters to submit their comments on these paperwork requirements to the rulemaking docket (OSHA-2013-0023), along with their comments on other parts of the proposed regulation. For instructions on submitting these comments to the docket, see the sections of this Federal Register document titled DATES and ADDRESSES.

Comments submitted in response to this document are public records; therefore, OSHA cautions commenters about submitting personal information such as Social Security numbers and dates of birth. To access the docket to read or download comments and other materials related to this paperwork determination, including the complete ICR, use the procedures described under the section of this document titled ADDRESSES. You may obtain an electronic copy of the complete ICR by going to the website at http://www.reginfo.gov/​public/​do/​PRAMain,, then selecting “Department of Labor” under “Currently Under Review,” then clicking on “submit.” This will show all of the Department's ICRs currently under review, including the ICRs submitted for proposed rulemakings. To make inquiries, or to request other information, contact Mr. Charles McCormick, Directorate of Standards and Guidance, OSHA, telephone: [phone]; email: [e-mail].

OSHA and OMB are particularly interested in comments that:

• Evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility;
• Evaluate the accuracy of the agency's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used;
• Enhance the quality, utility, and clarity of the information to be collected; and
• Minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses.

OSHA notes that a federal agency cannot conduct or sponsor a collection of information unless OMB approves it under the PRA, and the information collection displays a currently-valid OMB control number. Also, notwithstanding any other provision of law, no party shall be subject to penalty for failing to comply with a collection of information if the collection of information does not display a currently-valid OMB control number. OSHA will publish a notice of OMB's action when it publishes the final regulation, or, if not approved by then, when OMB authorizes the information collection requirements under the PRA.

VI. Unfunded Mandates

For purposes of the UMRA (2 U.S.C. 1501-1571), as well as E.O. 13132 (64 FR 43255 (Aug. 4, 1999)), this rule does not include any federal mandate that may result in increased expenditures by state, local, and tribal governments, or increased expenditures by the private sector of more than $100 million.

VII. Federalism

The proposed rule has been reviewed in accordance with Executive Order 13132, regarding federalism. Because this rulemaking involves a “regulation” issued under Sections 8 and 24 of the OSH Act, and is not an “occupational safety and health standard” issued under Section 6 of the OSH Act, the rule will not preempt state law (29 U.S.C. 667(a)). The effect of the proposed rule on states is discussed in Section VIII, State Plan States.

VIII. State Plan States

Pursuant to section 18 of the OSH Act (29 U.S.C. 667) and the requirements of 29 CFR 1904.37 and 1902.7, within 6 months after publication of the final OSHA rule, state-plan states must promulgate occupational injury and illness recording and reporting requirements that are substantially identical to those in 29 CFR part 1904 “Recording and Reporting Occupational Injuries and Illnesses.” All other injury and illness recording and reporting requirements (for example, industry exemptions, reporting of fatalities and hospitalizations, record retention, or employee involvement) that are promulgated by state-plan states may be more stringent than, or supplemental to, the federal requirements, but, because of the unique nature of the national recordkeeping program, states must consult with OSHA and obtain approval of such additional or more stringent reporting and recording requirements to ensure that they will not interfere with uniform reporting objectives (29 CFR 1904.37(b)(2), 29 CFR 1902.7). Also because of the need for a consistent national data system, employers in state-plan states must comply with federal requirements for the submission of data under part 1904 whether or not the state plan has implemented a substantially identical requirement by the time the federal requirement goes into effect. Therefore, although states will need to update their plans to match the Federal plan, there is no discretion involved, so this change should be relatively simple to make.

There are 28 state plan states and territories. The states and territories that cover private sector employers are Alaska, Arizona, California, Hawaii, Indiana, Iowa, Kentucky, Maryland, Michigan, Minnesota, Nevada, New Mexico, North Carolina, Oregon, Puerto Rico, South Carolina, Tennessee, Utah, Vermont, Virginia, Washington, and Wyoming. Connecticut, Illinois, Maine, New Jersey, New York, and the Virgin Islands have OSHA-approved state plans that apply to state and local government employees only.

IX. Public Participation

Because this rulemaking involves a regulation rather than a standard, it is governed by the notice and comment requirements in the Administrative Procedure Act (APA) (5 U.S.C. 553) rather than section 6 of the OSH Act (29 U.S.C. 655) and 29 CFR part 1911 (both of which only apply to “promulgating, modifying or revoking occupational safety or health standards” (29 CFR 1911.1)). Therefore, the OSH Act requirement to hold an informal public hearing (29 U.S.C. 655(b)(3)) on a proposed standard, when requested, does not apply to this rulemaking.

A. Public Submissions

OSHA invites comment on all aspects of the proposed rule. OSHA specifically encourages comment on the issues raised in the questions subsection. OSHA is not seeking comment on any other aspects of part 1904. Interested persons must submit comments by September 28, 2018. The Agency will carefully review and evaluate all comments, information, and data, as well as all other information in the rulemaking record, to determine how to proceed.

You may submit comments in response to this document (1) electronically at https://www.regulations.gov,, which is the federal e-rulemaking portal; (2) by fax; or (3) by hard copy. All submissions must identify the agency name and the OSHA docket number (Docket No. OSHA-2013-0023) or RIN (RIN 1218-AD17) for this rulemaking. You may supplement electronic submissions by uploading document files electronically. If, instead, you wish to mail additional materials in reference to an electronic or fax submission, you must submit three copies to the OSHA docket office (see ADDRESSES section). The additional materials must clearly identify your electronic comments by name, date, and docket number, so that OSHA can attach them to your comments.

Because of security-related procedures, the use of regular mail may cause a significant delay in the receipt of submissions. For information about security procedures concerning the delivery of materials by hand, express delivery, messenger, or courier service, please contact the OSHA docket office at [phone] (TTY [phone]).

B. Access to Docket

Comments in response to this Federal Register document are posted at https://,www.regulations.gov,, the federal e-rulemaking portal. Therefore, OSHA cautions individuals about submitting personal information such as Social Security numbers and birthdates. Although submissions are listed in the https://www.regulations.gov index, some information (e.g., copyrighted material) is not publicly available to read or download through that website. All comments and exhibits, including copyrighted material, are available for inspection at the OSHA docket office. Information on using https://www.regulations.gov to submit comments and access dockets is available on that website. Contact the OSHA docket office for information about materials not available through the website and for assistance in using the internet to locate docket submissions.

Electronic copies of this Federal Register document are available at https://www.regulations.gov. This document, as well as news releases and other relevant information, also are available at OSHA's web page at http://www.osha.gov. For specific information about OSHA's Recordkeeping rule, go to the Recordkeeping page on OSHA's web page.

List of Subjects in 29 CFR Part 1904

• Health statistics
• Occupational safety and health
• Reporting and recordkeeping requirements
• State plans

Signed at Washington, DC, on July 23, 2018.

Loren E. Sweatt,

Deputy Assistant Secretary of Labor for Occupational Safety and Health.

Amendments to Regulations

For the reasons stated in the preamble, OSHA proposes to amend part 1904 of chapter XVII of title 29 as follows:

PART 1904—[AMENDED]

Subpart E—Reporting Fatality, Injury and Illness Information to the Government

1. The authority citation for subpart E of 29 CFR part 1904 continues to read as follows:

Authority: 29 U.S.C. 657, 673, 5 U.S.C. 553, and Secretary of Labor's Order 1-2012 (77 FR 3912, Jan. 25, 2012).

2. In § 1904.41, revise the section heading and paragraph (a)(1), add paragraph (a)(4), and revise paragraph (b) to read as follows:

§ 1904.41

Electronic submission of Employer Identification Number (EIN) and injury and illness records to OSHA.

(a) * * *

(1) Annual electronic submission of OSHA Form 300A Summary of Work-Related Injuries and Illnesses by establishments with 250 or more employees. If your establishment had 250 or more employees at any time during the previous calendar year, and this part requires your establishment to keep records, then you must electronically submit information from OSHA Form 300A Summary of Work-Related Injuries and Illnesses to OSHA or OSHA's designee. You must submit the information once a year, no later than the date listed in paragraph (c) of this section of the year after the calendar year covered by the form (for example, 2019 for the 2018 form).

* * * * *

(4) Electronic submission of the Employer Identification Number (EIN). For each establishment that is subject to these reporting requirements, you must provide the EIN used by the establishment.

* * * * *

(b) Implementation—(1) Does every employer have to routinely submit this information to OSHA? No, only two categories of employers must routinely submit this information. First, if your establishment had 250 or more employees at any time during the previous calendar year, and this part requires your establishment to keep records, then you must submit the required information to OSHA once a year. Second, if your establishment had 20 or more employees but fewer than 250 employees at any time during the previous calendar year, and your establishment is classified in an industry listed in appendix A to subpart E of this part, then you must submit the required information to OSHA once a year. Employers in these two categories must submit the required information by the date listed in paragraph (c) of this section of the year after the calendar year covered by the form (for example, 2019 for the 2018 form). If you are not in either of these two categories, then you must submit the information to OSHA only if OSHA notifies you to do so for an individual data collection.

(2) Do part-time, seasonal, or temporary workers count as employees in the criteria for number of employees in paragraph (a) of this section? Yes, each individual employed in the establishment at any time during the calendar year counts as one employee, including full-time, part-time, seasonal, and temporary workers.

(3) How will OSHA notify me that I must submit information as part of an individual data collection under paragraph (a)(3) of this section? OSHA will notify you by mail if you will have to submit information as part of an individual data collection under paragraph (a)(3). OSHA will also announce individual data collections through publication in the Federal Register and the OSHA newsletter, and announcements on the OSHA website. If you are an employer who must routinely submit the information, then OSHA will not notify you about routine submittal.

(4) When do I have to submit the information? If you are required to submit information under paragraph (a)(1) or (2) of this section, then you must submit the information once a year, by the date listed in paragraph (c) of this section of the year after the calendar year covered by the form (for example, 2019 for the 2018 form). If you are submitting information because OSHA notified you to submit information as part of an individual data collection under paragraph (a)(3) of this section, then you must submit the information as specified in the notification.

(5) How do I submit the information? You must submit the information electronically. OSHA will provide a secure website for the electronic submission of information. For individual data collections under paragraph (a)(3) of this section, OSHA will include the website's location in the notification for the data collection.

(6) Do I have to submit information if my establishment is partially exempt from keeping OSHA injury and illness records? If you are partially exempt from keeping injury and illness records under §§ 1904.1 and/or 1904.2, then you do not have to routinely submit information under paragraphs (a)(1) and (2) of this section. You will have to submit information under paragraph (a)(3) of this section if OSHA informs you in writing that it will collect injury and illness information from you. If you receive such a notification, then you must keep the injury and illness records required by this part and submit information as directed.

(7) Do I have to submit information if I am located in a State Plan State? Yes, the requirements apply to employers located in State Plan States.

(8) May an enterprise or corporate office electronically submit information for its establishment(s)? Yes, if your enterprise or corporate office had ownership of or control over one or more establishments required to submit information under paragraph (a) of this section, then the enterprise or corporate office may collect and electronically submit the information for the establishment(s).

* * * * *

Footnotes

1.  OSHA's regulation at 29 CFR 1904.35(b)(2) requires employers to provide employees, former employees, their personal representatives, and their authorized employee representatives access to the OSHA Form 300. Employers must include the names of the employees with recorded cases, except for certain “privacy concern cases” as specified in 29 CFR 1904.29(b)(6)-(9). In addition, OSHA's regulation at 29 CFR 1904.29(b)(10) requires employees to remove or hide employee names and other personally identifying information when voluntarily disclosing the Form 300 or 301 to persons other than government representatives, employees, former employees or authorized representatives, except when disclosing the forms to an auditor or consultant hired by the employer to evaluate the safety and health program, or to the extent necessary for processing a claim for workers' compensation or other insurance benefits, or to a public health authority or law enforcement agency per 45 CFR 164.512. Finally, for the Form 301, OSHA's regulation at 29 CFR 1904.35(b)(2)(v) requires employers to provide an employee, former employee, or the employee's personal representative access to the Form 301 Incident Report describing an injury or illness to that employee or former employee; for authorized employee representatives, employers are required to provide the information in “tell us about the case” for any incident report and to remove all of the other information.

2.  The gathering of such data also may incentivize cyber-attacks on the Department's IT system. For example, on August 14, 2017, OSHA received an alert from the United States Computer Emergency Readiness Team (US-CERT) in the Department of Homeland Security that indicated a potential compromise of user information for OSHA's Injury Tracking Application (ITA). The ITA was taken off-line as a precaution. A complete scan was conducted by the National Information Technology Center (NITC). The NITC confirmed that there was no breach of the data in the ITA and that no information in the ITA was compromised. Public access to the ITA was restored on August 25, 2017. While this episode showed the security provisions of the ITA to work as designed, it also demonstrated that such a large data collection will inevitably encounter malware.

3.  OSHA expects many more establishments to respond with 2017 summary data this year, for at least two reasons. First, OSHA has analyzed the responses for 2016, has identified thousands of non-responders who were obligated to respond for 2016, and is in the process of informing them of their obligation to respond for 2017. Second, OSHA recently discovered that employers did not receive clear notice of their obligation to respond for 2016, if they were located in state plan states that had not completed adoption of their own state rules. In 2018, OSHA issued a correction clarifying that those employers were indeed obligated to submit Form 300A data for 2017.

4.  See “PEA calculations,” Ex. 2067.

5.  Forms 300 and 301 continue to offer substantial enforcement value in the context of on-site inspections. Compliance officers routinely review them as part of those inspections, and the information recorded in those forms can provide a roadmap for the compliance officer to focus the inspection on the most hazardous aspects of the operation.

6.  In addition to the privacy risks and uncertain enforcement benefits outlined above, electronic collection of the case-specific forms would also cause regulated employers and OSHA to incur financial costs. As explained in the Preliminary Economic Analysis, the annualized cost to employers is estimated at approximately $8.7 million per year. It would also cost OSHA significant sums to make case-specific data ready for enforcement use. In addition to the $450,000 required to add functionality to collect these data through the Injury Tracking Application (ITA), OSHA believes it would require several dedicated full-time employees to collect, process, analyze, distribute, and programmatically apply these data in a meaningful way.

7.  Employers covered by the OSH Act must report certain severe injuries or in-patient hospitalizations within 24 hours, and fatalities within 8 hours, chiefly to “allow OSHA to carry out timely investigations of these events as appropriate.” 79 FR 56156. The reported information, which OSHA retains in its records, resembles the information recorded in the case-specific Form 301. But these severe injury/fatality reports constitute a very small percentage of the total universe of Form 301s. In calendar year 2017, fewer than 16,000 incidents were reported. By contrast, OSHA estimates that approximately 775,000 cases would be submitted to OSHA as a result of the existing regulation. (See the Preliminary Economic Analysis.) Requiring electronic submission of Form 301 data would therefore increase almost 48-fold the universe of data potentially susceptible to FOIA.

8.  The Department also collects Form 301 data in two other ways, but neither offers a material precedent for collecting millions of Form 301s' data in a form potentially exposed to FOIA.

First, BLS collects approximately 250,000 Form 301s from private establishments for the annual Survey of Occupational Injury and Illness. But under the Confidential Information Protection and Statistical Efficiency Act, BLS is prohibited from releasing in identifiable form information acquired under a pledge of confidentiality for exclusively statistical purposes.

Second, the forms are occasionally retained in inspection case files, primarily in cases where OSHA issues a recordkeeping citation and the Form 301 is needed as evidence. In fiscal year 2017, OSHA issued 1,472 recordkeeping citations, 769 of which were for failure to report a fatality or severe injury, citations which were unlikely to result in Form 301 being entered into the case file. So in one year, approximately 703 citations represent possible cases where OSHA inspectors were likely to have retained Form 301 for agency records.

9.  See https://www.bls.gov/​oes/​current/​oes299011.htm.

10.  See https://www.bls.gov/​web/​ecec/​ececqrtn.txt.

11.  See the sensitivity analyses in the Improved Tracking FEA (https://www.gpo.gov/​fdsys/​pkg/​FR-2017-11-24/​pdf/​2017-25392.pdf,, page 55765) and the FEA in support of OSHA's 2016 final standard on Occupational Exposure to Respirable Crystalline Silica (81 FR 16285) (https://www.gpo.gov/​fdsys/​pkg/​FR-2016-03-25/​pdf/​2016-04800.pdf pp.16488-16492.). The methodology was modeled after an approach used by the Environmental Protection Agency. More information on this approach can be found at: U.S. Environmental Protection Agency, “Wage Rates for Economic Analyses of the Toxics Release Inventory Program,” June 10, 2002 (Ex. 2066). This analysis itself was based on a survey of several large chemical manufacturing plants: Heiden Associates, Final Report: A Study of Industry Compliance Costs Under the Final Comprehensive Assessment Information Rule, Prepared for the Chemical Manufacturers Association, December 14, 1989, Ex. 2065.

12.  OSHA welcomes comments on this assumption.

13.  The 2016 FEA estimated 713,397 injury and illness cases per year using the same methodology and the most recent SOII data then available (see “PEA calculations,” Ex. 2067).

14.  In addition, note that the totals in tables in this chapter, as well as totals summarized in the text, may not precisely sum from underlying elements due to rounding. The precise calculation of the numbers in the PEA appears in the spreadsheet (see “PEA calculations,” Ex. 2067).

15.  Overall, the estimated cost savings of this proposal to remove the provision for electronic reporting of case data is 25 percent greater than the 2016 estimated cost of promulgating the provision ($6,948,487). There are three reasons for this 25 percent increase: The number of establishments with more than 250 employees has grown, the mean hourly wage has increased, and OSHA is now including a 17 percent overhead estimate in the cost estimates.

16.  Source: https://www2.census.gov/​programssurveys/​susb/​datasets/​2015/​us_​state_​emplchange_​2014-2015.txt.

17.  For the CBP see: https://www.census.gov/​programs-surveys/​cbp.html.

18.  In addition, note that the totals in tables in this chapter, as well as totals summarized in the text, may not precisely sum from underlying elements due to rounding. The precise calculation of the numbers in the PEA appears in the spreadsheet (see “PEA calculations,” Ex. 2067).