OSHA Recordkeeping for Healthcare Clinics: Sharps, Privacy, and ITA Readiness
Whether a clinic keeps OSHA logs depends on its NAICS code: physician, dental, and outpatient offices (6211 to 6215) are partially exempt…
4 min readUpdated
Topic · 5 guides
The OSHA 300 Log is shared with employees and their representatives, so the rules limit what it can reveal. Under 29 CFR 1904.29(b)(7), six kinds of cases are privacy concern cases: an injury or illness to an intimate body part or the reproductive system; one resulting from a sexual assault; mental illnesses; HIV infection, hepatitis or tuberculosis; needlestick injuries and cuts from sharp objects contaminated with another person's blood or other potentially infectious material; and other illnesses where the employee voluntarily asks that their name not be entered. The list is complete, so you cannot add categories of your own.
~4 min average readUpdated

For these cases, write "privacy case" where the name would go and keep a separate, confidential list linking case numbers to names. If the description itself could identify the employee, you may use discretion in wording it, as long as you still record enough to show the cause of the incident and the general severity of the injury or illness. If you voluntarily share the forms with anyone other than employees, their representatives or the government, remove names and other identifying details first, with narrow exceptions for safety auditors, insurance claims and public health authorities.
These guides give safer description examples and cover sharps logs, mental health cases and clinics.
Free tool
OSHA Recordability Checker
Walk a case through 29 CFR 1904.5–1904.11 in under a minute.
Open the recordability checkerFree. No signup.
Privacy cases
5 guides
Whether a clinic keeps OSHA logs depends on its NAICS code: physician, dental, and outpatient offices (6211 to 6215) are partially exempt…
4 min readUpdated
Mental illness, including stress-related conditions, is not work-related unless the employee voluntarily provides an opinion from a qualified professional…
4 min readUpdated
Keep a separate confidential list pairing each privacy case number with the employee's name, so the case can be updated and produced if OSHA asks.
4 min readUpdated
Every work-related needlestick or cut from a sharp contaminated with another person's blood or OPIM is recordable, as an injury and a privacy case.
4 min readUpdated
OSHA lists six privacy case types, including sexual assault injuries, mental illness, HIV, hepatitis, TB, and contaminated needlesticks.
4 min readUpdated
From guide to log
300log turns each case into its OSHA 300 Log entry and 301 report, keeps privacy cases off the shared log, totals the 300A and files it with OSHA's ITA for you as soon as you authorize it.