Needlestick and Sharps Injuries on the OSHA 300 Log: What to Record

Every work-related needlestick or cut from a sharp contaminated with another person's blood or OPIM is recordable, as an injury and a privacy case. Clean sharps cuts are recorded only if they meet a general criterion, and a later bloodborne diagnosis turns the entry into an illness.

Sharps cases move fast because clinical follow-up and privacy controls happen at the same time.

Some cases go on the 300 Log without the employee's name. For these privacy concern cases, you write “privacy case” in the name column and keep a separate, confidential list that links case numbers to names (29 CFR 1904.29(b)(6)). The list of privacy concern cases is complete: an injury or illness to an intimate body part or the reproductive system; an injury or illness from a sexual assault; mental illness; HIV infection, hepatitis, or tuberculosis; needlestick and sharps injuries contaminated with another person's blood or other potentially infectious material; and other illnesses, when the employee voluntarily asks that their name be left off. If the details could still identify the person, you may describe the case in general terms (1904.29(b)(9)).

Employers that must keep an OSHA 300 Log and have employees exposed to blood also keep a sharps injury log under the Bloodborne Pathogens standard (29 CFR 1910.1030(h)(5)). It records, for each contaminated sharps injury, the type and brand of device, the department or work area, and how the incident happened, in a way that protects the employee's identity. It is a separate record from the 300 Log, but both describe the same incident, so link them by case number.

Record contaminated needlestick and sharps injuries as injuries, and protect the employee's name. Leaving a name off the log does little if the description, job title, or date still points to one person on a small team. The fix is to identify privacy cases at intake, before anyone writes the log description, and to review descriptions for identifying detail before any copy leaves the file.

In healthcare, clinical follow-up and recordkeeping run in parallel, so build the link between employee health and the OSHA log into intake itself.

Teams sometimes treat all clean sharps cuts as automatically recordable, when OSHA uses different logic.

Privacy status travels with the case: it changes what employees see when they request the log, what goes in the confidential list, and which free-text fields need review before an ITA case-data submission.

• A later bloodborne disease diagnosis can require updating classification and description.
• Names stay on the log for every other case when employees or their representatives request it; you cannot anonymize the whole log.

A nurse is stuck by a used insulin needle: recorded as an injury, with “privacy case” in the name column, even though no treatment beyond baseline testing follows. A maintenance worker cut by a clean new blade who needs only a bandage is not recorded.

1. Record the case as an injury within 7 days.
2. Enter “privacy case” in the name column.
3. Track post-exposure follow-up.
4. Update to an illness if a bloodborne disease is diagnosed.

What to keep in the case file:

• The confidential list of privacy case numbers and names, with restricted access
• The reason each case qualified as a privacy case
• The general description used on the 300 and 301
• A record of who received copies of the log and when

300log puts a privacy case flag on every incident, with OSHA's privacy case types listed where you set it, and exports the OSHA 300 Log with “Privacy Case” in place of the employee's name.

For a quick answer without an account, use the free recordability checker.

• OSHA Privacy Case Confidential List: What to Keep and Who Can See It
• Work-Related Stress and OSHA Recordability: Mental Illness, Privacy, and Evidence
• OSHA Recordkeeping for Healthcare Clinics: Sharps, Privacy, and ITA Readiness
• OSHA Recordkeeping for Franchise Locations: Employer Establishment and Log Ownership