Form 301 Electronic Submission Privacy: Fields OSHA Excludes From Publication
Establishments submitting 301 data leave out the employee's name and address and the treating provider and facility details, as 1904.41(b)(9) requires.
Quick answer
Establishments submitting 301 data leave out the employee's name and address and the treating provider and facility details, as 1904.41(b)(9) requires. Free-text answers still leave your system, so review them for names and identifying details before submission.
Some employers worry that electronic submission exposes every private Form 301 field.
The rule in plain English
Covered establishments submit injury data to OSHA's Injury Tracking Application (ITA) by March 2 each year for the previous calendar year; for 2026 data that is March 2, 2027 (29 CFR 1904.41). Three groups must submit: establishments with 250 or more employees that must keep records (300A data); establishments with 20 to 249 employees in an industry listed in Appendix A to Subpart E (300A data); and establishments with 100 or more employees in an industry listed in Appendix B (300A data plus 300 and 301 case data). Headcount means every individual employed at any time in the prior year, including part-time, seasonal, and temporary workers, and every submission includes the establishment's EIN.
Fields OSHA excludes from case data submissions
Under 1904.41(b)(9), establishments that submit 300 and 301 data leave out:
- OSHA 300: the employee's name (column B)
- OSHA 301: the employee's name (field 1) and address (field 2)
- OSHA 301: the name of the physician or other health care professional (field 6)
- OSHA 301: the facility name and address, if treatment was given away from the worksite (field 7)
Everything else on the forms, including the free-text answers about the case, is submitted, so review it for identifying details first.
What this looks like in practice
Know which detailed fields are submitted and which fields OSHA excludes from publication workflows. Most ITA problems are establishment data problems: an old NAICS code, a parent-company EIN, or a headcount measured at the wrong level. The fix is to decide coverage per establishment in the fall, clean the EIN, NAICS, and address data then, and leave only validation and submission for February.
Privacy officers should map exactly which fields leave the organization and which stay internal, and review free text as well as structured fields.
The mistake to avoid
Teams either over-redact required submission data or submit without internal privacy review.
The ITA submission is built from the certified 300A (and, for Appendix B establishments, the 300 and 301), so every correction to the log has to be reconciled with what was submitted.
Edge cases worth checking
- Privacy case handling still matters even when certain fields are not publicly posted.
- For 300 and 301 case data, OSHA excludes employee names and addresses and health care provider details from the submission (1904.41(b)(9)).
Example
A hospital's case data export includes the answer “Pat from pharmacy was restraining the patient when…”. The privacy review replaces it with “A coworker was restraining the patient when…” in the source record, so the change carries into every future export.
Step by step
- Confirm which fields are submitted.
- Review free-text fields for identifying details.
- Keep the source records separate.
- Submit through the ITA.
What to keep in the case file:
- The coverage decision for each establishment: peak headcount, NAICS code, and which appendix applies
- The EIN used by each establishment
- The submitted file or payload and the ITA confirmation
- Notes on any corrections made after submission
Where 300log helps
300log validates EIN and NAICS formats, produces ITA-ready CSV files for the 300A and for case data, and can authorize auto-filing of 300A data once you connect an ITA API token.
For a quick answer without an account, use the free ITA coverage checker.
Frequently asked questions
Does electronic submission replace posting the 300A?
No. Posting the certified 300A from February 1 to April 30 is a separate duty under 29 CFR 1904.32.
How can we submit to the ITA?
Through the ITA by entering data in the web form, uploading a CSV file, or sending it through the ITA's API. OSHA publishes CSV and API documentation.
Who has to submit to the OSHA ITA?
Establishments with 250 or more employees that keep records, establishments with 20 to 249 employees in Appendix A industries, and establishments with 100 or more employees in Appendix B industries (which also submit 300 and 301 case data).
When is the ITA deadline for 2026 data?
March 2, 2027.
Sources
Primary regulation and agency guidance this article relies on.
- [1]29 CFR 1904.41: Electronic submission requirementsOccupational Safety and Health Administration · osha.gov(opens in a new tab)
- [2]OSHA Injury Tracking Application frequently asked questionsOccupational Safety and Health Administration · osha.gov(opens in a new tab)
- [3]29 CFR 1904.29 privacy concern case requirementsOccupational Safety and Health Administration · osha.gov(opens in a new tab)
Written and reviewed by the 300log Editorial Team. Guidance, not legal advice: confirm edge cases with OSHA or counsel.