OSHA 300 Privacy Concern Cases: Examples and Safer Log Descriptions
OSHA lists six privacy case types, including sexual assault injuries, mental illness, HIV, hepatitis, TB, and contaminated needlesticks.
The short answer
OSHA lists six privacy case types, including sexual assault injuries, mental illness, HIV, hepatitis, TB, and contaminated needlesticks. For these, write “privacy case” instead of the name and keep the names on a separate confidential list.
Privacy rules are easy to respect if the team identifies the case type before publishing or sharing the log.
The rule in plain English
Some cases go on the 300 Log without the employee's name. For these privacy concern cases, you write “privacy case” in the name column and keep a separate, confidential list that links case numbers to names (29 CFR 1904.29(b)(6)). The list of privacy concern cases is complete: an injury or illness to an intimate body part or the reproductive system; an injury or illness from a sexual assault; mental illness; HIV infection, hepatitis, or tuberculosis; needlestick and sharps injuries contaminated with another person's blood or other potentially infectious material; and other illnesses, when the employee voluntarily asks that their name be left off. If the details could still identify the person, you may describe the case in general terms (1904.29(b)(9)).
The complete list of privacy concern cases
29 CFR 1904.29(b)(7) lists six kinds of privacy concern case, and the list is closed:
- An injury or illness to an intimate body part or the reproductive system
- An injury or illness resulting from a sexual assault
- Mental illnesses
- HIV infection, hepatitis, or tuberculosis
- Needlestick injuries and cuts from sharp objects contaminated with another person's blood or other potentially infectious material
- Other illnesses, if the employee voluntarily requests that their name not be entered on the log
How it plays out on site
Write “privacy case” in the name field and keep the confidential name list separately. Leaving a name off the log does little if the description, job title, or date still points to one person on a small team. The fix is to identify privacy cases at intake, before anyone writes the log description, and to review descriptions for identifying detail before any copy leaves the file.
As the safety manager you usually own the decision itself, so the most useful habit is writing down the fact each call rests on at the time you make it.
The common mistake
Teams remove names but leave an overly specific narrative that identifies the employee anyway. Review the description as a coworker would read it, and generalize anything that points to one person.
Privacy status travels with the case: it changes what employees see when they request the log, what goes in the confidential list, and which free-text fields need review before an ITA case-data submission.
Edge cases
- A small department or unusual incident can make even a nameless description identifiable.
- Only illnesses qualify under the voluntary-request category. An employee cannot ask to have a sprain logged as a privacy case.
Worked example
Three cases in one quarter: a testicular injury from a fall onto a beam (reproductive system, so a privacy case), a contaminated needlestick (a privacy case), and a back strain whose employee asks for privacy (not eligible, because only illnesses qualify under the voluntary-request category). The first two go on the log as “privacy case”; the back strain keeps the employee's name.
Checklist
- Check each new case against the six types.
- Write “privacy case” in the name column.
- Add the case to the confidential list.
- Review the description for identifying details.
What to keep in the case file:
- The confidential list of privacy case numbers and names, with restricted access
- The reason each case qualified as a privacy case
- The general description used on the 300 and 301
- A record of who received copies of the log and when
Where 300log helps
300log puts a privacy case flag on every incident, with OSHA's privacy case types listed where you set it, and exports the OSHA 300 Log with “Privacy Case” in place of the employee's name.
For a quick answer without an account, use the free recordability checker.
Frequently asked questions
Where do the names of privacy cases go?
On a separate, confidential list of case numbers and employee names, kept so you can update the cases and give the information to the government if asked.
Can we remove names from the log for other cases?
No. The privacy case list is complete, and employees and their representatives receive the log with names left on for all other cases (29 CFR 1904.35(b)(2)(iv)).
Is every sharps injury a privacy case?
Contaminated needlesticks and sharps injuries are. A cut from a clean object is recorded only if it meets a general recording criterion, and it is not automatically a privacy case.
What is a privacy concern case?
An injury or illness to an intimate body part or the reproductive system, one from a sexual assault, mental illness, HIV, hepatitis, or tuberculosis, a contaminated needlestick or sharps injury, or another illness when the employee voluntarily asks that their name be left off.
Sources
Primary regulation and agency guidance this article relies on.
- [1]29 CFR 1904.29: OSHA Forms 300, 300A, and 301Occupational Safety and Health Administration · osha.gov(opens in a new tab)
- [2]29 CFR 1904.29 privacy concern case requirementsOccupational Safety and Health Administration · osha.gov(opens in a new tab)
- [3]29 CFR 1904.8: Needlestick and sharps injuriesOccupational Safety and Health Administration · osha.gov(opens in a new tab)
Written and reviewed by the 300log Editorial Team. Guidance, not legal advice: confirm edge cases with OSHA or counsel.