OSHA Recordkeeping for Healthcare Clinics: Sharps, Privacy, and ITA Readiness

Whether a clinic keeps OSHA logs depends on its NAICS code: physician, dental, and outpatient offices (6211 to 6215) are partially exempt, while hospitals are not. Covered clinics handle the healthcare-specific cases (contaminated sharps, privacy cases, and bloodborne follow-up), and every clinic must report severe injuries.

Clinic teams face fast-moving sharps events, privacy concerns, and detailed filing needs.

Some cases go on the 300 Log without the employee's name. For these privacy concern cases, you write “privacy case” in the name column and keep a separate, confidential list that links case numbers to names (29 CFR 1904.29(b)(6)). The list of privacy concern cases is complete: an injury or illness to an intimate body part or the reproductive system; an injury or illness from a sexual assault; mental illness; HIV infection, hepatitis, or tuberculosis; needlestick and sharps injuries contaminated with another person's blood or other potentially infectious material; and other illnesses, when the employee voluntarily asks that their name be left off. If the details could still identify the person, you may describe the case in general terms (1904.29(b)(9)).

Build a workflow for contaminated sharps, privacy cases, treatment outcomes, and establishment-level summaries. Leaving a name off the log does little if the description, job title, or date still points to one person on a small team. The fix is to identify privacy cases at intake, before anyone writes the log description, and to review descriptions for identifying detail before any copy leaves the file.

Whatever you use should make these easy to keep and retrieve:

• The confidential list of privacy case numbers and names, with restricted access
• The reason each case qualified as a privacy case
• The general description used on the 300 and 301
• A record of who received copies of the log and when

1. Confirm your NAICS code and exemption status.
2. Set up sharps intake with privacy protection.
3. Track follow-up testing and update cases.
4. Prepare establishment-level 300A data.

In healthcare, clinical follow-up and recordkeeping run in parallel, so build the link between employee health and the OSHA log into intake itself.

Keep these in mind when you compare approaches:

• Teams treat clinical follow-up as separate from OSHA recordkeeping and lose the connection.
• Late bloodborne disease diagnosis can require updating a previously logged sharps injury.
• When you share the forms with anyone other than employees, their representatives, or government representatives (a consultant, for example), remove names and identifying information unless an exception in 1904.29(b)(10) applies.

Spreadsheets fail quietly: a sort that renumbers rows, a tab copied for the new year, a formula that misses a new column. None of that shows on the printed form, which is why any system, including a spreadsheet, should be tested on real historical cases before it is trusted.

A health system runs a hospital (6221) and three physician practices (6211). The practices are partially exempt and keep no routine log; the hospital keeps one, records its sharps injuries as privacy cases, and, with 100 or more employees in an Appendix B industry, submits 300 and 301 data to the ITA. A severe injury at any of the four sites is reported within 24 hours.

300log puts a privacy case flag on every incident, with OSHA's privacy case types listed where you set it, and exports the OSHA 300 Log with “Privacy Case” in place of the employee's name.

For a quick answer without an account, use the free recordability checker.

• OSHA 300 Privacy Concern Cases: Examples and Safer Log Descriptions
• Needlestick and Sharps Injuries on the OSHA 300 Log: What to Record
• OSHA Privacy Case Confidential List: What to Keep and Who Can See It
• OSHA ITA FAQs: Submission Dates, Coverage, and Corrections for 2026 Data