Annual Summary & Form 300A Posting

29 CFR 1904.32 requires three actions at the close of every calendar year:

1. Review each establishment's 300 Log to verify entries are complete and accurate. Correct errors found during the review.
2. Summarize the year's entries on Form 300A. Total deaths, days away, transferred or restricted cases, other recordable cases, total days away, total restricted/transferred days, and case counts by injury and illness category.
3. Certify and post. A company executive certifies the summary, and the employer posts the 300A in a conspicuous location at each establishment from February 1 through April 30.

Under 29 CFR 1904.32(b)(4), the certification must be made by a company executive. OSHA defines this as:

• An owner of the company
• An officer of the corporation
• The highest-ranking company official working at the establishment
• The immediate supervisor of the highest-ranking company official working at the establishment

The certifying executive attests that the records have been reviewed and that the summary is correct and complete to the best of the executive's knowledge. Delegation to a safety coordinator, HR generalist, or recordkeeper does not satisfy the certification requirement, even though those individuals may prepare the underlying documents.

29 CFR 1904.32(b)(5) requires the 300A to be posted in a conspicuous place where notices to employees are customarily posted. In practice, this is the same wall as the OSHA “Job Safety and Health — It's the Law” poster, the labor law posters, and the injury-and-illness reporting notice.

The posting must remain readable for the entire three-month window. If it is damaged, defaced, or removed, the employer must replace it. Establishments with multiple bulletin boards or shifts that do not share a common break area must ensure each location used by employees has access to the posting or to a clearly visible copy.

Remote and traveling workforces present a separate question. If employees do not regularly report to a physical workplace, OSHA permits the employer to post the 300A at the location from which the employees are supervised or to provide a copy to each employee for posting at the home worksite.

Each establishment maintains its own 300 Log, 300A, and 301 Incident Reports. An “establishment” under 29 CFR 1904.46 is a single physical location where business is conducted or where services or industrial operations are performed. Different physical sites are separate establishments even when owned by the same company.

Limited exceptions allow consolidated or alternate recordkeeping:

• Short-duration establishments expected to operate fewer than one year may have their cases recorded at the permanent base of operations.
• Records may be maintained at a central location if cases can be transmitted to and produced from the central site as required.

The 300A must still be posted at each establishment that meets the size and industry coverage thresholds, even if records are kept centrally.

29 CFR 1904.33 requires retention of the 300 Log, the privacy concern case list, the 300A annual summary, and the 301 Incident Report for five years following the end of the calendar year that those records cover.

Retention is not passive. During the five-year retention period, the employer must update the 300 Log to include newly discovered cases and to show changes in cases already recorded. New information that becomes available during retention can include:

• Seroconversion to a bloodborne illness following a recorded needlestick.
• A previously deferred work-relatedness determination becoming clear.
• Additional days away or restriction added to a case that recurred.
• A reclassification when an injury becomes an illness or when a fatality occurs from a previously recorded case.

The 300A annual summary itself does not need to be re-posted when underlying records are updated, but the 300 Log entries should be corrected and the records produced in updated form when requested.

The 300A is summary statistics only. It does not list any employee name, occupation, or case description. Every privacy concern case is counted in the totals, but no identifying information is required to be on the posted document.

When releasing the underlying 300 Log alongside or following the 300A posting, the privacy designation continues. See the article on privacy concern cases for the rules on names and descriptions.