Who Must Submit
29 CFR 1904.41 establishes three tiers of electronic reporting based on establishment size and industry. The 2024 final rule expanded the most stringent tier to include Form 300 Log entries and 301 Incident Reports for certain high-hazard employers.
Tier 1 — 100+ employees in designated high-hazard industries
Submit Form 300A annual summary plus Form 300 Log and Form 301 Incident Report data. Industries are listed in Appendix B to Subpart E of Part 1904. The establishment's legal company name and EIN are required in the submission.
Tier 2 — 250+ employees in industries covered by Part 1904
Submit Form 300A annual summary only. Includes most industries not partially exempt under 1904.2.
Tier 3 — 20 to 249 employees in high-hazard industries
Submit Form 300A annual summary only. Industries listed in Appendix A to Subpart E of Part 1904.
Counting employees: Use the peak employment count at the establishment during the calendar year. Part-time, seasonal, temporary, and leased workers count toward the establishment headcount if the employer supervises them on a day-to-day basis.
The March 2 Deadline
Submissions for the prior calendar year are due by March 2 of the following year. The deadline is firm. Extensions are not routinely granted, and a missed deadline is a citation-eligible recordkeeping violation.
Practical sequencing:
- Year-end review and 300 Log corrections in January.
- 300A summary preparation by late January.
- Executive certification before posting on February 1.
- Electronic submission via the Injury Tracking Application by March 2.
- 300A posting remains up at the establishment through April 30.
What Goes In, What Stays Out
Tier 1 establishments submitting Form 300 and 301 data must omit personally identifiable information that OSHA itself does not need for its public dataset. The required omissions are:
- Employee name (Form 300 column B; Form 301 field 1)
- Employee address (Form 301 field 2)
- Name of physician or other health care professional (Form 301 field 6)
- Name and address of facility where treatment was provided (Form 301 field 7)
Privacy concern cases require additional handling. The case description should already reflect the privacy designation in the maintained 300 Log; that protected description is what is submitted.
Other 300 and 301 fields are submitted as recorded — case number, date of injury or illness, where the event occurred, description of the injury or illness, what happened, body part affected, object or substance involved, days away, days restricted/transferred, case classification (death, days away, restriction, other recordable), and case type (injury or illness category).
Setting Up an ITA Account
The Injury Tracking Application is hosted at osha.gov and uses Login.gov for authentication. First-time users create a Login.gov account, then create or claim an ITA establishment record by entering the establishment address, NAICS code, and EIN.
Each establishment is a separate ITA record. Multi-site employers can manage their establishments under a single user account or grant access to local site managers as alternate submitters. The owning legal entity field records the parent company; the establishment field records the local site.
Submissions can be entered manually field-by-field, uploaded as CSV, or transmitted by API. CSV is the practical option for employers with many establishments and is documented in the ITA upload specifications on the agency's website.
State Plan States
Twenty-two states and territories operate their own occupational safety and health programs covering private sector employers, and an additional seven cover state and local government employees only. State plan states must adopt requirements at least as effective as the federal rule, but the precise mechanics of submission may differ.
Most state plans direct employers to the federal ITA for submission. A few (notably California in past years) have implemented their own systems or have delayed adoption of federal expansions. Verify the current status with the relevant state plan agency before each reporting cycle, particularly for the new Tier 1 Form 300 and 301 requirements.
Public Disclosure of Submitted Data
OSHA publishes selected fields from electronic submissions in its public dataset. Aggregate 300A totals, establishment information, and key 300 and 301 fields appear in the public release. Personally identifiable information that has been correctly omitted before submission stays out of the public dataset.
Employers submitting accurate, complete, and properly redacted records do not face additional disclosure exposure. Errors in the maintained 300 Log can become public errors. Pre-submission review of the underlying records, particularly the case description fields, is the best protection.
Common Mistakes
Submitting at the corporate level only. Each establishment is a separate ITA record. A single rolled-up submission for a multi-site employer is incomplete.
Including names in 300 or 301 submissions. The required omissions are mandatory in Tier 1 submissions. Names must be stripped before upload.
Using prior year's industry coverage list. Appendix A and Appendix B can be revised between cycles. Verify the establishment's NAICS against the current appendices each year.
Confusing establishment count with total employer count. The 1904.41 thresholds are establishment-level. A company with 5,000 employees spread across thirty 50-employee sites has zero Tier 1 establishments.
Skipping the submission because no recordable cases occurred. A 300A with zeros must still be submitted by covered establishments by March 2.