An incident report should be completed when: the full rulebook

Last updated 2026-07-09

What triggers the requirement to complete an incident report?

More events trigger a report than most small business owners realize. That is the whole problem in one sentence.

OSHA's recordkeeping rule, 29 CFR 1904, draws a bright line. A recordable case is any work-related injury or illness that results in death, days away from work, restricted work or job transfer, medical treatment beyond first aid, loss of consciousness, or a significant injury or illness diagnosed by a licensed healthcare professional, even if it causes none of the other outcomes on the list ^[1]. That last category catches people off guard. A doctor's diagnosis of occupational asthma, a positive TB skin test tied to workplace exposure, or a needlestick that leads to a bloodborne pathogen exposure determination all land on the list even when the worker never misses a shift.

First aid does not trigger a recordable entry. OSHA defines first aid narrowly: non-prescription medications at non-prescription strength, bandaging, eye flushing, splinter removal, and a short list of similar treatments in 29 CFR 1904.7(a) ^[1]. Stay inside that list and no OSHA 300 Log entry is required. You still want an internal incident report for your own program, but the legal log obligation does not kick in.

Set your internal trigger lower than OSHA's. Most safety professionals, and OSHA's own guidance, recommend capturing near-misses, property damage, and hazardous conditions before anyone gets hurt. The logic is blunt. A near-miss is a free lesson. You get the data without the blood.

Think of it as three rings. The inner ring is OSHA recordables, which you must document on the 300 Log and 301 form inside specific deadlines. The middle ring is OSHA-reportable fatalities and severe injuries, which require a phone call or online report, more than a log entry. The outer ring is everything else worth capturing internally: near-misses, first-aid cases, property damage, security incidents.

What are OSHA's specific time limits for filing an incident report?

The clock runs at three different speeds depending on how bad the event is. Miss the fastest one and OSHA can cite you before you have even finished the paperwork.

For a recordable injury or illness that does not involve death or hospitalization, you have 7 calendar days from the day you learn of the case to enter it on the OSHA 300 Log ^[1]. You complete the OSHA 301 Incident Report form (or an equivalent state workers' compensation first report of injury) at the same time. Seven days sounds generous until you remember it counts weekends.

A work-related fatality has to go directly to OSHA within 8 hours of the moment you learn of the death ^[2]. This is not a log entry. It is a phone call to the nearest OSHA area office or a report through OSHA's online portal. Blow the 8-hour window and you are looking at a citation on top of whatever caused the death.

In-patient hospitalization of one or more employees, an amputation, or the loss of an eye carries a 24-hour reporting window ^[2]. Same drill: call or go online. These are the severe injury reporting requirements under 29 CFR 1904.39.

For your internal report, finish the initial write-up the same day, ideally within the first few hours. Witnesses remember more. Physical evidence is still in place. A polished report written two weeks later is worth less than a rough one written the same shift.

One nuance trips people up. The 7-day clock starts when the employer learns of the case, not when the incident happened. If a worker sees a doctor on their own time and tells you a week later that the doctor called it work-related, your 7 days start the day they told you ^[1].

Event type	OSHA requirement	Deadline
Recordable injury or illness	Enter on OSHA 300 Log + complete 301 form	Within 7 calendar days of learning of the case
Work-related fatality	Report directly to OSHA (phone or online)	Within 8 hours of learning of the death
In-patient hospitalization, amputation, or eye loss	Report directly to OSHA (phone or online)	Within 24 hours of learning of the event
Near-miss or first-aid case (internal)	Complete internal report	Same shift or same day, as soon as practical

Which businesses are exempt from OSHA recordkeeping, and does that mean no incident report?

Partial exemptions exist. They do not mean you skip documentation.

Businesses with 10 or fewer employees at all times during the previous calendar year are partially exempt from routinely keeping OSHA 300 Logs and 301 forms ^[3]. The exemption also covers certain low-hazard industries regardless of size, including much of retail, services, finance, insurance, and real estate, listed in Appendix A to Subpart B of 29 CFR 1904 ^[3].

Here is the catch that costs employers money. Even exempt employers must report fatalities, in-patient hospitalizations, amputations, and eye losses directly to OSHA within the same windows above ^[2]. The exemption covers routine log-keeping only. Severe injury reporting still applies to everyone.

Small exempt businesses should still complete internal incident reports for every significant event. Workers' compensation carriers require first reports of injury no matter your OSHA status. Your premiums ride on your loss history. And if OSHA ever inspects you, a file with zero documentation of any injury reads worse than a file with thorough internal records.

State-plan states sometimes run stricter recordkeeping rules than federal OSHA. If you operate in California, Michigan, Washington, or any of the other state-plan jurisdictions, check with your state agency before you assume the federal partial exemption covers you ^[4].

What exactly should go into an incident report?

OSHA's own 301 Incident Report form sets the floor. It asks for the injured person's name and job title, date and time of the incident, location, what the person was doing when injured, how the injury occurred, the object or substance that caused harm, and the nature of the injury ^[1]. That is the legal minimum for a recordable case.

A good internal report climbs well above that floor. The point of an internal report is not to satisfy OSHA. It is to figure out what went wrong and stop the repeat. That means capturing the full sequence of events leading up to the injury, more than the instant of impact. It means naming contributing factors. Was the worker trained? Were procedures followed? Were wet floors, poor lighting, or heat in play? Was equipment involved, and had it been inspected lately?

Root cause analysis belongs in the report. You do not need a formal methodology for most small business cases. Ask why a few times. The forklift hit the rack. Why? The driver did not see the rack. Why? The mirror at the end of the aisle was missing. Why? Nobody was assigned to check it. That chain of whys points straight at a corrective action that actually prevents the next hit. If your operation runs lifts, forklift certification requirements under 29 CFR 1910.178(l) may matter to your investigation.

Witness statements belong in the file, gathered as soon as possible. Memories fade and stories drift within hours. Photographs of the scene, the equipment, and the conditions beat any description written later.

A finished report should also name who ran the investigation, the date it closed, the corrective actions identified, who owns each action, and the due date. File the report and change nothing, and you have paperwork. File the report and chase the corrective actions, and you have a safety program.

Does a near-miss require an incident report?

OSHA does not require you to log near-misses on the 300 Log. No injury occurred, so they are not recordable. That is the floor, not the standard.

Every serious safety professional will tell you to document near-misses, and the numbers back them up. The Bureau of Labor Statistics counted 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023 ^[5]. Researchers have studied the ratio of near-misses to actual injuries for decades, and while the exact ratio shifts by industry, the finding holds: near-misses vastly outnumber injuries. Catching them is how you step in before someone gets hurt.

OSHA actively pushes near-miss reporting. Its incident investigation guidance tells employers to investigate close calls and warns that a reporting-friendly culture depends on workers feeling safe raising concerns without fear of discipline ^[6]. That fear-of-discipline piece decides everything. Workers in a punitive shop hide near-misses. Workers in a reporting-friendly shop surface them. The difference is whether your response to a reported near-miss is "thanks for telling us" or "why weren't you watching what you were doing."

In your internal program, treat a near-miss like a first-aid case. Use the same form, run the same investigation, assign the same corrective actions. The only difference is that the injury section of the form stays blank.

What is the difference between an OSHA 300 Log, an OSHA 301 form, and an internal incident report?

Three documents, three purposes, three audiences. Mixing them up is a common small business mistake.

The OSHA 300 Log (officially Form 300, Log of Work-Related Injuries and Illnesses) is a running tally. You add a line for each recordable case during the year. At year-end you summarize it on Form 300A and post that summary in a visible workplace location from February 1 through April 30 ^[9]. Employees can see the 300 Log on request. Certain authorized union employees and their representatives get access too.

The OSHA 301 Incident Report form is the detailed companion to each 300 Log line. Every recordable case that earns a line on the 300 needs a 301 (or an equivalent workers' comp first report of injury that captures the same data). The 301 carries more detail about the circumstances, the worker, and the treatment. OSHA lets you substitute a state workers' compensation first report of injury form if it holds the same data elements ^[1].

Your internal incident report stands apart from both. It is your investigation document. You do not submit it to OSHA and you do not post it for employees. It should hold everything the 301 has plus your root cause analysis, witness statements, photographs, and corrective action plan. The 301 is the "what happened" document. Your internal report is the "why it happened and what we're going to do about it" document.

For a small business building a program from scratch, sorting out which form does which job is step one. If your written safety program has no incident reporting procedure, a tool like SafetyFolio's safety program generator can help you build one in a fraction of the time it takes to write from a blank page.

What counts as work-related for incident report purposes?

Work-relatedness is the trickiest part of OSHA recordkeeping. It generates more OSHA letters of interpretation than almost any other topic.

The basic rule: an injury or illness is work-related if an event or exposure in the work environment caused or contributed to the condition, or significantly aggravated a pre-existing condition ^[1]. The work environment covers any location where employees are working or are present as a condition of employment.

Several categories are carved out even when they happen at work. A worker who has a heart attack at their desk is not automatically a recordable case. Injuries from eating lunch, personal tasks during a break, or voluntary participation in a wellness program are generally not recordable ^[1]. Mental illness is generally not recordable unless the employee voluntarily provides an opinion from a licensed mental health professional stating it is work-related.

The commute is not the work environment. A worker hurt driving to work is generally not a recordable case. A worker hurt driving a company vehicle to a client site generally is.

Remote work adds complexity. OSHA's position is that injuries occurring while a teleworker is performing work duties in their home are recordable, while injuries during personal activities at home are not ^[6]. If a remote worker trips walking to their home office to join a meeting, that sits in a gray zone OSHA itself calls difficult, and the agency's older home-office letter of interpretation is worth reading if this describes your workforce.

When you genuinely cannot tell whether something is work-related, write down your reasoning. OSHA's compliance officers look at whether you made a reasonable, good-faith determination. Document what you weighed and why you landed where you did.

What happens if you fail to complete an incident report or miss the OSHA deadline?

Missing an OSHA recordkeeping deadline is not a paperwork technicality. OSHA cites it, and the fines add up.

Failure to record a recordable case, failure to complete a 301 form, failure to post the 300A summary, or failure to report a severe injury inside the required window can each draw an OSHA citation. Penalties for serious violations run up to $16,550 per violation as of 2024, and OSHA adjusts these figures every year for inflation ^[7]. Willful or repeated violations reach $165,514 per violation.

OSHA's inspection targeting feeds off injury data. Establishments in high-hazard industries with high injury rates get flagged for programmed inspections. And any inspection triggered by a complaint or referral will pull your 300 Logs for the past five years. OSHA keeps those records five years, and so must you ^[1].

Late reporting of a severe injury is a separate citation from the log issue. If a worker loses a finger Monday morning and you call OSHA Wednesday afternoon, that is a 24-hour window violation, and it stacks on top of any 300 Log problems.

The downstream damage runs past OSHA fines. Workers' compensation carriers may deny claims or adjust coverage when no contemporaneous incident report exists. Attorneys for injured workers ask for your incident reports in discovery. A blank file or a missing report never helps you.

How should employees report incidents, and what should your procedure look like?

A reporting procedure is only as good as the workers who know it and trust it. Write the best form in the world and it does nothing if people are afraid to fill it out.

Your written procedure should spell out who employees notify (their direct supervisor, a safety officer, or both), how fast (immediately for anything involving medical attention, by end of shift for near-misses), and what information they need to provide. Post it where workers can see it. Train on it at onboarding. Refresh it once a year. Those are the basics.

Anti-retaliation is the piece most small businesses miss. OSHA's recordkeeping rule at 29 CFR 1904.35 bars employers from discouraging workers from reporting injuries and illnesses ^[1]. That covers disciplining a worker for reporting an injury, even under policies that look neutral on their face, like attendance-based safety incentive programs that dock points when a worker reports an injury. OSHA has issued guidance on this, including its 2016 memo and follow-on enforcement guidance around the 2016 recordkeeping amendments ^[6]. Put a plain statement in your procedure that employees will not face retaliation for reporting.

In a small business, the investigation usually falls to the owner or a shift supervisor already wearing five hats. That is fine. This does not require a safety engineer. It requires someone who can ask what happened, write down the answers, take a few photos, and follow through on corrective actions. A one-page report form that gets filled out every time beats a sophisticated form nobody touches.

Good osha training for supervisors covers exactly this: how to take an injury report without making the worker feel blamed, how to secure the scene, how to gather facts while they are fresh. If your supervisors have not had that training, close that gap first.

Are there special incident reporting rules for specific industries or hazards?

Yes. General industry recordkeeping rules cover most employers, but several sectors and hazard types carry extra or different requirements.

Construction follows the same 29 CFR 1904 recordkeeping rules as general industry. But construction sites often run as multi-employer worksites, which raises the question of who records which injury. OSHA's multi-employer policy and 1904.31 handle this: you record injuries of employees on your payroll or under your day-to-day supervision, depending on the facts ^[1].

Healthcare carries specific rules for needlestick and sharps injuries under 29 CFR 1904.8. These require a sharps injury log separate from the 300 Log, with detail on the type of device, the procedure underway, and where the incident happened. Healthcare employers must keep that log in a way that protects worker privacy ^[11].

Mining, railroad, and aviation answer to different agencies (MSHA, FRA, and FAA) and run their own incident reporting schemes that differ from OSHA's. If your business touches any of those sectors, the OSHA 1904 rules may not be your primary framework.

Hazardous materials incidents carry their own reporting duties under EPA and DOT regulations that can run parallel to OSHA recordkeeping. A chemical release that injures a worker triggers the OSHA recordkeeping requirement for the injury and may also trigger an EPA RMP or EPCRA notification depending on the substance and quantity.

For employers with a hazard communication program, any incident involving chemical exposure should document the specific chemical, the exposure route, and whether an SDS was available and consulted during the emergency response. That detail matters for both the medical evaluation and any future OSHA review.

If you operate in a state with its own OSHA plan, check for state-specific additions. Several state plans set lower severity thresholds for direct OSHA reporting than federal OSHA does ^[4].

How long do you keep incident reports, and who can see them?

Retention and privacy rules are specific, and you want to know them before you set up the filing system, not after an inspector asks.

OSHA 300 Logs and 301 Incident Report forms must be kept for five years following the end of the calendar year they cover ^[1]. So your 2024 records stay until the end of 2029. You keep the 300A summary five years too. Current and former employees and their representatives can request access within timelines OSHA sets out in 1904.35 and 1904.40.

Privacy is a real issue on the 300 Log. For certain privacy concern cases, including sexual assaults, HIV/AIDS, mental illness, and a few others, you enter "privacy case" on the 300 Log instead of the worker's name ^[1]. The 301 form for that case, which does carry the name, is kept separately and is not handed to employees or union representatives on request.

Your internal incident reports are not OSHA documents, and OSHA sets no retention period for them. But workers' compensation statutes in most states require you to keep first reports of injury for set periods, often three to five years. And if litigation follows an injury, those reports can be discoverable. A reasonable practice is to keep internal reports for the life of the workers' compensation claim plus three years, or ten years minimum for serious incidents.

OSHA's rule allows electronic storage as long as you can produce a hard copy on request ^[1]. Most document management or HR systems handle that without trouble.

What does the data say about how often incidents go unreported?

Underreporting of workplace injuries is documented and significant. Clean logs do not always mean a clean shop.

A 2012 Government Accountability Office report (GAO-12-330) found that OSHA's injury and illness data likely undercounts actual incidents, and named worker fear of retaliation, employer pressure, and lack of awareness as the primary drivers ^[8]. The report reviewed multiple studies and found evidence that both employees and employers sometimes discourage or avoid reporting, especially where safety incentive programs reward low injury counts.

The BLS Survey of Occupational Injuries and Illnesses, which produces the annual nonfatal injury statistics, acknowledges its own methodological limits and that some recordable cases never make it onto a 300 Log. Academic estimates of the undercount vary widely by study and industry, and no single figure is settled, so treat any specific percentage you see with caution.

The takeaway for a small business owner is concrete. If your OSHA 300 Log shows zero injuries for three straight years at an operation with real physical hazards, that is not automatically proof of great safety. It might be. Or workers are not reporting, or supervisors are logging things as first aid that should be recordable. OSHA compliance officers know this pattern and may look harder at a suspiciously clean log.

A genuine safety culture produces incident reports. Not because workers are getting hurt constantly, but because near-misses and minor events surface and get documented before they escalate. Steady reporting is a sign of health, not dysfunction ^[6].

Frequently asked questions

Should an incident report be completed for a first-aid-only case?

You do not have to enter a first-aid-only case on your OSHA 300 Log, but you should still complete an internal incident report. First-aid cases are defined in 29 CFR 1904.7(a) and include bandaging, over-the-counter medication at labeled strength, and eye flushing. An internal report on these events creates a record that helps you spot patterns before a more serious injury shows up.

Does a near-miss have to be reported to OSHA?

No. Near-misses are not OSHA recordable events and require no 300 Log entry or direct OSHA notification. OSHA strongly encourages internal near-miss reporting as part of a working safety program. Documenting near-misses helps you catch hazardous conditions before an injury occurs, and OSHA's incident investigation guidance explicitly recommends investigating close calls.

What is the deadline to report a workplace fatality to OSHA?

A work-related fatality must be reported directly to OSHA within 8 hours of learning of the death, per 29 CFR 1904.39. You report by calling OSHA's 24-hour hotline at 1-800-321-OSHA or by reporting online at osha.gov. This is separate from entering the case on your 300 Log, which must be done within 7 calendar days.

What if an employee is injured but refuses to report it?

Your obligation to record a case on the OSHA 300 Log exists once you learn of it, regardless of whether the employee filed a formal report. If a coworker tells you, if you witness it, or if a supervisor observes it, you are on notice. Document what you know and when you learned it. Employees cannot waive your recordkeeping obligation by declining to file.

How do I report a workplace injury to OSHA if it requires direct reporting?

For fatalities (within 8 hours) and hospitalizations, amputations, or eye losses (within 24 hours), report by calling 1-800-321-OSHA (1-800-321-6742), calling your nearest OSHA area office, or using the online reporting tool at osha.gov. Have the employer name, location, time of incident, number of employees affected, and a brief description of the event ready when you call.

Can I use a workers' compensation form instead of the OSHA 301 form?

Yes. OSHA allows employers to substitute a state workers' compensation first report of injury form for the OSHA 301 Incident Report, as long as the substitute captures the same data elements required on the 301. Most state workers' comp forms qualify. Check the specific data elements in 29 CFR 1904.29(b)(4) to confirm your state form works.

Who is responsible for completing an incident report, the worker or the supervisor?

Both have a role. The worker should report the incident immediately to a supervisor. The supervisor typically completes the initial report, secures the scene, and starts the investigation. In most written safety programs, management owns the recordkeeping obligation under 29 CFR 1904. Workers supply information. Supervisors document, investigate, and enter records on the OSHA 300 Log within the 7-day deadline.

What is a privacy concern case on the OSHA 300 Log?

Certain injury types require you to protect worker identity on the 300 Log. For cases involving sexual assault, HIV/AIDS, mental illness, tuberculosis, hepatitis, needlestick injuries, and a few others, you write 'privacy case' in the name column instead of the worker's name. The full 301 form with the name is kept separately and is not released to employees or representatives on request. The rule is in 29 CFR 1904.29(b)(7).

Does an employee working from home who gets injured need an incident report?

Possibly yes. OSHA's position is that injuries to remote workers are recordable if they occur while performing work duties and arise from work activities. An injury in a home office during work hours while the employee is doing their job is treated like an office injury. Injuries during personal activities at home, like cooking lunch, are not recordable. Document your reasoning either way.

How many years do I need to keep OSHA 300 Logs?

Five years from the end of the calendar year they cover, per 29 CFR 1904.33. So your 2024 log must be kept through December 31, 2029. During that period, you must provide the logs to current and former employees and their representatives on request. Electronic storage is fine as long as you can produce a printed copy.

What is the penalty for not completing an OSHA incident report or missing the 300 Log deadline?

OSHA can cite recordkeeping violations as serious, with penalties up to $16,550 per violation as of 2024 and annual inflation adjustments. Willful or repeated violations reach $165,514. Failure to report a fatality within 8 hours or a severe injury within 24 hours is a separate citation on top of any log violations. OSHA reviews 300 Logs going back five years during any inspection.

Do small businesses with fewer than 10 employees have to complete incident reports?

Businesses with 10 or fewer employees at all times during the prior calendar year are partially exempt from OSHA routine recordkeeping, meaning no 300 Log or 301 form for most cases. But they still must report fatalities, hospitalizations, amputations, and eye losses directly to OSHA within the same time windows. Internal incident reports are still strongly advisable for workers' comp and safety program purposes.

What should a good incident report form include?

At minimum: injured person's name and job, date and time of incident, exact location, description of what the person was doing, how the injury occurred, the object or substance involved, nature of the injury, and treatment provided. A thorough internal form also holds witness statements, root cause analysis, photographs, and a corrective action plan with assigned responsibilities and target completion dates.

Can disciplining an employee for being injured violate OSHA rules?

Yes. Under 29 CFR 1904.35, employers may not retaliate against workers for reporting injuries and illnesses. This covers direct discipline and also indirect discouragement, like automatic point deductions under attendance programs triggered by injury reports. OSHA issued enforcement guidance in 2016 clarifying that safety incentive programs discouraging reporting violate the rule, even if the employer did not intend to penalize the reporting itself.

Sources

1. OSHA, 29 CFR Part 1904 – Recording and Reporting Occupational Injuries and Illnesses: Defines recordable cases, first aid exclusions, 7-day log entry deadline, 301 form requirements, five-year retention, privacy concern cases, and anti-retaliation provisions for injury and illness recordkeeping.
2. OSHA, Report a Fatality or Severe Injury: Employers must report work-related fatalities within 8 hours and in-patient hospitalizations, amputations, or losses of an eye within 24 hours, under 29 CFR 1904.39.
3. OSHA, Partial Exemption for Employers with 10 or Fewer Employees / Low-Hazard Industries: Employers with 10 or fewer employees during the prior calendar year, and employers in low-hazard industries listed in Appendix A to Subpart B of 29 CFR 1904, are partially exempt from routine recordkeeping.
4. OSHA, State Plans: State-approved OSHA plans operate in multiple states and territories and may have recordkeeping and reporting requirements that are at least as effective as federal OSHA and sometimes stricter.
5. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses, 2023: Private industry employers reported 2.6 million nonfatal workplace injuries and illnesses in 2023.
6. OSHA, Incident Investigation – Guidance for Employers: OSHA's incident investigation guidance recommends investigating near-misses and close calls, and states that employers should not discipline workers for reporting injuries, including through incentive programs that implicitly penalize reporting.
7. OSHA, Penalties: OSHA maximum penalties for serious violations are $16,550 per violation and $165,514 for willful or repeated violations, with annual inflation adjustments.
8. U.S. Government Accountability Office, Report GAO-12-330, Workplace Safety and Health: Additional Data Needed to Address Continued Underreporting of Injuries and Illnesses, 2012: GAO found that OSHA injury and illness data likely undercounts actual incidents due to worker fear of retaliation, employer pressure, and lack of awareness of reporting requirements.
9. OSHA, Forms for Recording Work-Related Injuries and Illnesses (Forms 300, 300A, 301): OSHA Form 300 is the log of work-related injuries and illnesses; Form 300A is the annual summary posted February 1 through April 30; Form 301 is the incident report form required for each recordable case.
10. OSHA, 29 CFR 1904.8 – Recording Criteria for Needlestick and Sharps Injuries: Healthcare employers must maintain a separate sharps injury log with detailed information about each needlestick or sharps incident, in addition to the OSHA 300 Log.