How to store and retain OSHA safety records for a small business

Last updated 2026-07-11

Which OSHA records does a small business actually have to keep?

The honest answer is: more than most owners expect, less than a big manufacturer. OSHA has no single recordkeeping rule. Different standards each carry their own retention clock, format, and access rules, and they don't agree with each other.

The big categories are:

1. Injury and illness records (the OSHA 300 Log, 300-A Summary, and 301 Incident Report forms) under 29 CFR 1904. 2. Exposure records, meaning air monitoring data, biological monitoring results, and chemical exposure measurements, under 29 CFR 1910.1020. 3. Training records, required by dozens of standards including hazard communication (29 CFR 1910.1200), lockout/tagout (29 CFR 1910.147), respiratory protection (29 CFR 1910.134), and forklift operation (29 CFR 1910.178). 4. Medical records, including the results of required medical surveillance programs. 5. Equipment inspection and certification logs, such as crane inspections, fire extinguisher checks, and eyewash station tests.

Partial exemptions add a wrinkle. If your business had 10 or fewer employees at all times during the calendar year, or your industry sits on OSHA's partially exempt list ^[1], you don't have to routinely keep 300 Logs. You still report severe injuries (hospitalizations, amputations, loss of an eye) within 24 hours ^[2], and you still keep exposure and training records under the standard-specific rules. A size exemption is not a recordkeeping exemption.

Pull up your NAICS code and check the OSHA partial exemption list before you assume you're off the hook. See also the broader osha overview for how the rules break down by employer size and industry.

How long do you have to keep OSHA records? A retention schedule

Retention windows range from one year to forty. The table below pulls each period straight from the CFR citation, so you can see exactly which standard drives which clock.

Record type	Governing standard	Minimum retention
OSHA 300 Log, 300-A, 301 Incident Reports	29 CFR 1904.33	5 years following the end of the calendar year the records cover [3]
Employee exposure records (air monitoring, biological monitoring)	29 CFR 1910.1020(d)(1)(i)	30 years [4]
Employee medical records	29 CFR 1910.1020(d)(1)(ii)	Duration of employment plus 30 years [4]
Analysis using exposure or medical records	29 CFR 1910.1020(d)(2)	30 years [4]
Hazard communication training (informal)	29 CFR 1910.1200	No explicit duration in the standard; OSHA letters of interpretation recommend keeping at minimum until employment ends
Lockout/tagout training records	29 CFR 1910.147	Not specified; retain at least through employment
Respiratory protection: fit test records	29 CFR 1910.134(m)(2)(i)	Until the next fit test is administered [5]
Respiratory protection: medical evaluations	29 CFR 1910.134(m)(2)(ii)	Not specified; align with 1910.1020 medical record rules to be safe
Forklift operator training and evaluation	29 CFR 1910.178(l)	No explicit duration; retain through employment and 1 year after, per common compliance practice
Noise exposure (audiometric testing records)	29 CFR 1910.95(m)(3)(ii)	Duration of employment [6]
Asbestos exposure records	29 CFR 1926.1101(m)	30 years
Lead exposure records	29 CFR 1910.1025(n)	40 years or duration of employment plus 20 years, whichever is longer [7]

The 30-year window on exposure records catches a lot of employers off guard. OSHA's reasoning, laid out in the preamble to 1910.1020, is that occupational diseases like asbestosis or chemical-induced cancer can take decades to show up. If you use regulated substances (machining, auto body, construction, painting, fabrication), that 30-year clock is real, and you need a system that survives a software switch or a sale of the business.

Lead is the outlier. That 40-year window is the longest retention requirement in the OSHA general industry standards ^[7]. Construction employers should cross-reference 29 CFR 1926 for construction-specific lead and asbestos rules, which mostly mirror the general industry periods.

Does OSHA accept digital records, or does everything have to be on paper?

Digital storage is fully acceptable. OSHA's position, confirmed in letters of interpretation, is that you can keep records electronically as long as you can produce them in hard copy when a compliance officer asks ^[8].

That "when requested" standard has a hard deadline inside the injury and illness rule. Under 29 CFR 1904.40, you must provide records to an authorized OSHA representative by the end of the next business day. So if an inspector walks in at 9 a.m. Tuesday and asks for three years of 300 Logs, you hand them over before you close Wednesday.

Exposure and medical records run on a different clock. Under 29 CFR 1910.1020, inspectors, employees, and employee representatives can request access, and you must respond within 15 working days of a written request ^[4].

Practical requirements for digital records:

• The format has to be one you can retrieve and print. A PDF or Excel file works. A proprietary database only one vendor can read is a problem if that vendor folds in year 18 of a 30-year window.
• Backups matter. A single local hard drive is not a records system. Off-site or cloud backup with version control is the floor.
• Access controls can't block legitimate access. Employees have a right to their own medical and exposure records under 1910.1020 ^[4]. A password is fine. A system only the owner can open, while the owner is on vacation, is not.
• Electronic signatures are generally accepted for training records, though the governing standard controls. Check the individual standard if you're unsure.

Starting fresh? A shared folder with a naming convention (YYYY-MM-DD_employee-name_record-type) beats fancy software for most shops under 50 employees. Match the system to the record set, not the other way around.

Where should you physically (or digitally) store OSHA records?

OSHA doesn't name a location for most records. The practical constraints do the naming for you.

Injury and illness logs have to be at the establishment they cover, or at a central location if you can retrieve and transmit them to the establishment within 4 hours ^[3]. That 4-hour rule is specific to 29 CFR 1904. Run three job sites out of a main office and keep all the 300 Logs centrally? Fine, as long as you can get a site's records to an inspector standing at that site within 4 hours.

Exposure and medical records under 1910.1020 just have to be available at reasonable times and places. No mandated location, which means your attorney's vault, a cloud server, or a fireproof cabinet at the main office all qualify.

Physical storage:

• Use a fireproof cabinet or safe for paper you can't afford to lose. A $150 to $300 fireproof file box earns its keep on 30-year documents.
• Keep the current year and prior 4 years of 300 Logs on-site or quickly reachable. OSHA can ask for up to 5 years of logs without a subpoena.
• Label folders by calendar year and record type, not by employee name alone. An inspector usually wants a specific year or hazard, not a specific person.

Digital storage:

• Cloud backup through Google Workspace, Microsoft 365, or a document management platform is the practical baseline. You get off-site redundancy, version history, and search without buying a server.
• Name files consistently. When you go looking for a 2019 noise dosimetry report in 2049, you'll thank yourself.
• Set a calendar reminder to migrate records when you change platforms. "We moved everything to new software" is not a defense OSHA accepts.

For businesses running hazard communication programs, safety data sheets (SDSs) are a related question. SDSs must be accessible to employees during their shifts, but 1910.1200 sets no explicit 30-year SDS retention rule. Here's the catch: if an SDS documents a chemical an employee was exposed to, the exposure record rules in 1910.1020 can pull that SDS into the 30-year window by extension. When in doubt, keep it.

What happens to records when a small business closes or is sold?

Most owners never think about this until it's almost too late, and OSHA has a specific rule for it.

Under 29 CFR 1910.1020(h), if a business closes, the employer must transfer all employee medical and exposure records to NIOSH (the National Institute for Occupational Safety and Health) and notify affected employees of the transfer 3 months before closing ^[4]. Not optional. Not well-known.

For a sale, the rule lets a successor employer receive the records and keep maintaining them. No successor and no transfer to NIOSH? OSHA calls that a violation. In practice, attorneys handling small business closures or asset sales rarely know this rule exists, so you may have to raise it yourself.

Injury and illness logs (the 300 series) don't have the same transfer-to-NIOSH mechanism, but the 5-year retention obligation rides through a sale. Sell your business June 1, 2025, and the buyer inherits the duty to keep 300 Logs going back to 2020.

My advice: when you sell or close, copy everything and keep your own set. The legal obligation may move, but your personal liability for incidents that happened on your watch does not vanish. An employment attorney who handles OSHA matters can walk you through successor liability in your state.

What are employee rights to access their own OSHA records?

Employees have wide access rights, and OSHA enforces them. Under 29 CFR 1910.1020(e), employees and their designated representatives (including union reps and physicians) can access their own medical and exposure records ^[4].

Here's how it runs. An employee submits a written request. You provide access to exposure records within 15 working days. Medical records get the same 15-day clock, though you can offer access to the records rather than copies if that's easier logistically. You can charge for copies, but the fee can't be so high it effectively denies access.

Injury and illness records follow 29 CFR 1904.35. Current and former employees, plus their personal representatives, can request the 300 Log for their establishment, and you must provide it by the end of the next business day. You don't have to give non-affected employees access to 301 Incident Reports, but the injured employee, or their representative, can see their own 301.

A common mistake is treating injury logs like private HR files. The 300-A Summary is built to be posted publicly every year, February 1 through April 30. That's a requirement under 29 CFR 1904.32, not an option ^[3]. The summary carries no names, but the count and frequency of injuries is public information inside your workplace.

For your own tracking, read the incident report guide so you capture the right details at the time of injury. That makes retention far simpler later.

How do you set up a simple records management system that passes an OSHA inspection?

A compliance officer's job is to confirm records exist, are complete, and are accessible. They're not grading your filing aesthetics. A simple system you actually maintain beats an elaborate one you don't.

Here's a structure that works for a shop with 5 to 50 employees:

Folder 1: Injury and illness records

• One subfolder per calendar year
• Each year: 300 Log, 300-A Summary (signed), all 301s for that year
• Keep 5 years active; archive the rest

Folder 2: Training records

• One subfolder per employee or per training type (your call)
• Each record: employee name, date, topic, trainer, duration, and a signature or attestation
• For osha training that involves third-party certifications (like forklift certification), keep the original certificate plus your internal training sign-in sheet

Folder 3: Exposure monitoring

• Organized by substance and date
• Each record: sampling method, results, employee IDs exposed, date, lab report
• This folder lives for 30 years. Treat it that way.

Folder 4: Medical surveillance

• Organized by employee
• Confidential. Access-controlled. Separate from general HR files.
• Retention: employment duration plus 30 years

Folder 5: Equipment inspections

• Forklift daily checklists, crane certifications, fire extinguisher tags, eyewash tests
• Daily checklists usually kept 1 year; certification documents kept for the life of the equipment plus a few years

Folder 6: Written programs

• Current lockout/tagout program, respiratory protection program, emergency action plan, and the rest
• Keep current versions plus prior versions with their effective dates

Need the underlying programs before you worry about storing them? SafetyFolio's safety program generator produces OSHA-compliant written programs in about 15 minutes, which at least gives you something to file. The records system, though, has to be yours to run.

One non-negotiable: whoever owns records management has to know it's their job. In a small business, that's usually the owner or the operations manager. Write it into a job description or a safety assignment document so there's no confusion when that person leaves.

What does OSHA actually look at during a records inspection?

OSHA can inspect records during a programmed inspection (random or industry-targeted), an unprogrammed one (from a complaint, referral, or severe injury report), or a records-only audit. Records-only audits, sometimes called 300 Log audits, have been a periodic enforcement priority.

During a records inspection, the compliance officer usually asks for:

• The OSHA 300 Log for the current year and up to 4 prior years
• The 300-A Summary for those years
• The 301 Incident Reports for specific cases they want to examine
• Your written injury and illness recording procedures (if you have them)
• In some inspections, training records for specific standards (especially after an injury tied to a regulated hazard)

The most common recordkeeping citations are failure to record a case that should have been recorded, recording it incorrectly (wrong injury classification, for example), and failure to post the 300-A Summary. In fiscal year 2023, recordkeeping violations under 29 CFR 1904 ranked among the top 10 most-cited OSHA standards ^[9].

Penalties for recordkeeping violations can reach $16,131 per willful or repeated violation as of 2024 ^[10]. These often get treated as serious violations rather than administrative ones, especially when OSHA thinks the undercount was intentional.

One thing inspectors check that many employers miss: the 300 Log has to be recorded in near real time, within 7 calendar days of learning of a recordable work-related injury or illness ^[3]. It's not a year-end summary you knock out in January. A log where every entry is dated December 31 is a red flag.

Are there OSHA recordkeeping rules that differ by state?

Yes, and it matters if you operate in one of the 22 states and 2 territories that run their own OSHA-approved state plans ^[11]. State plans must be at least as effective as federal OSHA, but they're free to be stricter.

California's Cal/OSHA is the clearest example. It requires a written Injury and Illness Prevention Program (IIPP) under Title 8 CCR 3203, with documentation federal OSHA doesn't demand in the same form ^[12]. Washington's WISHA and Michigan OSHA also carry their own documentation standards in certain areas.

In a state plan state, the approach is simple: 1. Start with federal OSHA requirements as your baseline 2. Check your state plan's specific requirements on the state plan's own website 3. Apply whichever is stricter

For osha 30 training specifically, some states want documentation of state-plan-approved training beyond federal OSHA outreach training. Check with your state plan before you assume federal certification cards satisfy the state's records requirement.

The OSHA state plans page lists every approved plan and links to each state agency ^[11]. That's the most reliable place to confirm current rules, because state requirements do change.

What's the right way to document employee training to satisfy OSHA?

Training documentation is probably the single most common records gap in small businesses. The standard is simple in theory: show that a specific employee got training on a specific topic on a specific date, ideally with evidence of what was covered.

OSHA doesn't prescribe a training record format for most standards. A sign-in sheet, a completion certificate, a trainer's attestation, or a learning management system (LMS) record all work. What you need in any format:

• Employee full name
• Date of training
• Topics covered (a reference to the standard helps)
• Name and qualifications of the trainer (for standards that require qualified trainers)
• Some acknowledgment from the employee (signature or electronic equivalent)

For standards that require retraining (respirator users annually, forklift operators when performance slips, hazmat handlers when procedures change), you also need to show the retraining happened and what triggered it.

A common mistake is keeping only the external provider's certificate and losing the internal record of who attended which session. If your third-party trainer hands you a roster, keep a copy. If they don't, build your own.

For osha 30 training and OSHA 10 outreach courses, the completion card from an authorized trainer is your training record. But if your business has a standard-required training (respirator, hazcom, lockout/tagout), the outreach card does not substitute for standard-specific training documentation.

Some businesses use SafetyFolio to generate written programs, then attach training records to each program document. That's a reasonable system because it ties the training to the exact written procedure employees were trained on, which is the chain of evidence an inspector wants to see.

How should you handle OSHA 300 Log corrections and late entries?

Mistakes happen. An employee reports an injury two weeks late. You learn in January that a December incident turned out to be recordable. Your injury classification changes once more medical information comes in.

OSHA's 1904 rules allow and require corrections. Under 29 CFR 1904.33(b)(2), you must update entries to reflect changes in the outcome of a case, like days away from work still ongoing at year end ^[3]. The process is straightforward: correct the entry, add a note explaining what changed and when, and keep both the original and corrected version if you can.

For a late entry that should have been recorded earlier, add it to the log for the year the recordable event happened, not the current year. Date it when you add it, and note why it's late if you want to document good faith.

What you don't do is white out, delete, or alter entries to make them disappear. OSHA treats intentional removal of entries as a willful violation, which carries the top penalty tier. If a case was recorded that shouldn't have been (turned out non-work-related or non-recordable), you can void or strike it with a notation. Keep the original entry visible.

When ownership changes mid-year, the old owner's records stay with the old employer for the calendar year up to the transfer date. The new employer starts a fresh log from the transfer date forward. This is another spot where an employment attorney's read on the specific deal terms matters.

Frequently asked questions

Do small businesses with fewer than 10 employees have to keep OSHA injury records?

Employers with 10 or fewer employees at all times during the calendar year are partially exempt from routine OSHA 300 Log requirements under 29 CFR 1904.1. The exemption doesn't cover everything. You still must report any work-related fatality within 8 hours and any inpatient hospitalization, amputation, or eye loss within 24 hours ^[2]. Standard-specific training and exposure records (hazcom, lockout/tagout, and the rest) are required no matter your size.

Can I store OSHA records in the cloud, and does OSHA accept electronic signatures?

Yes to both, with caveats. OSHA has confirmed in letters of interpretation that electronic storage satisfies recordkeeping rules as long as records can be produced in hard copy on request ^[8]. Electronic signatures are generally accepted. The practical requirement is that records stay retrievable and printable, and that the system remains accessible for the full retention period, which can run 30 years for exposure records.

How long do I need to keep forklift training records?

The forklift standard at 29 CFR 1910.178(l) requires documented training and evaluation but sets no retention period. The consensus among OSHA compliance practitioners is to keep forklift training records for the duration of employment plus at least one year after the employee separates. If a post-injury investigation or lawsuit ever comes, those records are the first thing requested.

What OSHA records does an employee have a legal right to see?

Under 29 CFR 1910.1020(e), employees can access their own medical and exposure records within 15 working days of a written request ^[4]. Under 29 CFR 1904.35, employees can access the 300 Log for their establishment by the end of the next business day. Injured employees and their representatives can also access their own 301 Incident Reports. You cannot charge fees so high they effectively block access.

What happens to OSHA records when I sell my business?

Medical and exposure records must transfer to the successor employer under 29 CFR 1910.1020(h). If there's no successor, you must transfer records to NIOSH and notify affected employees at least 3 months before the business closes ^[4]. Injury and illness logs (the 300 series) carry over with the business. Make your own copies of everything before any asset transfer finalizes.

Does OSHA require a written records management policy?

No OSHA standard requires a written records management policy document. Having one still helps during an inspection because it shows the compliance officer your system is intentional, not accidental. A one-page document naming who's responsible for records, where they're stored, and how long each category is kept takes about an hour to write and can defuse a lot of inspector questions.

How long do I have to keep SDS sheets (safety data sheets)?

The hazard communication standard at 29 CFR 1910.1200 requires SDSs to be accessible to employees during their shifts but sets no post-use retention period. Here's the catch: if an SDS documents a chemical an employee was exposed to, OSHA's position under 1910.1020 is that exposure record rules may apply, meaning 30-year retention. The safe practice is to keep SDSs for substances employees were exposed to for at least 30 years.

What's the penalty for missing or incomplete OSHA records?

As of 2024, OSHA serious violations carry penalties up to $16,131 per violation, and willful or repeated violations can reach $161,323 per violation ^[10]. Recordkeeping failures, especially when OSHA believes cases were intentionally not recorded, are frequently classified as serious or willful. The 300 Log audit program has specifically targeted underrecording in high-injury industries.

Can OSHA show up and demand records without a scheduled inspection?

Yes. OSHA can conduct unannounced inspections and, in some cases, records-only audits without physically entering the workplace. Under 29 CFR 1904.40, you must provide injury and illness records by the end of the next business day when an authorized OSHA representative requests them ^[3]. For exposure and medical records under 1910.1020, the standard allows up to 15 working days to respond to written requests ^[4].

Do I need to keep records separately for each business location?

Each establishment you operate (a single physical location where business is conducted) needs its own 300 Log under 29 CFR 1904. You can run a centralized records system, but you must be able to retrieve and transmit records for a specific site within 4 hours of a request. Training and exposure records don't carry the same per-site rule, but tying records to the correct worksite makes audits far easier.

What's the difference between OSHA recordable and OSHA reportable injuries?

Recordable means the injury meets the criteria under 29 CFR 1904.7 (days away from work, restricted duty, medical treatment beyond first aid, loss of consciousness, and so on) and goes on your 300 Log. Reportable is narrower: fatalities must be reported to OSHA within 8 hours; inpatient hospitalizations, amputations, and eye losses within 24 hours ^[2]. An injury can be recordable without being reportable, but every reportable event is also recordable.

How do I document safety training if I use a third-party training provider?

Get a certificate or roster from the provider showing each employee's name, the date, and the course content. Add your own internal sign-in sheet if the provider's paperwork misses required fields. For standard-specific training, note the trainer's qualifications, since some OSHA standards require training by a 'competent person.' Keep your copy no matter what the provider claims to maintain, because you need access on your own schedule.

Are there different recordkeeping rules if I'm in a state-plan state?

State plan states must meet or exceed federal OSHA requirements and can add their own ^[11]. California's Cal/OSHA, for example, requires a written Injury and Illness Prevention Program with its own documentation elements under Title 8 CCR 3203 ^[12]. Washington and Michigan also carry state-specific twists. Check your state plan's own website after confirming the federal requirements, and apply whichever is stricter.

What's the OSHA rule for posting the injury and illness summary?

Under 29 CFR 1904.32, the 300-A Annual Summary must be posted in a visible location at each establishment from February 1 through April 30 of the year following the year it covers ^[3]. So the 2024 summary goes up February 1, 2025 and comes down no earlier than April 30, 2025. A company executive must certify it. Failure to post is one of the most commonly cited 1904 violations.

Sources

1. OSHA, Recordkeeping Rule 29 CFR 1904: 300 Logs, 300-A Summaries, and 301 Incident Reports must be retained for 5 years following the end of the calendar year they cover; the 300-A must be posted February 1 through April 30; entries must be made within 7 calendar days of learning of a recordable case
2. OSHA, Access to Employee Exposure and Medical Records, 29 CFR 1910.1020: Exposure records must be retained 30 years; medical records must be retained for employment duration plus 30 years; employees must be given access within 15 working days of written request; closing employers must transfer records to NIOSH
3. OSHA, Respiratory Protection Standard, 29 CFR 1910.134: Fit test records must be retained until the next fit test is administered per 29 CFR 1910.134(m)(2)(i)
4. OSHA, Occupational Noise Exposure Standard, 29 CFR 1910.95: Audiometric test records must be retained for the duration of the affected employee's employment per 29 CFR 1910.95(m)(3)(ii)
5. OSHA, Lead Standard General Industry, 29 CFR 1910.1025: Lead exposure and medical records must be retained 40 years or duration of employment plus 20 years, whichever is longer, per 29 CFR 1910.1025(n)
6. OSHA, Top 10 Most Cited Standards FY2023: Recordkeeping violations under 29 CFR 1904 ranked among the top 10 most cited OSHA standards in fiscal year 2023
7. OSHA, Penalties: As of 2024, OSHA serious violations carry penalties up to $16,131 per violation and willful or repeated violations up to $161,323 per violation
8. OSHA, State Plans: 22 states and 2 territories operate OSHA-approved state plans that must be at least as effective as federal OSHA requirements and may be stricter
9. California Department of Industrial Relations, Cal/OSHA Title 8 CCR 3203 Injury and Illness Prevention Program: California's IIPP regulation at Title 8 CCR 3203 requires a written IIPP with specific documentation elements not explicitly required in the same form by federal OSHA