Incident-based reporting: what it is, what OSHA requires, and how to do it right

Last updated 2026-07-09

What is incident-based reporting in the workplace?

Incident-based reporting is the practice of recording and, when the law requires it, reporting workplace events that cause injury, illness, or death. The phrase covers two jobs that people constantly mix up: internal documentation (keeping your own records so you can spot patterns and fix hazards) and external reporting (calling OSHA when something serious happens).

The internal side lives in your OSHA 300 Log, the 300-A Annual Summary, and individual 301 Incident Report forms. The external side kicks in the moment a worker dies, is hospitalized overnight, loses a finger, or loses an eye at work.

Small employers conflate the two all the time. A near-miss that bruised nobody still belongs in your internal tracking. A fatality triggers a federal phone call within 8 hours whether or not you keep a 300 Log. Knowing the difference saves you from both under-reporting (which invites citations) and from panicking over incidents that need no OSHA call at all.

The system is also a feedback loop. The BLS Survey of Occupational Injuries and Illnesses, built from employer OSHA records, counted 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023 ^[1]. That number only exists because employers tracked events. No consistent reporting, no data. No data, no pressure to make the work safer.

Which employers must keep OSHA injury and illness records?

The general rule is simple. If you had 10 or more employees at any point in the previous calendar year and your industry is not exempt, you must keep OSHA injury and illness records under 29 CFR 1904.1 ^[2]. Employers with fewer than 10 employees are partially exempt from routine recordkeeping, but nobody is ever exempt from the severe-injury reporting rules.

OSHA also exempts certain low-hazard industries from routine 300 Log recordkeeping no matter the size. The list covers most retail, finance, insurance, real estate, and professional services. You can check your specific NAICS code against OSHA's partially exempt industry list ^[9]. If you land on that list, you still report fatalities, hospitalizations, amputations, and eye losses. The exemption covers paperwork, not phone calls.

One more layer. Establishments with 100 or more employees in high-hazard industries must electronically submit their 300 Log data every year through OSHA's Injury Tracking Application (ITA). Establishments with 20 to 249 employees in certain industries submit their 300-A summary data instead ^[3]. The size thresholds and the ITA deadline (March 2 each year for the prior year's data) catch a lot of mid-size employers flat-footed.

Employer size	Routine 300 Log	Annual 300-A summary	Electronic ITA submission
Fewer than 10 employees	Not required	Not required	Not required
10-19 employees, non-exempt industry	Required	Required	Not required
20-249 employees, high-hazard NAICS	Required	Required	300-A required by March 2
100+ employees, high-hazard NAICS	Required	Required	Full 300 Log by March 2

What are the OSHA reporting deadlines for serious incidents?

This is where mistakes get expensive. The deadlines are firm, and the penalties for missing them are real.

Fatality: you report to OSHA within 8 hours of learning about a work-related death ^[4]. If the death happens within 30 days of a work-related incident, it still counts. A worker hurt Monday who dies the following week still starts the 8-hour clock the moment you learn of the death.

In-patient hospitalization, amputation, or eye loss: 24 hours from the time you learn it happened ^[4]. Hospitalization means overnight admission for medical treatment, more than an emergency room visit. An ER trip alone does not trigger the 24-hour report.

How do you report? Call OSHA's 24-hour hotline at 1-800-321-OSHA (6742), call your nearest area office, or use OSHA's online reporting tool for some incident types ^[8]. OSHA wants a live call for fatalities.

Have this ready before you dial: your establishment name, where the incident happened, the time it happened, the type of reportable event, the number of employees affected, names of injured workers (if they consent), a contact person and phone number, and a short description of what happened. You do not need a finished investigation before you call. The first report is just notification.

What counts as a recordable incident vs. a reportable incident?

These two words trip up almost everyone. They are not synonyms.

A recordable incident goes in your OSHA 300 Log. Under 29 CFR 1904.7, a work-related injury or illness is recordable if it results in days away from work, restricted work or job transfer, medical treatment beyond first aid, loss of consciousness, or a diagnosis of a significant injury or illness by a licensed healthcare professional ^[2]. That covers a lot of ground. A sprained wrist treated with prescription medication at urgent care is recordable even if the worker came back the next day.

First aid is the key exclusion. OSHA defines first aid in 29 CFR 1904.7(a) as a specific list of treatments: non-prescription medications at non-prescription strength, tetanus shots, wound cleaning, butterfly bandages, non-rigid splints, and a handful of others ^[2]. Stay on that list and it is generally not recordable. If the doctor writes a prescription, it almost certainly is.

A reportable incident triggers the mandatory phone call to OSHA. There are only four triggers: fatality, overnight hospitalization, amputation, and eye loss. A recordable injury that involves none of those four never gets called in. You write it in the 300 Log, keep the 301 form on file for 5 years, and that is it.

Near-misses sit in a third category. OSHA does not require you to record a near-miss unless an injury actually resulted. But ask any safety pro and they will tell you that tracking near-misses internally is the highest-return move a small employer can make. Near-misses are free lessons. Injuries are the ones you pay for.

How do you fill out the OSHA 300 Log correctly?

The OSHA 300 Log (officially Form 300, Log of Work-Related Injuries and Illnesses) has six columns that matter: employee name, job title, date of injury, location, a short description of the injury, and a set of checkboxes for the outcome (days away, job transfer) and the type of injury or illness ^[2].

A few practical points catch people.

Privacy cases: if the injury involves a sensitive diagnosis (HIV, hepatitis, sexual assault, mental illness, or certain reproductive issues), leave the employee's name blank on the 300 Log and keep a separate confidential list. You still record the incident. You just protect the name ^[2].

The 7-calendar-day rule: you have 7 calendar days from learning about a recordable incident to enter it on the 300 Log. That clock starts when you know it is recordable, not when the incident happened. If a worker tells you Monday that their Tuesday injury now needs prescription medication, your 7 days start Monday.

Days-away counts: you count calendar days away, more than workdays. Weekends count. Holidays count. Cap the count at 180 days per incident.

The 300-A Annual Summary gets posted from February 1 through April 30 where employees normally report to work. A company executive has to sign it. Run multiple establishments and each location needs its own 300 Log and its own posted 300-A.

What is an incident report form, and how does it differ from the OSHA 301?

The OSHA 301 Incident Report is the federal form you use to document each recordable injury or illness. Think of it as the supporting file behind each row on your 300 Log. It captures who was hurt, what they were doing, how it happened, what object or substance caused the harm, and what the treating provider said ^[2].

You complete a 301 (or an equivalent form with the same information) within 7 calendar days of learning a case is recordable. You keep it for 5 years. Former employees, their representatives, and OSHA inspectors can request access to 301 forms that name specific individuals, subject to privacy limits.

Plenty of employers use a custom internal incident report that goes further than the 301. That is fine and usually smart. Your internal form might ask root-cause questions, capture witness statements, document corrective actions, and track follow-up tasks. As long as you also have the 301-equivalent information, OSHA does not care that you added more. The 301 is a floor, not a ceiling.

For a printable walkthrough of what a good internal form looks like, see our guide to writing an incident report. It covers both the mandatory OSHA fields and the investigation questions that actually help prevent the next one.

How should you investigate a workplace incident after it happens?

Filling out forms is the compliance part. Investigating is the safety part. Most small employers do one without the other.

A useful investigation answers five questions: what happened, where and when, who was involved, why it happened (root cause, more than immediate cause), and what needs to change so it does not repeat. The 301 form gets you through the first three. Root cause and corrective action are on you.

Start within hours, not days. Physical evidence moves. Memories blur. If a worker slipped on a wet floor, take photos before someone mops. If equipment failed, isolate it before anyone touches it. The first hour after an incident is when the most useful evidence still exists.

The most common mistake is stopping at the immediate cause. "Worker slipped on wet floor" describes what happened. It does not explain why the floor was wet, why there was no anti-slip mat, why the warning sign was missing, or why nobody reported the spill. Those layers are where corrective action lives.

A few structured methods exist for root cause analysis: the 5-Whys (ask why five times in sequence), fault tree analysis for complex mechanical failures, and fishbone (Ishikawa) diagrams for sorting causes into categories. For most small-employer incidents, the 5-Whys takes about 20 minutes and surfaces enough to act on.

Document corrective actions and track them to completion. An investigation that produces a recommendation nobody implements is safety theater. OSHA inspectors who come out after a serious incident will ask to see prior 301 forms and check whether corrective actions actually happened.

What are the OSHA penalties for failing to report or record incidents?

OSHA rebuilt its civil penalty structure in 2015 under the Federal Civil Penalties Inflation Adjustment Act, and the numbers have climbed every year since ^[5]. As of 2024, the maximum penalty per serious violation is $16,131, and willful or repeated violations can hit $161,323 each ^[5].

Recordkeeping failures fall under 29 CFR 1904 and can be cited as serious violations when OSHA believes you knew an incident was recordable and failed to log it. Failing to report a fatality within 8 hours gets treated harshly, because it also blocks OSHA from investigating while evidence is fresh.

OSHA also enforces the anti-retaliation provisions of 29 CFR 1904.35 ^[6]. You cannot discipline workers for reporting injuries, you cannot discourage reporting through incentive programs that reward zero-injury rates, and you cannot require drug testing just because a worker reported an injury when nothing suggests drug use. OSHA issued guidance on this in 2016 and has cited employers under Section 11(c) of the OSH Act for these practices.

Here is the break for small employers. OSHA does reduce penalties by size. Employers with 25 or fewer employees get a 60% reduction in proposed penalties. Employers with 26 to 100 employees get 40% ^[5]. These are starting-point reductions, applied before any good-faith or history adjustments.

Paper citations are one risk. The bigger one is that an under-reported incident means an unexamined hazard, and an unexamined hazard hurts someone again.

What is electronic incident reporting and how does OSHA's ITA work?

OSHA's Injury Tracking Application (ITA) is the online portal where eligible employers submit annual injury and illness data. You create an account tied to your establishment's NAICS code and employee count ^[3].

The deadline is March 2 each year for the prior calendar year's data. Miss it and you can still submit late, but a late filing can weigh against you if you are inspected.

Who submits what: establishments with 250 or more employees in industries already required to keep records must submit full 300 Log data. Establishments with 20 to 249 employees in designated high-hazard industries submit only their 300-A summary. Both groups submit for the same prior calendar year.

The ITA takes direct data entry, CSV uploads, or API connections from some safety management software. Run multiple locations and each establishment that meets the threshold needs its own submission.

One consequence people forget: OSHA publishes the submitted data. Your establishment's injury rates become public record, visible to job applicants, customers, and union organizers. That is not a reason to under-report. It is a reason to fix the hazards driving your numbers.

If you are building a written safety program that assigns electronic reporting responsibilities, SafetyFolio's program generator walks you through the exact roles, deadlines, and recordkeeping steps so nothing slips.

How do you build an internal near-miss reporting system that workers actually use?

Near-miss reporting can beat injury reporting for value, because it lets you fix hazards before anyone gets hurt. The catch is that workers often stay quiet. They fear discipline, ridicule, or filing paperwork that goes nowhere.

The pattern in the research is steady enough to trust. Studies of near-miss programs across manufacturing and construction find that organizations with functioning programs catch and fix hazards before injury events at higher rates than those without them. OSHA's own guidance on safety and health programs calls near-miss reporting a core element of proactive hazard identification ^[7].

Four things make a near-miss system work.

Make reporting anonymous or blame-free. If workers think a report will trace back and trigger discipline, they will not file one. Plenty of employers use paper drop boxes or a simple Google Form for exactly this reason.

Close the loop fast. If a worker reports a loose railing and nothing happens for three weeks, they never report again. Even a quick "we looked at it, here is what we did" message within a week makes people feel heard.

Never use near-miss data punitively. The moment a near-miss report becomes a disciplinary document, the system dies.

Put near-miss trends into your regular safety meetings. Sharing sanitized examples with the whole team makes reporting normal and shows people their reports change something. Your osha training program is a natural place to introduce this with new hires.

How does incident reporting connect to your written safety program?

A written safety program that does not describe your incident reporting process is unfinished. OSHA's general duty clause (Section 5(a)(1) of the OSH Act) and the recordkeeping standard at 29 CFR 1904 expect a systematic process, more than good intentions ^[10].

At minimum, your written program should name who completes the 301 form (usually the direct supervisor or a designated safety coordinator), who posts the 300-A summary each February, who handles OSHA notifications for severe injuries, and how the company investigates incidents and tracks corrective actions.

If you have hazard communication obligations, lockout tagout procedures, or run equipment like forklifts where forklift certification is required, your incident reporting process should cover incidents tied to those hazards. An amputation during a lockout tagout failure is both a recordable injury and a trigger for a hard look at the equipment and the procedure.

Building all of this from scratch eats time most small business owners do not have. SafetyFolio's safety program generator produces a written program with incident reporting, investigation, and OSHA notification procedures already built in, customized to your industry and size, in about 15 minutes.

The written program matters for workers' comp too. Most insurers want to see a documented incident reporting process when you file a claim. A gap in the paper trail can slow claims and raise questions about your safety culture.

What records do you need to keep, and for how long?

OSHA is specific about retention. You keep your 300 Log, 300-A Annual Summary, and 301 Incident Reports for 5 years after the end of the calendar year they cover ^[2]. Your 2024 records stay on file through the end of 2029.

During those 5 years, you provide records to current and former employees, their personal representatives, and their authorized employee representatives (such as a union). You provide the 300 Log within 4 business hours of a request. The 301 forms for cases involving the requesting employee go out by the end of the next business day ^[2].

OSHA inspectors who show up can request all of these. You do not have to hand them over instantly during an unannounced inspection, but you need to produce them quickly.

Keep records in a format you can actually pull up. A manila folder stuffed under a desk that walks out the door with a departing office manager is not a recordkeeping system. Cloud storage with restricted access and named backups works. Safety software that exports 300 Logs on demand works. A shared drive with year-labeled folders works. Pick one and stick with it.

Records that document corrective actions after incidents belong right next to the 301 forms, even though OSHA does not strictly require it. If you are ever cited for a repeat violation, proof that you investigated prior similar incidents and fixed them is one of the few things that can cut a proposed penalty.

Frequently asked questions

Does a first aid only injury need to be recorded on the OSHA 300 Log?

No. Under 29 CFR 1904.7, injuries treated only with first aid as OSHA defines it are not recordable. OSHA's first-aid list includes non-prescription medications at non-prescription strength, wound cleaning, bandages, and similar treatments. The moment a prescription is written or treatment goes beyond that list, the case becomes recordable. When in doubt, call your OSHA area office for guidance.

What happens if I miss the 8-hour deadline to report a fatality to OSHA?

Missing the 8-hour fatality deadline is a citable violation under 29 CFR 1904.39. OSHA can issue a serious citation with a penalty up to $16,131 as of 2024. Report the moment you realize you missed it, even if the deadline has passed. Late reporting beats no reporting, and showing good faith after the fact can cut a proposed penalty. Document when you learned of the death and what you did right after.

Do remote workers count for OSHA recordkeeping purposes?

Yes, if the injury is work-related. Under OSHA's home-based work guidance, a recordable injury that happens while a remote worker performs work tasks at home goes on the employer's 300 Log. Injuries that happen at home but are not tied to work duties, like tripping on the way to the bathroom during a break, are generally not work-related and not recordable.

What is the difference between OSHA's 300 Log and the 301 form?

The 300 Log is a running annual list of all recordable injuries and illnesses at your establishment, captured as a table. The 301 Incident Report is a separate, detailed form for each individual case on that log. It documents how the incident happened, the nature of the injury, and the treatment. Both must be kept for 5 years. Many employers also use an internal incident report that goes further than the 301.

Can OSHA cite me for injuries that happened before they showed up for an inspection?

Yes. OSHA inspectors routinely review the last 3 to 5 years of 300 Logs during an inspection. If they find injuries that should have been recorded and were not, they can issue recordkeeping citations. They also look for patterns. If the same injury recurs and you have no record of corrective action, that can support a repeat or willful finding, which carries higher penalties.

Are near-miss incidents required to be recorded on the OSHA 300 Log?

No. Near-misses that cause no injury, illness, or loss of consciousness are not recordable under 29 CFR 1904. But OSHA strongly encourages internal near-miss tracking as part of a proactive safety program. Many safety professionals argue near-miss reporting is the single most valuable safety activity a small employer can do, because it surfaces hazards before they injure anyone.

What is OSHA's Injury Tracking Application (ITA) and who has to use it?

The ITA is OSHA's online portal for electronic submission of annual injury and illness data. Establishments with 250 or more employees in routinely-covered industries submit full 300 Log data by March 2 each year. Establishments with 20 to 249 employees in certain high-hazard NAICS industries submit their 300-A summary. OSHA publishes the submitted data, so your establishment's injury rates become visible online.

Does an employee's prior medical condition affect whether an injury is recordable?

Not if the work event significantly aggravated the pre-existing condition. Under 29 CFR 1904.5, a case is work-related if an event or exposure in the work environment caused, contributed to, or significantly aggravated a pre-existing condition. Conditions that are simply symptomatic at work without any work aggravation are not recordable. The key word is significantly. Minor aggravation from normal work activities is a gray area OSHA resolves case by case.

How do I handle a recordable injury for a temporary or staffing agency worker?

The employer who supervises the day-to-day work records the injury. If you bring in a temp from a staffing agency and direct their work on your site, a recordable injury goes on your 300 Log, not the agency's. If the agency supervises the tasks and you just provide the space, the agency records it. When both share supervision, OSHA says the primary employer records it. Put the responsibility in your staffing contract in writing.

What should I do if a worker refuses to report an injury?

Your OSHA recordkeeping obligation stands regardless of whether the worker reports. If you have any knowledge a work-related injury occurred, from a coworker, a supervisor's observation, or medical documentation, and it meets the recordability criteria, you must record it. Review your reporting policy with all employees each year and confirm it is non-retaliatory. Workers who fear discipline for reporting are the root cause of most unreported injuries.

How does incident reporting connect to workers' compensation claims?

OSHA injury recordkeeping and workers' compensation are separate systems run by different agencies, but they overlap a lot. An injury recordable on the 300 Log usually triggers a workers' comp claim too. Some employers try to discourage reporting to hold comp claims down, but OSHA's anti-retaliation rule at 29 CFR 1904.35 forbids it. Undercounting injuries also tends to raise long-term comp costs by delaying treatment and dragging out claims.

Does OSHA require me to notify employees about their right to report injuries?

Yes. Under 29 CFR 1904.35, employers must tell each employee how to report a work-related injury or illness and must not discourage or deter reporting. OSHA published a final rule on this in 2016. The OSHA poster, required for all covered employers, includes language on the right to report injuries. Include reporting procedures in new-hire orientation and your written safety program too.

Is there a difference between incident-based reporting and outcome-based reporting?

Yes, and it matters for safety culture. Incident-based reporting captures events after they happen: injuries, illnesses, near-misses. Outcome-based metrics like injury rates are calculated from that data. Leading indicators, by contrast, measure proactive activity: training completed, inspections done, hazards corrected. A healthy program tracks both. Relying on injury counts alone misses the hazards that have not hurt anyone yet.

Sources

1. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses 2023: 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023
2. OSHA, 29 CFR Part 1904, Recording and Reporting Occupational Injuries and Illnesses: Recordkeeping requirements including 300 Log, 301 form, 300-A summary, 5-year retention, first aid definition, privacy cases, and 7-day entry rule
3. OSHA, Injury Tracking Application (ITA): Electronic submission requirements, establishment size thresholds, and March 2 annual deadline
4. OSHA, 29 CFR 1904.39, Reporting fatalities, hospitalizations, amputations, and losses of an eye to OSHA: 8-hour deadline for fatality reporting and 24-hour deadline for in-patient hospitalization, amputation, or eye loss
5. OSHA, Penalties: Maximum penalty of $16,131 per serious violation and $161,323 per willful or repeated violation as of 2024; small employer penalty reductions of 60% for 25 or fewer employees and 40% for 26 to 100 employees
6. OSHA, 29 CFR 1904.35, Employee involvement and anti-retaliation: Anti-retaliation provisions prohibiting discipline for reporting injuries, discouraging reporting through incentive programs, or requiring drug testing without reasonable basis
7. OSHA, Recommended Practices for Safety and Health Programs: Near-miss reporting is a core element of proactive hazard identification in OSHA's recommended safety and health program framework
8. OSHA, Reporting a Fatality or Severe Injury: Employers can report fatalities and severe injuries via OSHA's 24-hour hotline 1-800-321-OSHA or online reporting tool
9. OSHA, Recordkeeping (Who Is Required to Keep Records): Partially exempt industries list based on NAICS code; exempt employers still must report severe injuries directly to OSHA