Incident reporting: what OSHA requires and how to do it right

Last updated 2026-07-09

What is incident reporting and why does OSHA care about it?

Incident reporting is how an employer documents and, for the worst events, notifies OSHA when a worker is killed, seriously hurt, or injured in a way that meets specific recordability thresholds. It is not optional, and it is more than paperwork.

OSHA's reasoning is simple. The agency cannot spot hazard patterns across an industry if employers quietly absorb injuries and never write them down. The Bureau of Labor Statistics counted 5,486 fatal work injuries in 2022, and 2.8 million nonfatal injury and illness cases in private industry that same year ^[1][2]. Without systematic reporting, those numbers do not exist.

For small business owners, incident reporting has two legs that people constantly confuse. The first is immediate phone reporting to OSHA for the most serious events. The second is the ongoing written recordkeeping system, the OSHA 300 log and its companion forms, that tracks every recordable injury across the year. Different rules. Different deadlines. Different exemptions. Mixing them up is one of the most common compliance mistakes small employers make.

Understanding OSHA basics helps here, because the reporting rules flow straight from the Occupational Safety and Health Act of 1970. That law gives OSHA authority to set these requirements under 29 CFR Part 1904 for recordkeeping and 29 CFR 1904.39 for severe injury reporting ^[3].

What events must you report to OSHA immediately?

Three events trigger immediate reporting under 29 CFR 1904.39: a work-related fatality, the in-patient hospitalization of one or more employees, or an amputation or eye loss ^[3]. A fatality gets reported within 8 hours. Hospitalizations, amputations, and eye losses get reported within 24 hours.

The clock starts when the employer learns about the event, not when it happens. Do not count on that distinction buying you much room. If a worker is hospitalized Friday night and you hear about it Saturday morning, you have until Sunday morning to call.

You report three ways: call 1-800-321-OSHA (1-800-321-6742), contact your nearest OSHA area office during business hours, or use OSHA's online severe injury report form at osha.gov. The phone line runs 24 hours.

The definitions are narrower than they sound. A fatality is reportable only if the death occurs within 30 days of the work-related incident. A hospitalization means formal in-patient admission, more than an emergency room visit or observation status. An amputation is the traumatic loss of a limb or part of one; degloving and avulsion injuries do not count. Loss of an eye means the eye is removed (enucleation), not loss of vision in an eye that stays put.

Some severe-sounding events are carved out. Heart attacks on the job, motor vehicle accidents on public streets, and injuries to employees of other employers at your site all have their own handling ^[3]. OSHA's 2015 rulemaking rewrote 29 CFR 1904.39 to add hospitalizations and amputations, expanding well past the old rule that only covered fatalities and catastrophes.

Event	Reporting deadline	How to report
Work-related fatality (within 30 days of incident)	8 hours	1-800-321-OSHA, area office, or osha.gov
In-patient hospitalization of 1+ employees	24 hours	Same as above
Amputation	24 hours	Same as above
Loss of an eye	24 hours	Same as above
ER visit only (no admission)	Not required	N/A
Heart attack at work	Not required unless work-related	N/A

Which employers are exempt from OSHA recordkeeping requirements?

Almost nobody is exempt from the immediate severe injury reporting rules. The 8-hour and 24-hour requirements under 29 CFR 1904.39 apply to nearly every employer, including small businesses and firms in partially exempt industries. There is no size exemption. If someone dies at your job site, you call OSHA, however many people you employ.

The recordkeeping requirements work differently. Employers with 10 or fewer employees at all times during the previous calendar year are exempt from routine recordkeeping (the 300 log, 301 incident report, and 300A annual summary) under 29 CFR 1904.1 ^[3]. Employers in certain low-hazard industries are partially exempt under 29 CFR 1904.2 regardless of size.

The low-hazard list covers things like retail, finance, insurance, and some service industries, keyed to NAICS codes. OSHA publishes the full list. If your NAICS code is on it, you are exempt from routine 300 log requirements unless OSHA or the BLS specifically asks you to keep records. Check your industry's status through OSHA's Injury Tracking Application page at osha.gov/injuryreporting.

State plan states raise the bar. About half the country runs its own OSHA-approved plan, and some are stricter. California's Cal/OSHA, for example, requires an Injury and Illness Prevention Program that goes past federal minimums. Check your state plan before you assume a federal exemption covers you ^[4].

One more thing. Being exempt from routine recordkeeping does not mean the incident never happened. Documenting injuries internally is smart practice even when the law does not force it, and any OSHA inspection can request the records you do keep.

What is the OSHA 300 log and what goes on it?

The OSHA 300 log (formally the Log of Work-Related Injuries and Illnesses) is the backbone recordkeeping document for covered employers. Each recordable case gets its own line: employee name (unless it is a privacy case), job title, date, where it happened, a short description, and which outcome column applies. Days away from work, restricted work, job transfer, other recordable case, or death ^[3].

A case is recordable if it is work-related, it is a new case, and it meets one of the general recording criteria under 29 CFR 1904.7: death, days away from work, restricted work, job transfer, medical treatment beyond first aid, loss of consciousness, or a significant injury or illness diagnosed by a licensed healthcare professional. First aid only cases stay off the log. OSHA lists exactly what counts as first aid versus medical treatment in 29 CFR 1904.7.

Two companion forms ride with the 300 log. The OSHA 301 (Injury and Illness Incident Report) is the detailed narrative for each case. Many employers substitute their workers' compensation first report of injury form if it captures the same fields. The OSHA 300A annual summary is what you post on the workplace bulletin board from February 1 through April 30, covering the prior year. A company executive has to sign it.

Records stay for 5 years from the end of the calendar year they cover ^[3]. OSHA can ask for them any time inside that window.

For a sense of what actually lands on the log, BLS data for 2022 shows overexertion (mostly lifting and lowering) and falls, slips, and trips drove most days-away-from-work cases in private industry ^[2]. Those are the events your reporting system documents most often.

How do you conduct a proper internal incident investigation?

Filling out an incident report and investigating what happened are two different things. OSHA does not mandate a specific method, but the agency's guidance pushes employers to find root causes rather than stop at the surface facts ^[5].

A basic investigation runs in steps. Secure the scene and get medical help for anyone who needs it. Gather facts fast, while memories are fresh: the injured worker (if able), witnesses, supervisors. Document the physical conditions, take photos, preserve any equipment involved. Then trace backward to the contributing factors behind the obvious cause.

Here is the difference that matters. A worker who slipped on a wet floor did not fall because the floor was wet. The floor was wet because a drain was blocked, and the drain was blocked because a maintenance inspection got skipped. The skipped inspection is the cause worth fixing.

OSHA training programs, including material covered in OSHA 30 courses, teach incident investigation as a core safety skill. The framework goes by root cause analysis or causal factor analysis, and the names shift depending on who is teaching it.

The investigation should end in a written report: what happened, who was involved, immediate and root causes, planned corrective actions, who owns each action, and a target date. That report becomes part of your OSHA 301 file and, more useful, the internal record that proves you are turning incident data into prevention.

The common small-employer mistake is treating the report as the finish line. It is the starting line. Fill out the form, drop it in a drawer, ignore the root cause, and you will see the same incident again.

What should a written incident reporting program include?

A written incident reporting program is the policy that tells employees, supervisors, and managers exactly what to do when something goes wrong. OSHA requires written programs for plenty of specific standards, lockout/tagout under 29 CFR 1910.147 and hazard communication under 29 CFR 1910.1200 among them, but it does not explicitly require a standalone written incident reporting program the way it requires those ^[6][7].

Having one anyway is the right call for any employer past a handful of workers. A good program covers five things.

Scope and definitions. What counts as an incident that needs a report? Most programs split injuries (any harm to a person), near misses (events that could have caused harm but did not), property damage, and environmental events. Near-miss reporting earns its keep because it catches hazards before anyone gets hurt.

Reporting procedures. Who does an employee notify first? What is the time frame for initial notification (most programs say immediately or within hours)? Who writes the formal report? Who calls OSHA if the event hits the 8-hour or 24-hour threshold?

Investigation responsibilities. Which incidents get a full investigation versus a basic report? Who runs it? What documentation is required?

Corrective action tracking. How do you make sure follow-up actually happens instead of dying in an inbox?

Employee protections. Your program should state, in writing, that workers face no retaliation for reporting injuries or near misses. Section 11(c) of the OSH Act makes retaliation for reporting illegal, and OSHA enforces it ^[8]. Employers who discourage reporting through incentive programs (prizes for zero incidents) or discipline tied to injury rates have drawn citations and heavy penalties.

If you are building this from scratch, SafetyFolio's safety program generator produces a written incident reporting program in about 15 minutes, customized to your industry and state.

What are the OSHA penalties for not reporting an incident?

Missing a required report is a real citation, treated as an other-than-serious or serious violation depending on the facts. As of 2024, OSHA's maximum penalty for a serious violation is $16,131 per violation. Willful or repeated violations reach $161,323 per violation ^[9].

For late or missed severe injury reports (the 8-hour and 24-hour rules), OSHA generally treats a first offense as a serious violation if the employer eventually reports, and as willful if the employer made no effort at all. These are among the cleaner citations OSHA can write, because the timestamp on the event and the timestamp on the report are both on paper. There is not much to argue about.

False or inaccurate recordkeeping is its own violation. Employers who lean on workers not to report, or who code lost-time injuries as job transfers to dodge the worse outcome column, face the same penalty structure plus potential retaliation claims.

State plan states set their own penalty schedules. Some match federal levels, some do not. California, for one, sets its own caps. Check your state plan's enforcement page for current numbers ^[4].

The math is not close. A proper incident report costs an hour of administrative time. A missed report costs up to $16,131, and that is before the injury itself. Workers' compensation for a single lost-time injury averages around $40,000 once you add medical and indemnity, according to National Safety Council data ^[10].

What incident reporting software options work for small businesses?

Paper works. Nothing in OSHA's rules requires electronic recordkeeping, and plenty of small employers keep fully compliant 300 logs on paper or in a spreadsheet. OSHA does require covered employers with 250 or more employees, plus certain high-hazard industries with 20 or more, to electronically submit their 300A data to the Injury Tracking Application each year, but that is a submission rule, not a format rule ^[3].

That said, software can kill the friction that makes incidents go unreported. When logging a near miss means tracking down a paper form, filling it out in triplicate, and hunting for a manager, it takes 45 minutes and it never happens. A mobile app where a worker reports in two minutes from the floor actually changes behavior.

Small business options split into a few buckets. Free or cheap: OSHA's own free 300 log spreadsheet templates, downloadable from osha.gov. Basic cloud forms like Google Forms or Typeform cost nothing and capture the essential fields; someone still has to move that data onto the real 300 log.

Dedicated incident reporting software that small business owners look at includes Intelex, Cority, EHS Insight, and SafetyCulture (formerly iAuditor). Pricing swings hard. Entry-level tiers ran roughly $50 to $300 per month as of mid-2024, though vendors change pricing often and most want a demo call before they quote. No endorsement here. The right pick depends on whether you need integrations with HR or workers' comp, how many locations you run, and whether your team will actually use a mobile app.

Straight answer: fewer than 25 employees and one location, a well-organized spreadsheet plus a clear reporting procedure in your written safety program gets you through most audits. Software earns its cost when you have multiple supervisors, multiple sites, or enough volume that trend analysis tells you something.

How does OSHA's electronic reporting requirement affect small businesses?

Since 2024, the electronic recordkeeping rule under 29 CFR 1904.41 requires certain employers to submit injury and illness data through OSHA's Injury Tracking Application (ITA) each year at osha.gov ^[3]. Who submits, and what, depends on size and hazard level.

Employer category	What to submit	Deadline
250+ employees (covered industries)	300A summary annually	March 2 each year
20-249 employees in high-hazard industries (NAICS-listed)	300A summary annually	March 2 each year
100+ employees in certain high-hazard industries (added by 2023 rule)	300 log, 300A, and 301 forms	March 2 each year
Under 20 employees, low-hazard industry	No electronic submission required	N/A

The 2023 update, effective January 1, 2024, expanded the rule to require full 300 log and 301 form submission (more than just the 300A summary) from employers with 100 or more employees in high-hazard NAICS codes. That is a big jump in data flowing to OSHA, which the agency says it uses to target inspections.

Most small businesses under 20 employees in non-high-hazard industries are clear of all of it. But if you run a 30-person construction subcontractor or a 50-person food plant, read the NAICS list on OSHA's ITA page carefully. High-hazard industries include construction, manufacturing, agriculture, utilities, transportation, and warehousing, among others.

The ITA is free and needs no software. You can key in data by hand. But submitting full 300 log and 301 data for a 100-plus-employee company turns a spreadsheet painful fast, and that is where dedicated software starts paying for itself.

What is a near miss, and should you report it?

A near miss is an unplanned event that caused no injury, illness, or damage but easily could have. A scaffold board that shifts but does not fall. A forklift that clips a rack but does not tip. A chemical container that spills but only reaches the floor drain, not a person.

OSHA does not require near-miss reporting. No 8-hour rule, no 300 log entry, nothing.

Report them anyway.

Near misses are the best early-warning system a safety program has. The premise behind the National Safety Council's guidance and Heinrich's injury triangle, however much the exact ratios get argued, is the same: serious injuries come after many more minor incidents and near misses. Heinrich's original 1931 ratios do not hold up well against modern data, and honestly nobody should quote them as precise. The direction still holds. Organizations with active near-miss reporting catch and fix hazards before they turn into injuries.

A near-miss culture needs two things. A reporting path that does not punish people for coming forward, because if workers think a report gets them disciplined for unsafe behavior, they go quiet. And visible follow-up, because if every report drops into a void and nothing changes, the reporting stops inside a few weeks.

Your written program should name near misses in its scope, define them clearly, and make reporting dead simple. A five-field form (paper or app) takes under three minutes. That is a low price for catching a hazard that could put someone in the hospital.

How should you handle incident reporting when a contractor is injured on your site?

This one trips people up, and OSHA's rules are more nuanced than most employers expect.

For recordkeeping, under 29 CFR 1904.31, you record injuries to employees on your payroll and injuries to workers you supervise day to day, even if they are technically employed by a staffing agency or labor broker ^[3]. The test is supervision and direction, not the W-2.

Independent contractors and employees of another company who bring their own supervision do not go on your 300 log. Their employer records the injury. Here is the twist: if a contractor gets seriously hurt on your site and you had any control over the work conditions, you can still be cited for the safety violation behind the injury, entirely separate from who owns the log entry.

For immediate reporting (8 hours and 24 hours), 29 CFR 1904.39 requires you to report if the fatality or serious injury happened in your work environment, no matter the employment relationship ^[3]. A staffing agency worker who dies at your facility is a reportable event for you, even if you also expect the agency to report it.

Practical advice: do not try to finesse a contractor injury. If someone is seriously hurt on your site, report it. Sort out the technical employment relationship for the 300 log afterward. Blowing an 8-hour deadline because you spent the morning debating who owns the paperwork is a self-inflicted wound.

For multi-employer worksites like construction, OSHA's multi-employer citation policy applies, and incident reporting is one piece of a bigger coordination duty. The lockout tagout standard, for example, carries specific contractor coordination requirements that often overlap with incident reporting.

How do you build a reporting culture that workers will actually use?

A form nobody fills out is not a safety system. It is theater.

The data on underreporting is not comforting. OSHA guidance documents that workers frequently fear discipline or job loss if they report injuries, and that some incentive programs (bonuses for zero-incident stretches) structurally discourage reporting by putting money on the line against coming forward ^[8]. OSHA has specifically warned employers against these structures.

Getting workers to report near misses and injuries takes specific behavior from management, not a policy taped to a wall.

Make the process simple. If step one is finding a supervisor, step two is a two-page form, and step three is a formal meeting, most near misses die unreported. A one-page form, a mobile option, and one named point of contact make the path obvious.

Close the loop out loud. When a worker reports a hazard and something changes because of it, tell the team. Post a line on the safety board: "Last week someone flagged a slipping hazard by the loading dock. We added a floor mat. Thanks." This sounds small. It is not.

Separate reporting from discipline. The report is an information tool. Discipline decisions, if any, come later, handled separately, based on facts. Workers who believe the report itself triggers punishment stop reporting.

Supervisor behavior outweighs policy. If a supervisor rolls their eyes when a worker reports a near miss, the written policy is dead. OSHA training at the supervisor level targets exactly this, because supervisors are the real front line of any reporting system.

Nobody has clean aggregate data on what moves reporting rates most among small businesses specifically. The closest evidence comes from large manufacturer studies and safety climate research, which keep pointing at one thing: perceived management commitment is the strongest predictor of whether people report.

What records do you need to keep, and for how long?

Five years. Under 29 CFR 1904.33 you keep the OSHA 300 log, the 300A annual summary, and the 301 incident reports for 5 years from the end of the calendar year they cover ^[3]. If OSHA requests them inside that window, you produce the 300 log and 300A within 4 business hours and the 301 forms within 7 calendar days.

You also update the 300 log during the retention period when new information arrives. If an injury first looked like restricted duty but later became days away from work, you fix the entry. If an injured worker dies within 30 days of the incident from that injury, you update the entry and, separately, check whether a late fatality report to OSHA is now required.

The 300A summary gets posted in the workplace from February 1 through April 30 each year, covering the prior year. A company executive signs it: an owner, officer, or the highest-ranking official at the establishment ^[3]. A safety manager's signature does not cut it unless that person is also a company officer.

OSHA's 5 years is a floor, not a ceiling. Workers' compensation records often carry their own retention schedules under state law, sometimes 7 to 10 years. If a comp claim is contested, those records turn into evidence. Keep incident documentation longer than OSHA's minimum if your state or your insurance carrier says so.

The incident report form itself, OSHA's 301, is a free download from osha.gov. Many employers use their workers' comp carrier's first report of injury form instead, which is an acceptable substitute when it captures every required field.

Frequently asked questions

Do I have to report a near miss to OSHA?

No. OSHA does not require near-miss reporting. The mandatory immediate reporting rules under 29 CFR 1904.39 cover only fatalities, in-patient hospitalizations, amputations, and eye losses. Near misses carry no federal deadline. Tracking them internally is still one of the most effective things a small employer can do to stop serious injuries before they happen.

What if I miss the 8-hour fatality reporting deadline?

Report the moment you realize you missed it. Call 1-800-321-OSHA right away. Late reporting is a violation and OSHA may cite it, typically as a serious violation at up to $16,131. Willful failure to report at all can reach $161,323. Calling late always beats not calling.

Can I use my workers' compensation form instead of the OSHA 301?

Yes. Under 29 CFR 1904.10, OSHA lets employers substitute a workers' compensation first report of injury form for the OSHA 301, as long as the WC form captures all the required data fields. Most state WC forms do. Check yours against the OSHA 301 fields before relying on it, and keep the WC forms in the same 5-year filing system.

Does a first aid only case need to go on the OSHA 300 log?

No. Under 29 CFR 1904.7, cases involving only first aid are not recordable. First aid includes one-time wound cleaning, bandaging, non-prescription medication at non-prescription strength, and tetanus shots. The line is crossed when medical treatment beyond first aid is provided, including prescription medication, stitches, or physical therapy.

Does an ER visit without hospital admission require an OSHA report?

No. An emergency room visit that ends in outpatient treatment does not trigger an immediate OSHA report. The 24-hour rule under 29 CFR 1904.39 applies only to in-patient hospitalization, meaning formal admission. Treatment and discharge does not count. The case may still be recordable on the 300 log if it meets other criteria.

What is the OSHA Injury Tracking Application and who must use it?

OSHA's Injury Tracking Application (ITA) is the electronic portal for submitting 300A summary data, reachable through osha.gov. Employers with 250 or more employees in covered industries must submit by March 2 each year. Employers with 20 to 249 in high-hazard NAICS industries also submit. Since 2024, employers with 100 or more in certain high-hazard industries must submit full 300 log and 301 forms too.

Can OSHA retaliate against workers for reporting injuries?

No, and neither can employers. Section 11(c) of the OSH Act bars employers from discriminating against workers who report injuries or exercise other OSHA rights. Workers have 30 days to file a retaliation complaint with OSHA. Employers whose incentive programs punish reporting, or who discipline workers for getting hurt, have faced citations and settlements under the anti-retaliation rules.

How long do I have to keep OSHA incident records?

Five years from the end of the calendar year the records cover, under 29 CFR 1904.33. That covers the OSHA 300 log, 300A summary, and 301 incident reports. Inside that window, OSHA can request the 300 log within 4 business hours and the 301 forms within 7 calendar days. Your state workers' compensation laws may require longer.

Does my state have different incident reporting rules than federal OSHA?

Possibly. Twenty-two states and two territories run their own OSHA-approved plans, which must be at least as effective as federal OSHA and may be stricter. California, Washington, Michigan, and others add requirements around injury reporting, illness prevention programs, and electronic submission. Check your state's plan directly; do not assume a federal exemption applies to you.

What happens if I have fewer than 10 employees?

Employers with 10 or fewer employees at all times during the previous calendar year are exempt from routine OSHA recordkeeping under 29 CFR 1904.1. You do not maintain an OSHA 300 log. But the immediate severe injury reporting rules still apply. If a worker dies or is hospitalized at your 5-person shop, you still call OSHA within 8 or 24 hours.

Is incident reporting software worth the cost for a small business?

For most employers under 25 people with one location, a clear written procedure and an organized spreadsheet handle compliance fine. Software earns its cost when you have multiple sites, high incident volume, or need trend reporting to satisfy insurance or client requirements. Entry-level incident reporting software ran $50 to $300 per month as of 2024, worth weighing against your current administrative time cost.

Do I need to report a work-related illness the same way as an injury?

Occupational illnesses like chemical exposure, repetitive stress disorders, or heat illness follow the same recordkeeping rules as injuries under 29 CFR 1904.5 through 1904.11. They go on the 300 log if they meet the general recording criteria. The immediate reporting rules (8 and 24 hours) apply if an illness causes a fatality, hospitalization, amputation, or eye loss, same as an acute injury.

What information does the OSHA 300 log actually require me to record?

For each recordable case: the case number, employee name (unless a privacy case), job title, date of injury or onset of illness, location, a brief description, the body part affected, and the outcome column (days away, restricted, transfer, other recordable, or death). You also record the number of days away or restricted where it applies. OSHA provides a free 300 log template at osha.gov.

When does a work-related injury become a day-away-from-work case?

It becomes a days-away-from-work case when a licensed healthcare professional recommends the employee stay home, or when the employer sends the employee home, because of the injury or illness. The count starts the day after the injury. Days the employer is closed (weekends, holidays) still count if the employee could not have worked them. The total days away is capped at 180 for recording purposes.

Sources

1. Bureau of Labor Statistics, National Census of Fatal Occupational Injuries 2022: 5,486 fatal work injuries occurred in the United States in 2022
2. Bureau of Labor Statistics, Employer-Reported Workplace Injuries and Illnesses 2022: 2.8 million nonfatal workplace injury and illness cases recorded in private industry in 2022
3. OSHA, 29 CFR Part 1904 Recordkeeping and Reporting Occupational Injuries and Illnesses: Fatalities must be reported within 8 hours; hospitalizations, amputations, and eye losses within 24 hours under 29 CFR 1904.39; recordkeeping exemption for employers with 10 or fewer employees under 29 CFR 1904.1; records retained 5 years under 29 CFR 1904.33
4. OSHA, State Plans page: Twenty-two states and two territories operate OSHA-approved state plans that may have stricter requirements than federal OSHA
5. OSHA, Incident Investigation guidance: OSHA guidance encourages employers to identify root causes of incidents, not just document surface facts
6. OSHA, 29 CFR 1910.147 Control of Hazardous Energy (lockout/tagout): OSHA requires a written energy control program under 29 CFR 1910.147
7. OSHA, 29 CFR 1910.1200 Hazard Communication Standard: OSHA requires a written hazard communication program under 29 CFR 1910.1200
8. OSHA, Penalties page: As of 2024, maximum OSHA penalty for a serious violation is $16,131 per violation; willful or repeated violations up to $161,323 per violation
9. National Safety Council, Injury Facts: Workers' compensation costs for a lost-time injury average $40,000 or more including medical and indemnity costs