OSHA recordkeeping retention requirements by document type

Last updated 2026-07-11

What are OSHA's recordkeeping retention requirements?

OSHA has no single retention period. It has a patchwork of rules spread across different standards, each with its own clock. Injury and illness records run five years under 29 CFR 1904.33 ^[1]. Exposure and medical records run 30 years under 29 CFR 1910.1020 ^[2]. Most training records run three years, depending on the standard.

The confusion makes sense. A first-time small business owner assumes one number covers everything. It doesn't. Once you map each document type to its rule, though, the whole thing gets easy to run.

This article covers every major document category, the exact CFR citation behind each period, what starts the clock, and what OSHA does when records go missing during an inspection. The next section has the quick-reference table if you want the numbers first.

How long must each type of OSHA record be kept? (full retention schedule)

Here is the retention schedule for the document categories OSHA inspectors actually ask for. Every period below traces to a specific CFR provision or agency guidance document.

Document Type	Retention Period	Governing Standard
OSHA 300 Log (injury/illness log)	5 years	29 CFR 1904.33
OSHA 300A Summary	5 years	29 CFR 1904.33
OSHA 301 Incident Report	5 years	29 CFR 1904.33
Employee medical records	30 years (duration of employment + 30)	29 CFR 1910.1020(d)(1)(i)
Employee exposure records	30 years	29 CFR 1910.1020(d)(1)(ii)
Safety Data Sheets (SDSs)	Duration of employment + 30 years	29 CFR 1910.1020(d)(1)(ii)
Hazard communication written program	No explicit retention period; keep current	29 CFR 1910.1200
Lockout/tagout procedures	No explicit period; keep current + inspections 1 year	29 CFR 1910.147(c)(6)
Lockout/tagout periodic inspection certifications	1 year (until next annual inspection)	29 CFR 1910.147(c)(6)(ii)
Respirator fit-test records	Until next fit test	29 CFR 1910.134(m)(2)(i)
Respirator medical evaluations	Duration of employment	29 CFR 1910.134(m)(1)
Bloodborne pathogens training	3 years	29 CFR 1910.1030(h)(2)(ii)
Bloodborne pathogens medical records	Duration of employment + 30 years	29 CFR 1910.1030(h)(1)(ii)
Hearing conservation audiograms	Duration of employment	29 CFR 1910.95(m)(3)(i)
Crane/derrick inspection records	Varies; monthly inspections 3 months, annual inspections life of equipment	29 CFR 1926.1412
Forklift operator training certifications	3 years	29 CFR 1910.178(l)(4)
Hazardous waste training records (HAZWOPER)	3 years after leaving employment	29 CFR 1910.120(e)(4)

Two things jump off this table. Exposure-related documents have far longer tails than anything else, by decades. And some standards say "current" instead of a fixed number, which means you keep the document active and updated, not filed away in a box. ^[1][2][3]

The forklift certification rule under 29 CFR 1910.178(l)(4) is one of the most missed in general industry. The standard requires the employer to certify that each operator was trained and evaluated, and the certification has to name the operator, the training date, and the evaluation date. A card without dates fails.

What is the five-year rule for injury and illness records?

The five-year rule under 29 CFR 1904.33 covers the 300 Log, the 300A Summary, and the 301 Incident Report (or an equivalent form). ^[1] The clock starts January 1 of the year after the calendar year the records cover. Your 2024 records have to survive through December 31, 2029.

During that five-year window you also have to update the 300 Log when new information changes how a case is classified. A worker first recorded as "days away from work" who later returns to full duty with no restriction? That entry needs correcting. People forget the update duty the moment a year closes.

The 300A Annual Summary is its own document. Employers with more than 10 employees, and not in a partially exempt industry, must post the 300A somewhere visible from February 1 through April 30 every year. ^[4] It comes down after April 30, but it stays in the files for five years. The 301 Incident Report, or a workers' comp first report of injury that captures the same fields, gets the same five-year treatment.

Do you need all three forms, or just some? All three. Each holds different information. The 300 is the running log. The 300A is the annual total. The 301 is the case file for a single incident. An inspector asks for the 2022 300 Log, you hand it over in a couple minutes. That's the standard.

For what belongs on a 301, the incident report article walks through the exact fields OSHA expects and what a workers' comp form has to contain to stand in for it.

Why do exposure and medical records require 30 years?

The 30-year rule for exposure and medical records comes from 29 CFR 1910.1020, OSHA's Access to Employee Exposure and Medical Records standard. ^[2] The reason is latency. Occupational diseases from chemical or physical exposure often take decades to surface. Mesothelioma from asbestos typically appears 20 to 50 years after first exposure. Toss the records early and a worker who gets sick at 60 has nothing to support a claim, and epidemiologists have nothing to study.

The standard is blunt. Medical records: duration of employment plus 30 years. Exposure records: 30 years. There's an exception for certain background data in exposure monitoring if you keep a summary instead, but the summary itself then carries the 30-year clock.

SDSs (Safety Data Sheets, formerly MSDSs) fall under this same standard for retention. Under 29 CFR 1910.1020(d)(1)(ii), an SDS for a substance employees were exposed to must be kept for the duration of employment plus 30 years. The alternative is keeping a record of the substance's identity plus where and when exposure happened, as long as the SDS stays obtainable somewhere. Most EHS managers just keep the SDS, because proving a substance's identity and exposure timing without it is harder than filing one document. ^[2]

An employee retires after 20 years. You cannot toss their records on the way out the door. You keep their exposure records another 30 years past that final day. Records from a 1995 hire who retired in 2015 have to survive until 2045.

Business closing? 29 CFR 1910.1020(h) requires the employer to notify affected employees at least three months before shutting down that records will be transferred or destroyed, and to offer to transfer the records to NIOSH (the National Institute for Occupational Safety and Health) or to the employees. Closing businesses miss this constantly, and it creates real liability.

What are the retention rules for training records?

Training records have no universal period. Each OSHA standard that requires training sets its own rule, and the gaps between them trip people up.

Bloodborne pathogens training records under 29 CFR 1910.1030(h)(2)(ii) run three years. ^[3] The record has to include the training dates, the content or a summary of it, the trainer's name and qualifications, and the names and job titles of everyone who attended. That's a lot, and it catches people off guard. A sign-in sheet alone fails if it never names the trainer's credentials.

HAZWOPER training (hazardous waste operations, 29 CFR 1910.120(e)(4)) runs three years after the employee leaves. Not three years from the training date. Three years from separation. Someone trained in 2019 who left in 2023? Keep that record until 2026. ^[5]

Forklift operator training certifications under 29 CFR 1910.178(l)(4) run three years, though the standard blurs the line between a hard document-retention rule and a recertification cycle. Either way, inspectors expect documentation of training and evaluation for every operator dated within the last three years.

Respiratory protection works differently. 29 CFR 1910.134 requires fit-test records kept until the next required fit test, and medical evaluations kept for the duration of employment. There's no explicit training-documentation retention period in 1910.134, but destroying training records while the employee is still on the respirator program would be a mistake.

OSHA training requirements shift by hazard and role. If you're building a documentation system, the safe move is one rule for everything: keep training records for the duration of employment plus three years, every standard. That's stricter than some standards demand. It also closes every gap, which is the point.

Some employers treat OSHA 30 completion cards as proof of general safety training. They aren't. An OSHA 30-hour card shows someone sat through a general industry or construction safety overview. It doesn't replace the standard-specific documentation required under rules like 1910.1030 or 1910.178. Keep both.

Do written safety programs need to be retained, and for how long?

Written programs are their own category. Standards that require a written program, like hazard communication under 29 CFR 1910.1200, lockout tagout under 29 CFR 1910.147, and respiratory protection under 29 CFR 1910.134, mostly don't set a fixed retention period for the program document. They require it to exist and be current. ^[6]

So the practical rule is this: keep the current version accessible, and hold onto prior versions long enough to show what your program said at any point in time. A worker gets hurt under a procedure your 2021 program described, and you've since rewritten it? You want the 2021 version in hand during the investigation or litigation. Many EHS managers keep prior program versions at least five years.

Lockout/tagout periodic inspection records are the exception here. 29 CFR 1910.147(c)(6)(ii) requires a certification of each periodic inspection that names the machine, the date, the employees involved, and the person who did the inspection. The standard doesn't say how long to keep them, but OSHA's enforcement read is that you need the most recent annual certification on hand. Three to five years of annual certifications is a reasonable practice.

The written hazard communication program itself, under 29 CFR 1910.1200(e)(4), must be available to employees, their designated representatives, and OSHA on request. Keeping it current means reviewing it whenever you bring in a new chemical or change a process. No archival period lives in the standard, but treating superseded versions as a five-year archive is smart.

What happens if you can't produce records during an OSHA inspection?

A compliance officer can request specific records under 29 CFR 1904.40, and you have to provide access to the 300 Log and related forms within four business hours. ^[4] For exposure and medical records, the access duty runs to employees and their representatives under 29 CFR 1910.1020(e).

Failing to produce required records is its own citation, separate from whatever brought the inspector in. OSHA can cite you under the recordkeeping standard even when the rest of the workplace is clean. As of 2024, other-than-serious recordkeeping citations run up to $16,550 per violation, and willful or repeat violations reach $165,514 per violation. ^[7] OSHA adjusts these for inflation every year.

The usual outcome isn't one giant penalty. It's a stack of individual citations, one per form or per missing year. Missing 300 Logs for three of the required five years can become three separate citations. The total climbs faster than most small business owners expect.

Inspectors also read missing records as a signal. A 300 Log showing zero recordable incidents across five years at a 50-person manufacturer reads as statistically implausible, and an experienced officer will dig harder. The Bureau of Labor Statistics 2023 Survey of Occupational Injuries and Illnesses put the private industry recordable rate at 2.4 cases per 100 full-time-equivalent workers. ^[8] A log that shows nothing for years is a red flag, not a gold star.

Who is exempt from OSHA's recordkeeping requirements?

Employers with 10 or fewer employees at all times during the previous calendar year are partially exempt from routinely keeping 300/300A/301 records under 29 CFR 1904.1. ^[4] They still have to report fatalities and certain severe injuries (hospitalizations, amputations, loss of an eye) to OSHA within the required timeframes. That duty never goes away.

Some low-hazard industries are also partially exempt regardless of size, under 29 CFR 1904.2. OSHA revised the exemption list in 2014 and publishes the current version by NAICS code. Retail, finance, insurance, real estate, and many service industries show up on it. In one of those industries with 10 or fewer employees? You're doubly exempt from routine 300/300A/301 recordkeeping. The severe-injury reporting rule still covers you.

Here's the part people miss: neither exemption touches exposure and medical records under 29 CFR 1910.1020. If your small business uses hazardous chemicals and workers get exposed, the 30-year clock runs no matter your size or industry code.

State Plan states can be stricter. Twenty-two states and territories run their own OSHA-approved plans, some with retention periods above federal minimums. ^[9] Operating in California, Washington, Michigan, or another State Plan state? Check with your state agency before assuming the federal numbers apply.

How do electronic recordkeeping and OSHA's electronic submission rules affect retention?

OSHA's electronic recordkeeping rule, finalized in 2023 under 29 CFR 1904, requires certain employers to submit 300A summary data electronically each year through OSHA's Injury Tracking Application (ITA). ^[10] Establishments with 100 or more employees in high-hazard industries also submit 300 Log and 301 data annually.

Electronic submission does not replace local retention. You still keep the originals or complete copies of every required form for the full retention period, paper or digital. The ITA submission is a reporting duty, not a storage plan. OSHA doesn't guarantee your ITA submissions stay accessible to you for five years, and they will never serve as your exposure record archive.

For electronic records generally, OSHA's position across multiple letters of interpretation is that they're fine as long as they can be produced in a readable format on request and are protected against alteration or loss. A spreadsheet anyone can edit doesn't clear that bar. A locked PDF, a database with an audit trail, or dedicated EHS software holds up better.

Backup matters more than people admit. If your only copy sits on a hard drive that dies, you have no defense at an inspection. Cloud storage with version history and access controls is the most practical setup for a small employer without a formal records system.

What records does OSHA require employers to post?

Posting is different from retention, but they overlap in one spot: the 300A Annual Summary. It has to be posted from February 1 through April 30 every year, signed by a company executive. ^[4] After April 30 it comes down and stays in the files for five years.

OSHA's "It's the Law" poster (OSHA 3165) has to be up wherever employees can see it. There's no retention period for the poster because it's supposed to stay posted at all times. Worth knowing: OSHA updated the poster in 2015, and older versions are non-compliant.

Citations and abatement notices must be posted at or near the affected work area for three working days or until the violation is corrected, whichever runs longer. ^[4] The citation itself becomes a record worth keeping, even though OSHA doesn't name a retention period. Keep it at least three years, because OSHA uses prior citations to classify repeat violations and the repeat window runs five years.

Inspection results, variance documents, and equivalency determinations are employer records with no set retention period in most cases. The conservative move: keep them indefinitely, or at minimum for the life of the condition they address.

What's the best system for managing OSHA records at a small business?

Most small businesses don't need EHS software to manage OSHA records. They need a clear folder structure, a retention schedule posted where people can see it, and one person who owns the process. That's the whole system.

Start simple. Make a physical or digital folder for each calendar year. Inside each one, keep that year's 300 Log, 300A, and 301s. Label the folder with its destruction date (year created plus five for injury records). Exposure and medical records get a separate set of folders that follow the employee, not the year, because they live 30 years past the employee's last day.

Building out a full written safety program and want a faster start? SafetyFolio's safety program generator produces a compliant written program in about 15 minutes, which gives you a base to hang the recordkeeping system on.

For training records, one spreadsheet per standard works fine as long as it captures the date, trainer, content summary, and attendees. Attach sign-in sheets as PDFs. The spreadsheet is the index. The sign-in sheets are the evidence.

Audit once a year, ideally in January while you finalize the prior year's 300A. Confirm every required record exists for every required year, that exposure records still tie to the right active and former employees, and that SDSs for any substance you used are still filed even after you stopped using it. That annual audit is the single highest-leverage move a small business can make against recordkeeping citations.

How does OSHA's 30-year rule apply when a business changes ownership or closes?

Business transfers create recordkeeping problems that buyers and sellers rarely think about until the deal closes. Under 29 CFR 1910.1020(h), an employer that ceases to do business must transfer medical and exposure records to any successor employer. ^[2] If there's no successor, the employer must notify NIOSH and affected employees at least three months before the records would otherwise be destroyed, and must offer to transfer them to NIOSH.

In an asset sale, the purchase agreement should spell out who takes custody of OSHA records and for how long. Buying a business? You want the prior owner's exposure and medical records in your hands. If those records vanish after the sale, the recordkeeping liability can follow the business rather than the seller, depending on how the deal is structured. Get legal advice for your state on this one.

For 300/300A/301 records, OSHA's position is that the successor takes over the duty to keep them for the rest of the five-year period. Prior owner had 300 Logs from 2021 and sold in 2024? The buyer keeps those 2021 records through 2026.

When a business closes outright with no successor, the 30-year exposure obligation doesn't just evaporate. The former owners or principals can retain responsibility. The practical and legal reality gets messy here, and OSHA's enforcement in these cases is thin. The notification duty to NIOSH and employees, though, is real and legally required.

Frequently asked questions

How long do I need to keep OSHA 300 logs?

Keep OSHA 300 Logs, 300A Summaries, and 301 Incident Reports for five years following the end of the calendar year they cover, per 29 CFR 1904.33. The clock starts January 1 of the year after the records were created, so a 2024 log stays through December 31, 2029. During that window you also have to update entries when new information changes a case's classification.

How long do safety data sheets need to be kept?

An SDS for a substance employees were exposed to must be kept for the duration of employment plus 30 years under 29 CFR 1910.1020(d)(1)(ii). The alternative is keeping a record of the substance's identity and when and where exposure happened, but keeping the SDS itself is easier to manage. Current SDSs for chemicals you actively use must always be accessible to employees under 29 CFR 1910.1200.

What is OSHA's retention period for medical records?

Employee medical records must be kept for the duration of employment plus 30 years under 29 CFR 1910.1020(d)(1)(i). This covers all medical records the employer maintains that relate to conditions of employment, including pre-employment physicals that were conducted and retained. If an employee retires after 25 years, you keep their medical records 30 more years past their last day.

Do small businesses with fewer than 10 employees have to keep OSHA records?

Employers with 10 or fewer employees at all times during the previous calendar year are partially exempt from keeping 300/300A/301 records under 29 CFR 1904.1. But every employer, regardless of size, must still report fatalities within eight hours and certain severe injuries within 24 hours. The exemption also doesn't touch exposure and medical records under 29 CFR 1910.1020, which apply no matter the size.

How long do training records need to be kept under OSHA?

It depends on the standard. Bloodborne pathogens training records run three years per 29 CFR 1910.1030(h)(2)(ii). HAZWOPER training records run three years after the employee leaves, per 29 CFR 1910.120(e)(4). Forklift operator certifications run three years per 29 CFR 1910.178(l)(4). When in doubt, keeping training records for the duration of employment plus three years covers most standards.

How long must respirator fit-test records be kept?

Under 29 CFR 1910.134(m)(2)(i), fit-test records must be kept until the next required fit test. Since most programs require annual fit testing, you effectively hold at least one year of fit-test records at all times. Medical evaluations for respirator use must be kept for the duration of employment. The standard sets no specific retention period for respirator training documentation, though keeping it for the duration of employment is prudent.

Can I keep OSHA records electronically?

Yes. OSHA accepts electronic records as long as they can be produced in a readable format on request and are protected against loss or unauthorized alteration. A plain editable spreadsheet doesn't meet that bar in practice. Cloud storage with access controls and version history, or dedicated EHS software, holds up better. Electronic submission through OSHA's Injury Tracking Application does not replace your local retention duty.

What happens to OSHA records when a business is sold?

Under 29 CFR 1910.1020(h), medical and exposure records must be transferred to any successor employer. For 300/300A/301 records, the successor takes over the retention duty for the rest of the five-year period. Purchase agreements should spell out which party takes custody of OSHA records. If no successor exists, the employer must notify NIOSH and affected employees at least three months before records would otherwise be destroyed.

How long do I need to keep lockout/tagout inspection certifications?

29 CFR 1910.147(c)(6)(ii) requires a written certification of each annual periodic inspection of energy control procedures. The standard sets no formal retention period, but OSHA's enforcement posture is that at minimum the most recent annual certification must be on hand. Keeping three to five years of annual certifications is a reasonable practice and protects you if an injury investigation reaches back more than one year.

Do State Plan states have different OSHA recordkeeping retention periods?

They can. The 22 states and territories with OSHA-approved State Plans must meet at least federal minimums but may set stricter requirements. California's Cal/OSHA, for example, has standards that in some cases exceed federal retention periods. If you operate in a State Plan state, check with your state occupational safety agency before assuming the federal CFR minimums apply to your situation.

What OSHA records do I need to post, and for how long?

The 300A Annual Summary must be posted from February 1 through April 30 each year in a visible location. OSHA citations must be posted at or near the affected work area for three working days or until corrected, whichever runs longer. The OSHA 'It's the Law' poster must stay up at all times. Posting a document is separate from retaining it; the 300A, for example, stays in your files for five years after it comes down.

How are OSHA recordkeeping violations penalized?

OSHA can cite recordkeeping failures independently of any underlying safety violation. As of 2024, other-than-serious violations carry penalties up to $16,550 per violation, and willful or repeat violations reach $165,514 per violation. OSHA adjusts these figures annually for inflation. Missing records across multiple years can generate multiple separate citations, so total exposure grows quickly even at a single inspection of a small business.

What information must be included in a bloodborne pathogens training record?

Under 29 CFR 1910.1030(h)(2)(ii), the record must include the training dates, a summary of the content or the curriculum, the trainer's name and qualifications, and the names and job titles of everyone who attended. A sign-in sheet alone isn't enough if it never captures trainer credentials and content. These records must be kept for three years from the date of training.

Sources

1. OSHA, 29 CFR 1904.33 - Retention and updating of old forms: Employers must save the 300 Log, 300A Summary, and 301 Incident Report for five years following the end of the calendar year they cover.
2. OSHA, 29 CFR 1910.1020 - Access to employee exposure and medical records: Employee medical records must be kept for the duration of employment plus 30 years; exposure records including SDSs must be kept 30 years; employers ceasing business must transfer records to a successor or notify NIOSH.
3. OSHA, 29 CFR 1910.1030 - Bloodborne pathogens: Bloodborne pathogens training records must be kept for three years from the date of training and must include dates, content summary, trainer qualifications, and employee names and job titles.
4. OSHA, Recordkeeping Rule Overview (29 CFR Part 1904): Employers with 10 or fewer employees are partially exempt from 300/300A/301 recordkeeping; the 300A must be posted February 1 through April 30; records must be provided to OSHA within four business hours on request.
5. OSHA, 29 CFR 1910.120 - Hazardous waste operations and emergency response (HAZWOPER): HAZWOPER training records must be kept for three years after the employee leaves employment.
6. OSHA, 29 CFR 1910.1200 - Hazard Communication Standard: The written hazard communication program must be made available to employees and OSHA on request; the standard does not specify a fixed retention period for the program itself.
7. OSHA, Penalties: As of 2024, other-than-serious violations carry penalties up to $16,550 per violation and willful or repeat violations up to $165,514 per violation, adjusted annually for inflation.
8. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses 2023: The private industry recordable injury and illness rate in 2023 was 2.4 per 100 full-time equivalent workers.
9. OSHA, State Plans: Twenty-two states and territories operate OSHA-approved State Plans that must meet at least federal minimums and may set stricter retention requirements.
10. OSHA, Injury Tracking Application (ITA) and Electronic Recordkeeping Rule: Establishments with 100 or more employees in high-hazard industries must submit 300 Log and 301 data electronically each year; electronic submission does not replace local record retention obligations.
11. OSHA, 29 CFR 1910.134 - Respiratory Protection: Respirator fit-test records must be kept until the next required fit test; medical evaluations must be kept for the duration of employment.
12. OSHA, 29 CFR 1910.147 - The control of hazardous energy (lockout/tagout): A certification of each periodic inspection of energy control procedures must be created, including the machine, date, employees involved, and inspector's name.
13. OSHA, 29 CFR 1910.178 - Powered industrial trucks: Forklift operator training certifications must identify the operator, date of training, and date of evaluation, and are maintained for three years.