OSHA rule will help protect sensitive employee information


May 1, 2019

Just when you thought you were getting the hang of OSHA’s complicated injury and illness reporting rules, they’re changing again.

In an attempt to protect worker privacy, OSHA has issued a final rule that eliminates the requirement for establishments with 250 or more employees to electronically submit information from OSHA Form 300 (Log of Work-Related Injuries and Illnesses) and OSHA Form 301 (Injury and Illness Incident Report) to OSHA each year. However, these workplaces are still required to electronically submit information from OSHA Form 300A (Summary of Work-Related Injuries and Illnesses).

By preventing routine government collection of information that may be sensitive, including descriptions of workers’ injuries and the body parts affected, OSHA is trying to avoid the risk of such information being publicly disclosed under the Freedom of Information Act (FOIA). This rule is expected to better protect personally identifiable information or data that could be re-identified as belonging to a particular worker by removing the requirement for covered employers to submit their information from forms 300 and 301.

The final rule does not alter an employer’s duty to maintain OSHA forms 300 and 301 on-site, and OSHA says it will continue to obtain these forms as needed through inspections and enforcement actions. Collection of calendar year 2018 information from OSHA Form 300A began on January 2, 2019. The deadline for electronic submissions was March 2, 2019.

“OSHA has determined that this final rule will allow OSHA to improve enforcement targeting and compliance assistance, protect worker privacy and safety, and decrease burden on employers,” according to a written OSHA statement.

Healthcare workers continue to see some of the highest rates of injury and illness in any industry. There were approximately 2.8 million non-fatal workplace injuries and illnesses reported by private industry employers in 2017, which occurred at a rate of 2.8 cases per 100 full-time equivalent workers, the U.S. Bureau of Labor Statistics (BLS) said in an annual report released in December 2018. And in 2010, the healthcare and social assistance industry reported more injury and illness cases—about 653,900—than any other private industry sector.

Most of the cases stem from issues resulting from bloodborne pathogens and biological hazards, chemical and drug exposures, respiratory hazards, ergonomic hazards from lifting and repetitive tasks, workplace violence, lab hazards, and exposure to radioactive material and x-ray hazards. Injuries in healthcare have been decreasing, though—thanks to education, greater awareness, and new employer reporting standards.

Before this new final rule, the OSHA reporting requirements were last changed in January 2015, when Assistant Secretary of Labor David Michaels announced that employers with more than 250 workers (including hospitals) would be required to report all injuries that require inpatient hospitalizations within 24 hours. Any amputations or loss of an eye would also need to be reported, and any workplace fatalities would need to be reported within eight hours. Previously, only workplace fatalities and incidents that required hospitalizations of three or more workers at a time were considered reportable, but because of healthcare’s sobering injury statistics, OSHA had been under pressure to keep better records and make workplaces more accountable.

Also in 2015, OSHA released an update to its Guidelines for Preventing Workplace Violence for Health Care and Social Service Workers, known to many in the safety field as OSHA Rule 3148. First published in 1996, the new version of the document provided updated statistical information on workplace violence incidents and additional references for deeper reading in specific subject matter, such as the International Association for Healthcare Security and Safety’s Design Guidelines for Healthcare Facilities. Not surprisingly, the updated guidelines also included recommendations for developing an effective workplace violence prevention program, addressing topics such as the following:

  • Management commitment and employee participation
  • Work site analysis
  • Hazard prevention and control
  • Safety and health training
  • Recordkeeping and program evaluation

Employers have always been required to track injuries by filling out OSHA 300 forms and keeping them on file. The new rule change, however, represents a shift in the way OSHA keeps track of workplace injuries—notably, injuries that once were considered minor now need to be reported. In addition, employers now are required to use an online reporting form that allows employers to report injuries and fatalities over the internet—and it allows OSHA to track injuries in real time and make records of them publicly available.

Another OSHA final rule published May 11, 2016 required employers operating in dangerous industries, including nursing homes and other healthcare facilities, to electronically submit data on workplace injuries to the federal government, which could then release the information to the public.

At the time of that rule’s release, OSHA said that by making the injury data transparent, it hoped employers would put a greater focus on safety to protect their reputations. Michaels compared the decision to a public-health grade for a restaurant, saying it could nudge companies in the right direction.

Many employers already are required to collect and report information on injuries, but the data rarely sees the light of day under the current system. With the new rule, OSHA will be posting the information on its website, enabling workers, safety advocates, researchers, and others to assess the safety records of particular work sites. The new rule requires electronic submission of the OSHA Form 300A summary report, as well as the 300 log, 300A summary, and 301 incident report, by March 2 every year.

Of course, the downside of electronic online reporting is the possibility of protected private healthcare information falling into the wrong hands if it becomes compromised.

In addition, OSHA says the rule change will allow the agency to focus its resources on initiatives that its past experience has shown to be useful—such as continuing to utilize information from severe injury reports that helps target areas of concern, and seeking to fully utilize a large volume of data from Form 300A—rather than on collecting and processing information from Forms 300 and 301 with uncertain value for OSHA enforcement and compliance assistance.

The agency is also amending the recordkeeping regulation to require covered employers to electronically submit their Employer Identification Number (EIN) with their Form 300A information. The EIN will make the data more useful for OSHA and the BLS, and could reduce duplicative reporting burdens on employers in the future.

OSHA has tried different ways of addressing worker injuries in healthcare, and recent rules have been widely looked at as the closest the agency will come to passing a proposed Injury and Illness Prevention Program (I2P2). I2P2 has been in the planning stages since 2010 but is currently shelved. It would, among other things, require employers to develop and implement an injury and illness prevention program, including a systematic process to proactively and continuously address workplace safety and health hazards.

As for enforcement, there are presently no specific OSHA standards dealing with slips, trips, and falls and other common worker injuries, and citations for hazards often fall under OSHA’s general duty clause. Since its proposal, the I2P2 idea has faced strong opposition from some employers, afraid that it would just be another tacked-on citation. While some advocates say new regulations would help make healthcare safer, others argue that pressure on organizations to report more injuries to OSHA will cause facilities to try and cheat the system, especially if government entities like CMS tie Medicare funding to statistics such as injury incidence.

That, in turn, could dissuade employees with job security fears from reporting an on-the-job injury.

Copyright © 2020. Hospital Safety Center.