The Occupational Safety and Health Administration (“OSHA”) recently released its final rule revising the Recording and Reporting Occupational Injuries and Illnesses regulations.  Employers should not be taken in by the benign titled, “Improve Tracking of Workplace Injuries and Illnesses.”  The new rule greatly expands the dissemination of information regarding workplace incidents by requiring companies to send their data on illness and injury incidents to OSHA electronically for inclusion in a public database.  The database will be available to anyone via the internet.  In light of this new rule, effected employers should review their internal reporting protocols and procedures.  Employers should carefully consider protecting trade secrets, managing labor relations, and anticipating litigation implications of any incident report made pursuant to OSHA’s new rule.

A. An Overview of The Existing Regulations

OSHA has required certain employers to record and report occupational injuries and illnesses in some format since 1971.[1]  OSHA regulations at 29 CFR part 1904 currently require employers with more than 10 employees in most industries to keep records of work-related injuries and illnesses at their establishments.  Covered employers must prepare an injury and illness report for each incident (Form 301), compile a log of its incidents (Form 300), and complete and post in the workplace an annual summary of work-related injuries and illness (Form 300A).   OSHA regulations require employers to record new cases of work-related fatalities, injuries, and illnesses within seven (7) calendar days after notification of an injury or illness that involves:

• death;
• days away from work;
• restricted work or transfer to another job;
• medical treatment beyond first aid;
• loss of consciousness; or
• significant injury or illness diagnosed by a licensed health care professional[2]

The regulations require employers to save the forms for five (5) years.[3]  Employers are also required to update Form 300 logs if the employer learns of any new cases within the five-year record retention window that were not previously recorded.[4]

Currently, OSHA primarily obtains the injury and illness data through onsite inspections or compliance audits of employers and that data is not generally made available to the public.  OSHA and the Bureau of Labor Statistics can collect aggregated data derived from the same forms but those aggregated surveys do not identify the individual responding businesses.

B. New Rule Promotes Public Shaming and Data Mining

The principal component of the new rule requires electronic submission of employer occupational injury and illness data to OSHA.  Additionally, the new rule extends whistleblower protections that encourage an active employee reporting regime and prohibit employers from creating policies that OSHA determines inhibit or punish employee reporting.

The new requirements take effect August 10, 2016, with phased in data submissions beginning in 2017.  Under the new rule, all businesses with 250 or more employees in industries covered by the recordkeeping regulation will eventually electronically submit injury and illness information from Forms 300, 300A, and 301.  Businesses with 20-249 employees in certain industries[5] will electronically submit information from OSHA Form 300A only.  The reporting obligations will be phased in as summarized in the following chart:

Using data collected under the new rule, OSHA will create, what it claims will be, the largest publicly available data set on work injuries and illnesses.  OSHA claims it will remove all personally identifiable information describing the individual injured or ill employees before the data is publicly accessible.  Unlike industry surveys conducted pursuant to the current rule, OSHA will identify the employers in its database.

The policy goals of the new rule are articulated in the 273 page notice of final rule.[6]  Dr. David Michaels, the Assistant Secretary of Labor for OSHA, more candidly summarized OSHA’s policy:

Our new rule will ‘nudge’ employers to prevent work injuries to show investors, job seekers, customers and the public they operate safe and well-managed facilities.  Access to injury data will also help OSHA better target compliance assistance and enforcement resources, and enable ‘big data’ researchers to apply their skills to making workplaces safer.[7]

C. Employers Must Consider The Risks Posed by The New Rule in Reviewing Their Reporting Procedures.

Supporters of the new rule argue that the additional electronic reporting requirements do not materially change an employer's obligation to complete and retain injury and illness records.  However, reports generated pursuant to the existing regulations are not widely published on the internet for any curious onlooker, competitor, or personal injury lawyer.  The widespread publication of employer’s injury and illness data creates risks that the information will be misused our misunderstood without proper context.

As employers evaluate their protocol for complying with both the existing OSHA reporting requirements and the new rule, they should be mindful of the potential for wide distribution of their reports.  In particular, employers should consider the issues outlined below.

1. Consult Legal Counsel

Many businesses assign responsibility for maintaining their occupational injury and illness forms to human resources, environmental safety and health, or other functions outside the law department.  This allocation of responsibility is sensible for many businesses and for most workplace incidents.  Companies may want to reconsider at what stage--and to what degree--to involve legal counsel in the process.  At the very least, employers will want to train their personnel on the implications of OSHA’s new reporting regime.  Opposing counsel often request a company’s incident reports as part of the discovery process after a case is filed.  With this new rule, companies should now assume that opposing counsel will have read the incident reports before filing a lawsuit. 

2. Channel Joe Friday — Just the Facts

If workplace incidents lead to litigation, many courts will admit, as evidence, the statements made by a company in their OSHA forms.  Statements made in the report may be deemed to be company admissions even if those statements are later shown to be mistaken.  Reports should include “just the facts” and avoid speculation, assumption, and supposition.  OSHA embraces a “no fault” record keeping system, which means that the reports do not have to make determinations of fault or cause.

When completing the OSHA Forms, especially an injury report for each incident (Form 301), it is okay to simply state the facts of the incident and defer to experts to determine the underlying causes of the incident.  Careless speculation in the initial report can create unnecessary problems in defending a claim or cause misleading reputational damage. 

3. Know You Are Creating Permanent Records

Under the existing OSHA reporting regime, an OSHA inspector may have reviewed a company’s reports as part of a routine compliance audit.  Under the new rule, the reports will receive a broader audience.  Likewise, the existing regulations require employers to maintain the workplace injury and illness files for only five (5) years.  Under the new rule, businesses should assume their reports will last in perpetuity in a publically searchable database. 

The full impact of large scale disclosure remains to be seen.  In the current cyber-environment, companies must be on constant guard for the misuse of information about themselves.  Companies must consider how to prepare compliant reports without overly disclosing sensitive business information.  What may seem like an innocuous report viewed in isolation may later be used to derive trade secrets, or to show “early knowledge” of a later discovered issue in work environment.

4. Review Form 300A for 2016

On July 1, 2017, covered employers will provide OSHA their annual summary of work-related injuries and illness (Form 300A) for 2016.  To state the obvious, the foundation for five (5) months of information for a 2016 summary has already been written.  In this first year, larger covered employers with 250+ employers do not have to provide their Forms 300 or 301.  Nevertheless, companies may want to evaluate whether the incident reports collected during the first five (5) months of the year are consistent with the protocols those companies implement going forward.  There may be opportunities to supplement or amend reports as appropriate.

5. Worry About HIPPA and Other Personal Information

OSHA claims they will remove any personally identifiable information from the reports prior to publication.  Ideally, compliance with OSHA regulations and a failure on OSHA’s part would shield a company from any claims arising from inadvertent disclosure of personal information by OSHA.  Why rely on the ideal prevailing?  A company should consider implementing reporting protocols that minimize the risk of any inadvertent disclosure of employee’s personal information while at the same time complying with the new regulations.

D. Conclusion

Employers should conduct a critical self-assessment of their current reporting protocols in evaluating their compliance with the new rule.  A preventative check-up may be just what the doctor, or in this case, the company lawyer ordered.  Under the new OSHA reporting regime, a significant amount of company information will, for the first time, be published on the internet for the world to read.  Under the old rule, it may have made sense for many companies to delegate the OSHA workplace injury and reporting responsibilities outside of the law department.  Under the new rule, many in-house lawyers may want to reevaluate their role given that the ripple effects of board publication could touch on many facets of a company’s interests. 

Notes: