OSHA's injury and illness recordkeeping requirements under 29 CFR 1904 are often treated by EHS managers as a back-office compliance function - an administrative burden that follows incidents rather than a compliance exposure in its own right. That framing underestimates the regulatory risk. Recordkeeping violations are among the most commonly cited requirements when OSHA conducts inspections triggered by fatalities or severe injury reports, and penalties for under-recording can exceed the penalties associated with the underlying hazard conditions that caused the injuries.
The recordkeeping standard is also one of the few areas where the compliance requirements interact directly with workers' compensation systems, insurance EMR calculations, and electronic reporting obligations in ways that create compounding consequences for facilities that get them wrong. This article covers the most common recordkeeping errors and their practical consequences, with specific reference to the 29 CFR 1904 requirements that generate citations most frequently.
The Work-Relatedness Analysis: Where Most Classification Errors Start
The threshold question for recordable incident classification is work-relatedness. Under 1904.5, an injury or illness is work-related if an event or exposure in the work environment caused or contributed to the condition or significantly aggravated a pre-existing condition. The definition includes a rebuttable presumption of work-relatedness for any injury or illness that occurs in the work environment, defined as any location where one or more employees are working or are present as a condition of their employment.
Work-relatedness analysis fails in two directions. Under-recording occurs when facilities apply the narrowest possible interpretation of work-relatedness, treating injuries with any pre-existing component or ambiguous causation as non-recordable. Over-recording occurs less commonly but generates its own problems: recordable classifications that inflate TRIR and DART rate figures used for EMR calculations and OSHA electronic reporting.
The most common under-recording errors involve musculoskeletal injuries with gradual onset, repetitive stress conditions, and aggravation of pre-existing conditions. A worker with a history of shoulder problems who reports increased pain after a shift involving overhead work presents a work-relatedness question that many facilities resolve by default as non-recordable. OSHA's guidance under 1904.5(b) specifically addresses this pattern: if workplace activity significantly aggravates a pre-existing condition, the resulting injury is work-related and potentially recordable.
Recordability Thresholds: Beyond First Aid
Once work-relatedness is established, the second classification question is whether the incident meets the recordability threshold. Under 1904.7, all work-related injuries and illnesses are recordable unless they resulted only in first-aid treatment as defined in 1904.7(a). The first-aid definition is specific and exhaustive: treatment not on the listed first-aid categories is, by implication, not first aid and triggers recordability.
The first-aid list at 1904.7(a) includes non-prescription medications at non-prescription strength, tetanus immunizations, cleaning and flushing of wounds, bandages and other wound coverings, use of non-rigid means of support, use of temporary immobilization during transport to a medical care provider, and several others. Notably absent from the first-aid list: prescription medication in any strength, physical therapy, sutures, and use of rigid splints or supports. A physician visit that results in a prescription for ibuprofen at prescription-strength dosing makes the incident recordable even if no other treatment is provided.
The prescription medication threshold generates a significant share of under-recording violations. Facilities that classify incidents as first-aid because "nothing was really done" without verifying whether prescription medication was provided are consistently finding recordable incidents classified as first-aid under OSHA scrutiny. The determination of recordability follows the treatment provided, not the severity of the injury as perceived by the facility.
Entry Timing Requirements and the Seven-Day Window
Under 1904.29(b)(3), employers must enter each recordable injury or illness on the OSHA 300 log within seven calendar days of receiving information that the injury or illness is recordable. This is a calendar-days requirement, not business days, and it runs from the date the employer receives information establishing recordability - not necessarily the date of the incident itself.
The seven-day window is frequently missed in cases where medical outcome determines recordability. If a worker is injured on a Monday, receives first-aid treatment, and is referred to a physician who prescribes physical therapy sessions starting the following week, the employer may not receive confirmation of the physical therapy prescription until after the initial incident report has been filed as first-aid. The seven-day window for log entry runs from the date the employer receives the physical therapy prescription information, not from the original incident date.
Facilities with inadequate medical management communication processes - where treating physicians or occupational health clinics do not promptly report prescribed treatment back to the EHS department - consistently generate late entry violations in this pattern. Establishing a formal communication protocol with treating providers, and documenting the date of receipt of medical outcome information, protects against late-entry citations even when recordable treatment is provided days or weeks after the incident.
The 300A Summary: Annual Posting Requirements and Executive Sign-Off
The OSHA 300A summary form must be posted from February 1 through April 30 each year in a conspicuous location at the establishment. It must be signed and certified by a company executive - specifically defined at 1904.32(b)(3) as the owner, officer of a corporation, the highest-ranking company official working at the establishment, or their supervisor.
The executive certification requirement generates citations in two common failure patterns. First, facilities that have a supervisor or EHS manager sign the 300A without meeting the "company executive" definition - even if that person has full operational responsibility for the facility. Second, facilities that post the 300A on the required dates but cannot demonstrate during an inspection that the form in their possession during the February through April posting period was actually posted.
Facilities subject to electronic reporting under 1904.41 - currently establishments with 20 or more employees in high-hazard industries and establishments with 250 or more employees in any industry - have additional compliance requirements around electronic data submission to OSHA's Injury Tracking Application (ITA). The ITA submission deadline is March 2 following the close of the calendar year for which data is being submitted. Late submissions and missing submissions from required establishments generate citations independently of any underlying recordkeeping accuracy issues.
Privacy Case Restrictions and Their Practical Implications
Under 1904.29(b)(6) through (b)(10), certain categories of injury and illness must be treated as "privacy cases" on the OSHA 300 log. Privacy cases include injuries or illnesses involving an intimate body part or reproductive system, injuries or illnesses resulting from sexual assault, mental illness, HIV infection, hepatitis, tuberculosis, and certain other conditions identified at 1904.29(b)(7). For privacy cases, the employer must not enter the injured or ill employee's name on the OSHA 300 log, instead using the designation "privacy case."
The privacy case requirement is straightforward in concept but creates practical complications for facilities that use templated log entry systems or software that auto-populates worker names from HR records. Checking privacy case status against the incident type before log entry is a required step that automated systems do not always enforce. The consequences of failing to apply privacy case treatment include potential HIPAA implications beyond the OSHA citation, depending on how the log is disclosed.
How SafeSiteX Supports 1904 Compliance
SafeSiteX automates OSHA 300 and 301 form completion from incident reports entered in the platform, with a recordability classification workflow that guides EHS managers through the work-relatedness and first-aid threshold analysis required before log entry. The system tracks treatment received from connected occupational health providers and flags incidents for recordability review when treatment transitions from first-aid to recordable categories.
The seven-day entry timer starts automatically from the date treatment information is received, with escalating alerts to ensure log entries are made within the regulatory window. The 300A annual summary generation and executive certification workflow is automated with a scheduling reminder system that ensures February 1 posting requirements are met and that the certifying official meets the 1904.32 executive definition before the document is finalized. As described in our article on OSHA general industry citations, accurate recordkeeping is foundational to managing the regulatory relationships that determine inspection frequency and scrutiny level.
For questions about OSHA 300 recordkeeping compliance or SafeSiteX's records management module, contact our team at contact@safesitex.com.