OSHA Proposes New Privacy Protection Rule

The Occupational Safety and Health Administration (OSHA) has proposed a new rule to protect the personal information of workers in its injury and illness reporting database. As most employers already know, OSHA requires all work-related injuries and illnesses that prompt professional medical treatment to be reported. Previously, however, there's been concern regarding the security of this information. If a worker's name, address and other personal information is listed in this database, conventional wisdom may lead you to believe that other individuals can access it, some of whom may do so with nefarious intent.

But OSHA is not taking steps to protect workers' personal information from prying eyes. Earlier this month, the organization proposed a new rule that would protect personally identifiable information. Technically, this isn't a new rule. Rather, the proposal would amend the existing injury and illness reporting rule to protect workers' personal information from disclosure by the Freedom of Information Act. 

Technical jargon aside, OSHA's proposed rule would eliminate the existing requirement for employers to submit injury and illness reporting information using the Log of Work-Related Injuries and Illnesses (Form 300) as well as the Injury and Illness Incident Report (Form 301) for businesses with at least 250 employees. For businesses with fewer 250 employees, they'll only need to submit the Summary of Work-Related Injuries and Illnesses (Form 300A).

OSHA says that its proposed rule would enhance privacy protection for workers “by rescinding the requirement for establishments with 250 or more employees to electronically submit information from OSHA Forms 300 and 301. These establishments will continue to be required to submit information from their Form 300A summaries.”

There's been a growing concern regarding the security of workers' personal information in injury and illness reporting forms. As cyber threats like hacking continue to increase, the risk of unauthorized access rises in its wake. The purpose of OSHA's proposed rule is to protect workers' personal information from such access. Employers will still be required to report injuries and illnesses that prompt professional medical treatment. However, the requirements are lightened to reduce the risk of unauthorized access and disclosure, thereby protecting workers' personal information.

It's unknown whether or not this proposed rule will take effect. Or if does take effect, when this will happen. Under OSHA's current rule, employers must report injuries and illnesses that occurred in 2017 via electronic submission by July 1, 2018.