Part 210 min

2.3 Privacy concern cases and who may see the records

The 300 Log carries names, and it is not a private document. Employees, former employees, their personal representatives and their union can ask to see it, and the deadlines are short. Against that, six categories of case have their names removed entirely. Getting both halves right is what keeps the log usable and the people on it protected.

1 Six privacy concern cases, and the list is closed

1904.29(b)(7) tells you which cases you must treat as privacy concern cases, and (b)(8) answers the obvious follow-up: “No, this is a complete list of all injuries and illnesses considered privacy concern cases for part 1904 purposes.” You cannot add to it, and you cannot decline to apply it.

Privacy concern cases — 1904.29(b)(7)
#	Case
i	An injury or illness to an intimate body part or the reproductive system
ii	An injury or illness resulting from a sexual assault
iii	Mental illnesses
iv	HIV infection, hepatitis or tuberculosis
v	Needlestick injuries and cuts from sharp objects contaminated with another person's blood or other potentially infectious material
vi	Other illnesses, where the employee voluntarily requests that their name not be entered

Note the shape of the sixth. It applies to illnesses, not injuries, and the request must come from the employee — you do not offer anonymity as a favor, and you do not withhold it when it is asked for.

2 What you write instead, and what you keep separately

1904.29(b)(6) sets the mechanics: do not enter the employee's name on the 300 Log; enter “privacy case” in the space normally used for the name; and keep a separate, confidential list of the case numbers and the employee names, so that you can update the cases and provide the information to the government if asked.

And there is a second layer for the cases where removing the name is not enough. 1904.29(b)(9) lets you use discretion in describing the injury or illness on both the 300 and the 301 where you have a reasonable basis to believe the description could still identify the person. You must still enter enough to identify the cause and the general severity — the rule's own examples are describing a sexual assault case as “injury from assault”, or an injury to a reproductive organ as “lower abdominal injury”.

Common mistake: keeping the confidential list in the same binder as the log, or in the same spreadsheet on a second tab. The whole point is that one document circulates and the other does not.

3 Who may see the records, and how fast

1904.35(b)(2) gives access rights to four categories of people: employees, former employees, their personal representatives — anyone the employee designates in writing, or the legal representative of a deceased or incapacitated employee — and their authorized employee representatives, which the rule defines narrowly as an authorized collective bargaining agent.

Access deadlines under 1904.35(b)(2)
Who asks	What for	By when
Employee, former employee, personal representative or authorized employee representative	The current or stored 300 Log for an establishment the employee has worked in	End of the next business day
Employee, former employee or personal representative	The 301 Incident Report describing that person's own case	End of the next business day
Authorized employee representative (collective bargaining agent)	301 Incident Reports for an establishment where it represents employees — limited to the “Tell us about the case” section, everything else removed	7 calendar days

Two rules sit under that table. You may not remove the names from the 300 Log before handing it over — 1904.35(b)(2)(iv) says so directly, and points to the privacy case mechanism as the protection instead. And the first copy is free under (b)(2)(vi); only additional copies may carry a reasonable charge for retrieval and copying.

4 Disclosing the forms to anyone else

1904.29(b)(10) governs voluntary disclosure to people who are not government representatives, employees, former employees or their representatives. The default is that you must remove or hide the names and other personally identifying information. Three exceptions let you disclose with the identifiers intact:

To an auditor or consultant you have hired to evaluate the safety and health program.
To the extent necessary to process a workers' compensation or other insurance claim.
To a public health authority or law enforcement agency, for uses and disclosures that do not require consent under the HHS privacy standards at 45 CFR 164.512.

This is the paragraph that answers the question every general contractor's prequalification packet raises: they are entitled to ask for your rates, and they are not on the list of people entitled to your employees' names.

5 Handling a request without drama

1
Confirm who is asking and in which category they fall. A personal representative needs a written designation; a union is an authorized employee representative by right.
2
Confirm which establishment and which years. Access covers establishments the employee has worked in.
3
For a 300 Log: copy it as it stands, names included, by the end of the next business day. No charge.
4
For 301s to a union: give only the "Tell us about the case" section, with everything else removed, within 7 calendar days.
5
Log the request and what you provided. It takes one line and it is the evidence that you met the deadline.

6 Why the access rules exist

1904.35 is headed Employee involvement, and the access rights sit in the same section as the duty to establish a reasonable reporting procedure and the prohibition on retaliation. That is not an accident of drafting. The rule treats the records as something workers are entitled to see precisely because they are the people the records are about.

On the job: a crew that can read its own log is a crew that can tell you the log is wrong. Three “struck by falling object” lines in one bay will get a comment from the people who work in that bay long before it gets one from a manager reading a summary.

Key takeaways

Six privacy concern cases, and 1904.29(b)(8) says the list is complete
Enter "privacy case" instead of the name, and keep a separate confidential list of numbers and names
Where the description could still identify the person, you may blur it — but keep cause and general severity
The 300 Log goes to an employee or their representative by the end of the next business day, names left on, free
A union gets 301s within 7 calendar days, limited to the "Tell us about the case" section
Disclosure to anyone else means removing identifiers, with three narrow exceptions in 1904.29(b)(10)

Free educational content — not OSHA-authorized training, no certificate or card issued. Follow your employer's program and the standards cited.