OSHA's Electronic Injury Reporting Rule: Which Small Businesses Must Submit and How

Most small business owners know they are supposed to keep an OSHA 300 log. Far fewer realize that keeping the log is only part of the obligation. A federal rule — 29 CFR 1904.41 — requires many employers to submit their injury and illness summary data to OSHA electronically every year through an online portal called the Injury Tracking Application. Miss the deadline or skip the filing entirely, and you are exposed to citations under a separate recordkeeping violation, even if your 300 log is perfectly maintained.

The rule has been on the books since 2016 and was expanded significantly in 2023. Yet compliance among small businesses remains inconsistent, largely because the requirement generates no reminder from OSHA and the portal is easy to overlook until someone asks for proof of submission during an inspection.

Who Has to File

The 1904.41 rule creates tiered submission requirements based on employer size and industry.

The most relevant tier for small employers covers establishments with 20 to 249 employees in industries OSHA designates as high-hazard. OSHA publishes a list of covered NAICS codes that includes construction, manufacturing, warehousing and storage, transportation, agriculture, utilities, certain retail categories, waste management, and many repair and maintenance trades. If your establishment falls into a covered NAICS code and you have between 20 and 249 employees, you must submit your 300A summary data electronically by March 2 each year.

A second tier, added in 2023, requires establishments with 100 or more employees in certain higher-hazard industries to submit the full 300 log and 301 incident forms in addition to the 300A. This puts individual incident-level data directly in OSHA's hands. Small businesses under 100 employees are not subject to this tier.

If you are uncertain about your NAICS code, check your most recent state unemployment insurance filings — the code is typically listed there. OSHA also maintains a searchable list of covered codes on its website.

What the Submission Actually Involves

OSHA's Injury Tracking Application is a web-based system. To submit, you create an account through login.gov, which requires identity verification similar to setting up an IRS online account. First-time setup takes most users around fifteen minutes.

Once your establishment profile is created, the 300A submission itself takes about five minutes. You enter the summary figures from your paper form: totals for cases involving days away from work, restricted or transferred work, deaths, total days away, total restricted days, and the breakdown of injury types. You also enter peak employment and total hours worked. No attachments are required for the 300A-only tier.

Save a confirmation screenshot or PDF when you finish. OSHA generates a confirmation number, and that record is your only proof of filing if the question ever comes up during an inspection or audit.

Deadlines and Consequences

Submissions covering the prior calendar year are due by March 2. This is a hard compliance deadline, not a voluntary one. OSHA can cite employers under 1904.41 for failing to submit. Penalties for recordkeeping violations are generally classified as other-than-serious, with current amounts posted on OSHA's website and adjusted annually. More practically, a missing electronic submission is exactly the kind of thing a compliance officer checks during an inspection — an employer with an otherwise clean workplace can still leave an inspection with a citation if the ITA filing is absent.

If you missed a prior year, the portal does accept late submissions. Filing late does not guarantee you will avoid citation if an inspection surfaces the gap, but it is better than leaving the record empty.

Anti-Retaliation Provisions

The same 2016 rulemaking that created the electronic submission requirement established explicit anti-retaliation protections at 29 CFR 1904.35. These prohibit employers from discouraging workers from reporting injuries — including through post-incident drug testing policies applied as a matter of course, incentive programs that reward low injury counts, or other practices that function as deterrents to reporting. OSHA's position is that accurate ITA data depends on workers feeling free to report without consequence.

For small business owners, this is worth noting even if you have no formal incentive program. Informal pressure to avoid reporting, or blanket post-incident drug testing without reasonable cause, can create both a recordkeeping problem and a retaliation exposure.

Building the Habit

The most reliable approach is to treat March 2 as a fixed annual compliance date, the same way you track quarterly payroll deposits or insurance renewals. Post your 300A in the workplace from February 1 through April 30 as required, finalize the summary figures, and then submit through the ITA before the deadline. If you are new to the portal, create your login.gov account and establish your establishment profile in January — identity verification can take a few days if there are any issues, and doing it before February removes the deadline pressure entirely.

Electronic recordkeeping under 1904.41 is one of the smaller obligations in OSHA's Part 1904 framework, but it is also one of the most consistently missed by small businesses that maintain good paper records and assume that is enough. One account setup, one annual data entry session, and a saved confirmation number closes the gap entirely.