OSHA recognizes that there may be situations in which you do not want to put the employee’s name on the OSHA 300 Log for privacy reasons. If that is the case, you may enter the words “privacy case” in the space normally used for the employee’s name. You must keep a separate, confidential list of the case numbers and employee names in order to update the case and provide the information to the government if requested (29 C.F.R. § 1904.29(b)(6)). The following injuries or illnesses must be considered “privacy concern cases:”

• An injury or illness to an intimate body part or the reproductive system 29 C.F.R. § 1904.29(b)(7)(i).
• An injury or illness resulting from a sexual assault 29 C.F.R. § 1904.29(b)(7)(ii).
• Mental illness 29 C.F.R. § 1904.29(b)(7)(iii).
• HIV infection, hepatitis or tuberculosis 29 C.F.R. § 1904.29(b)(7)(iv)
• Needle stick injuries and cuts from sharp objects that are contaminated with another person’s blood or other potentially infectious material 29 C.F.R. § 1904.29(b)(7)(v).
• Other illnesses if the employee independently and voluntarily requests that his/her name not be entered on the Log 29 C.F.R. § 1904.29(b)(7)(vi).

The regulations (29 C.F.R. § 1904.29(b)(9)) also provide that if the employer has reason to believe that the employee may be identified from the information on the form, you may use discretion in describing the injury or illness on both the OSHA 300 and 301 forms, even if the employee’s name has been omitted. Enough information, however, must be included to identify the cause of the incident and the general severity of the injury or illness, but you need not include details of an intimate or private nature. (e.g., a sexual assault case could be described as an “injury from assault,” or an injury to a reproductive organ could be described as a “lower abdominal injury”).

If you disclose the OSHA forms to anyone other than government representatives, employees, former employees or authorized representatives (as required by §§ 1904.35 and 1904.4), you must remove or hide the employee’s name and other personally identifying information, except in the following cases:

• Disclosure to an auditor or consultant hired by you to evaluate the safety and health program 29 C.F.R. § 1904.29(b)(10)(i).
• Disclosure to the extent necessary for processing a claim of workers’ compensation or other insurance benefit 29 C.F.R. § 1904.29(b)(10)(ii).
• Disclosure to a public health authority or law enforcement agency for uses and disclosure for which consent, an authorization, or opportunity to agree or object is not required under the Department of Health and Human Services Standards for Privacy of Individually Identifiable Health Information 29 C.F.R. § 1904.29(b)(10)(iii).