Consequently, in this rulemaking, OSHA finds that the data that will be
collected in compliance with this final rule will be protected from
cyber attack in accordance with the appropriate government standards.
10. The Health Information Portability and Accountability Act (HIPAA)
    OSHA also received comments from some interested parties expressing
concern about how the proposed rule would relate to the Health
Insurance Portability and Accountability Act of 1996 (HIPAA), Public
Law 101-191 (e.g., Docket IDs 0007, 0013, 0059, 0082). For example, two
interested parties commented that the OSHA Forms 300 and 301 include
personal and private information about an employee's health and
wellness, and that requiring the submission of such information to OSHA
will place employers in legal liability due to HIPAA restrictions
(Docket IDs 0007, 0013). But as explained below, HIPAA's implementing
regulations specifically allow employers to release workplace injury
and illness data to OSHA.
    The U.S. Department of Health and Human Services (HHS) implements
HIPAA through regulations at 45 CFR parts 160 and 164, known as the
HIPAA ``Privacy Rule.'' The Privacy Rule protects the privacy of
individually identifiable health information (referred to as
``protected health information'' or ``PHI'') maintained or transmitted
by HIPAA-covered entities and their business associates. The term
``covered entity'' includes health plans, health care clearing houses,
and health care providers who transmit health information in electronic
form (see 45 CFR 160.104). OSHA is not a covered entity for purposes of
the Privacy Rule, so the use and disclosure requirements of the Privacy
Rule do not apply to OSHA.
    The HIPAA Privacy Rule also excludes certain individually
identifiable health information from the definition of PHI. For
example, employment records held by a covered entity in its role as an
employer are not PHI and the HIPAA Privacy Rule does not prohibit the
disclosure of health information contained in employment records to
OSHA (see 45 CFR part 160.103). Even for information that qualifies as
PHI, the Privacy Rule specifically permits disclosures of PHI without
an individual's authorization for certain purposes, including when they
are required to do so by another law (see 45 CFR 164.512(a)). HHS has
made clear that this provision encompasses an array of binding legal
authorities, including statutes, agency orders, regulations, or other
Federal, State, or local governmental actions having the effect of law
(see 65 FR 82668). Similarly, a covered entity may also disclose PHI
without an individual's authorization to ``public health authorities''
and to ``health oversight agencies'' (see 45 CFR parts 164.512(b) and
(d)). The preamble to the Privacy Rule issued in 2000 specifically
mentions OSHA as an example of both (see 65 FR 82492, 82526). Finally,
the Privacy Rule also permits a covered entity who is a member of the
employer's workforce and provides healthcare at the request of an
employer, to disclose to employers protected health information
concerning work-related injuries or illnesses, or work-related medical
surveillance in situations where the employer has a duty under the OSH
Act, the Federal Mine Safety and Health Act, or under similar State law
to keep records on or act on such information. Accordingly, covered
entities generally may not restrict or refuse to disclose PII required
by an OSHA standard or regulation based on the provisions of the
Privacy Rule.
    OSHA also received comments from interested parties that, while
recognizing that HIPAA does not apply to the information disclosures at
issue here, argued that OSHA ``should examine the principles of HIPPA
in determining how to proceed--or not proceed--with this rule'' (Docket
ID 0059; see also Docket ID 0082). For example, NAHB asserted ``HIP[A]A
recognizes the legitimate privacy interests that individuals have with
respect to their own health information.

HIP[A]A also recognizes that aspects of a person's health record can
serve as an identifier of a person under certain circumstances. And
HIP[A]A recognizes that this is not acceptable'' (Docket ID 0059). NAHB
further argued that ``[t]he procedure for OSHA reviewing this should
have been thoroughly considered and addressed in the proposed
regulation; it was not'' (Docket ID 0059).
    OSHA agrees with commenters who suggested that the agency consider
applying the principles set forth in the Privacy Rule for the de-
identification of health information. Health information is
individually identifiable if it does, or potentially could, identify
the individual. As explained by commenters, once protected health
information is de-identified, there are no longer privacy concerns
under HIPAA. Again, it is OSHA's policy under the final rule not to
release any individually identifiable information. As discussed
elsewhere in this document, procedures are in place to ensure that
individually identifiable information, including health information,
will not be publicly posted on OSHA's website.
    However, OSHA disagrees with NAHB's claim that ``OSHA has provided
no thought regarding what types of information it will or should redact
to protect employees, except to mention that it may redact names and
other information that it would otherwise need to redact under the
Freedom of Information Act'' or that the agency's procedure was not
``thoroughly considered and addressed'' in the proposal (Docket ID
0059). As reiterated above, the proposal specified which fields the
agency proposed to collect and what subset of that collected
information it planned to release. It also detailed its plans to ensure
that it did not collect certain data (e.g., by not requiring the
submission of certain data fields and designing the system to remind
establishments not to submit certain data) and ways to protect the data
it does receive (e.g., carefully choosing which fields would be
publicly released and using scrubbing technology to ensure that data
contained in the fields to be released did not unintentionally include
information which could reasonably be expected to identify individuals
directly). In sum, contrary to NAHB's assertion, the agency has
carefully considered how to protect information that could reasonably
be expected to identify individuals directly and explained its plans
and thinking in the proposal.
11. The Americans With Disabilities Act (ADA)
    OSHA also received comments related to the Americans with
Disabilities Act (ADA). Specifically, in their comment, the Seventeen
AGs noted that ``if a certain type of occupational injury regularly
leads to ongoing disability in a particular industry or place of
work,'' the case-specific data that would be collected and published
under the proposed rule would allow States to ``explore what
accommodations those employers provide, for example, whether affected
workers have been placed in appropriate positions with reasonable
accommodations as required under the [(ADA)] and similar State laws''
(Docket ID 0045). OSHA agrees with this commenter that this kind of
inquiry is one of the many benefits that will stem from this final
rule.
    The Seventeen AGs' mention of the ADA raises the question of its
applicability to this final rule, a question that has been raised in
the rulemakings culminating in the 2016 and 2019 final rules (see 81 FR
29665-66; 84 FR 387). At various times as OSHA has considered whether
to collect and publish information from establishments' Forms 300 and
301 (and 300A, as well), commenters have raised concerns about whether
the ADA would prohibit establishments from releasing health and
disability-related information to OSHA. It would not. The ADA would
permit the collection by employers of such information.
    By its terms, the ADA limits disability-related inquiries and
medical examinations of job applicants or employees and requires
confidentiality for medical information obtained from any such
inquiries or medical examinations. However, the ADA also states that
``nothing in this Act shall be construed to invalidate or limit the
remedies, rights, and procedures of any federal law'' (see 29 U.S.C.
12201(b)). In enacting the ADA, Congress was aware that other Federal
standards imposed requirements for testing an employee's health, and
for disseminating information about an employee's medical condition or
history, determined to be necessary to preserve the health and safety
of employees and the public (see H.R. Rep. No. 101-485 pt. 2, 101st
Cong., 2d Sess. 74-75 (1990), reprinted in 1990 U.S.C.C.A.N. 356, 357
(noting, e.g., medical surveillance requirements of standards
promulgated under the OSH Act and the Federal Mine Safety and Health
Act, and stating ``[t]he Committee does not intend for [the ADA] to
override any medical standard or requirement established by federal . .
. law . . . that is job-related and consistent with business
necessity''); see also 29 CFR part 1630 App.). The ADA yields to the
requirements of other Federal safety and health standards and
regulations. The implementing regulation, codified at 29 CFR
1630.15(e), explicitly states that an employer's compliance with
another Federal law or regulation may be a defense to a charge of
violating the ADA (see Enforcement Guidance on Disability-Related
Inquiries and Medical Examinations of Employees under the ADA [verbar]
U.S. Equal Employment Opportunity Commission (eeoc.gov) Enforcement
Guidance on Disability-Related Inquiries and Medical Examinations of
Employees under the ADA [verbar] U.S. Equal Employment Opportunity
Commission (eeoc.gov) (available at: https://www.eeoc.gov/laws/guidance/enforcement-guidance-disability-related-inquiries-and-medical-examinations-employees), at Question 21). The ADA recognizes the
primacy of other Federal laws including Federal safety and health
regulations; therefore, such regulations, including mandatory OSHA
recordkeeping requirements and disclosure requirements, pose no
conflict with the ADA (cf. Albertsons, Inc. v. Kirkingburg, 527 U.S.
555, (1999) (``When Congress enacted the ADA, it recognized that
federal safety and health rules would limit application of the ADA as a
matter of law.'')).
    It also is worth noting that the information in the OSHA injury and
illness records is similar to that found in workers' compensation forms
and may be obtained by employers by the same process used to record
needed information for workers' compensation and insurance purposes.
The Equal Employment Opportunity Commission (EEOC), the agency
responsible for administering Title I of the ADA, which addresses
employment, recognizes a partial exception to the ADA's strict
confidentiality requirements for medical information regarding an
employee's occupational injury or workers' compensation claim (see
generally 29 CFR 1630.15(e) and EEOC Enforcement Guidance: Workers'
Compensation and the ADA (available at https://www.eeoc.gov/laws/guidance/enforcement-guidance-workers-compensation-and-ada), (September
3, 1996)). For these reasons, OSHA does not believe that the mandatory
submission and publication requirements in Sec.  1904.41 of this final
rule conflict with the confidentiality provisions of the ADA.

12. The Privacy Act
    The Plastics Industry Association commented that a failure by OSHA
to exclude or reliably redact all personal identifiers and personally
identifiable medical information would violate the Privacy Act of 1974,
5 U.S.C. 552a, as well as other privacy laws (Docket ID 0086).
    In response, OSHA notes that the Privacy Act is a Federal statute
that establishes a code of fair information practices that governs the
collection, maintenance, use, and dissemination of personal
identifiable information by Federal agencies. The Privacy Act only
applies to records that are located in a ``system of records.'' As
defined in the Privacy Act, a system of records is ``a group of any
records under the control of any agency from which information is
retrieved by the name of the individual or by some identifying number,
symbol, or other identifying particular assigned to the individual''
(see 5 U.S.C. 552a(a)(5)). Because OSHA injury and illness records are
retrieved neither by the name of an individual, nor by some other
personal identifier, the Privacy Act does not apply to OSHA injury and
illness recordkeeping records. As a result, the Privacy Act does not
prevent OSHA from posting recordkeeping data on a publicly accessible
website. However, OSHA again wishes to emphasize that, consistent with
the applicable exemptions under FOIA, the agency does not intend to
post personally identifiable information on the website.
13. Privacy Impact Assessment
    Section 208 of the E-Government Act requires Federal agencies to
conduct a Privacy Impact Assessment when developing or procuring new
information technology involving the collection, maintenance, or
dissemination of information in identifiable form or when making
substantial changes to existing information technology that manages
information in identifiable form. In the preamble to the proposed rule,
OSHA stated that it expected to complete a Privacy Impact Assessment
before issuing the final rule (87 FR 18540). Several commenters
supported this step (Docket IDs 0058, 0068, 0072, 0077, 0094).
    OSHA now has completed a Privacy Impact Assessment for this final
rule which is available at https://www.dol.gov/agencies/oasam/centers-offices/ocio/privacy (Docket ID 0107). In the Privacy Impact
Assessment, OSHA determined that the safeguards and controls described
in this preamble will adequately protect the collected and published
data addressed in the final rule.
14. Other Issues Related to OSHA's Proposal To Require the Submission
of and Then Publish Certain Data From Establishments' Forms 300 and 301
a. Miscellaneous Comments
    OSHA received a variety of other comments related to its proposal
to require certain establishments to submit certain data from their
Forms 300 and 301 and its plan to then publish a subset of that data.
For example, some interested parties expressed concern over repeated
rulemakings addressing the electronic submission of injury and illness
data to OSHA (e.g., Docket IDs 0058, 0060, 0071, 0072, 0077). The
Associated Builders and Contractors (ABC) commented, ``we hope that
OSHA recognizes that the frequent revisions it has made related to the
requirements surrounding electronic reporting of injury and illness
data has caused confusion and uncertainty among construction contractor
employers in respect to what requirements apply to their businesses,
especially for small businesses'' (Docket ID 0071). Similarly, the
Window and Door Manufacturers Association commented, ``OSHA must also
consider the impact that the agency's repeated changes and reversals to
its recordkeeping policies has had on employers, especially smaller
entities. This year's proposed rule is now the third such rulemaking by
OSHA on injury and illness recordkeeping since 2014.'' This commenter
added that the frequent changes to recordkeeping regulations have
resulted in confusion among employers regarding what requirements apply
to their business (Docket ID 0072). The Coalition for Workplace Safety,
the National Demolition Association, and the National Lumber and
Building Materials Association submitted similar comments (Docket IDs
0058, 0060, 0077).
    OSHA acknowledges that some employers may be confused by the
multiple rulemakings amending the part 1904 requirements for certain
employers to electronically submit injury and illness data from their
Forms 300 and 301. However, OSHA believes this rulemaking provided
potentially affected employers with clear notice of the possibility
that their obligations might change. And OSHA plans to implement a
robust roll-out plan to alert employers of the final rule's
requirements. Moreover, even if some confusion remains, OSHA must place
primary importance on whether new occupational safety and health
requirements will help ``assure so far as possible . . . safe and
healthful working conditions . . . by providing for appropriate
reporting procedures . . . which will help achieve the objective of
th[e] Act and accurately describe the nature of the occupational safety
and health problem'' (see 29 U.S.C. 651(b)(12)). As discussed above in
Section II, Legal Authority, Section 8 of the OSH Act provides OSHA
with broad authority to prescribe regulations as necessary or
appropriate for the enforcement of the OSH Act and for developing
information about the causes and prevention of occupational injuries
and illnesses. Federal agencies, furthermore, are permitted to change
or reverse prior policies, provided that they provide a reasoned
explanation for the change. In this rulemaking, OSHA has made every
effort to balance the benefits of this rule to occupational safety and
health against any potential burden created for the regulated
community, and has explained the reasons supporting any changes in
OSHA's prior policies throughout this preamble.
    As explained in more detail below, based on its experience with the
collection of injury and illness data through the ITA, and with the
advancements in technology to protect individual privacy, OSHA has
determined that it is necessary and appropriate at this time to require
certain larger establishments in higher hazard industries to
electronically submit data from their Forms 300 and 301 to OSHA once a
year. OSHA believes that this requirement to submit case-specific data
will have significant benefits for occupational safety and health,
especially since the requirement applies to certain establishments in
higher hazard industries where such reporting will have the greatest
impact on reducing injury and illness rates.
b. The Effect of the Rule on the Accuracy of Injury and Illness Records
    OSHA received comments expressing concern that OSHA collection and
publication of data from Forms 300 and 301 would lead to less accurate
data, because employers may respond by recording fewer injuries and
illnesses (i.e., under-recording) (e.g., Docket IDs 0052, 0053, 0088,
0090). One commenter, Angela Rodriguez, stated that some employers may
be tempted to avoid logging recordable cases (Docket ID 0052). The U.
S. Poultry & Egg Association commented that employers might record less
information because of fears that recording more cases could

harm recruitment and retention of employees (Docket ID 0053), while the
National Retail Federation stated that ``fear of developing a negative
image in their communities, may cause managers to underreport injuries
and illnesses that occur at the workplace to protect their business
reputation'' thereby reducing the accuracy of the data OSHA collects
(Docket ID 0090). NIOSH commented that employers might submit inflated
employee counts to OSHA in order to reduce their injury and illness
rates or alter their NAICS code to avoid the rule's requirements
(Docket ID 0035, Attachment 2).
    In response, OSHA notes that, as discussed above in Section III.B.4
of this Summary and Explanation, the agency already publishes
establishment-specific information from the OSHA Form 300A. Because the
new information employers will be submitting under the final rule
(i.e., the information from Forms 300 and 301) is simply the more
specific information underlying the data from the 300A that employers
are already submitting (and that is already being published online), it
is not clear to OSHA why publishing the additional information would
change any existing incentives to under-record or to falsify
information. Commenters did not provide any examples of increased
under-recording as a result of the collection and publication of Form
300A data, nor is OSHA aware of any. While OSHA believes that most
employers act in good faith when carrying out their recordkeeping
duties under the OSH Act, failing to record injuries or illnesses, or
submitting false information to OSHA, could result in a citation for a
violation of OSHA's recordkeeping regulations. In addition, employers
that falsify information provided to the government could also be found
to have violated 18 U.S.C. 1001(a), which prohibits the knowing and
willful provision of false information regarding material facts on
matters that are under the jurisdiction of the Executive branch, or
Section 17(g) of the OSH Act, 29 U.S.C. 665(g), which prohibits
knowingly making any false statement, representation, or certification
in any application, record, report, plan, or other document filed or
required to be maintained pursuant to the OSH Act.
    Some commenters raised the possibility that expanded data
collection and publication could lead some employers to record fewer
injuries and illnesses for which work-relatedness is unclear (e.g.,
Docket IDs 0042, 0086, 0088). For example, the Chamber of Commerce
stated that employers ``will reconsider whether to record as many
injuries or illnesses'' and pointed in particular to cases in which
work-relatedness is difficult to determine (Docket ID 0088).
    While OSHA recognizes that there are cases in which the analysis of
work-relatedness may not be straightforward, OSHA also notes that
employers are required to make good faith efforts to determine whether
an injury or illness is work-related in order to establish whether the
case is recordable under part 1904 (see Sec.  1904.4(a)). There is a
good deal of guidance in OSHA's recordkeeping regulations themselves
(see Sec.  1904.5) on how to determine if an employee's injury or
illness is work-related, including: general guidance for when a case is
considered to be work-related and when work-relatedness is presumed
(Sec.  1904.5(a)); a list of circumstances in which cases that occur in
the work environment are not work-related (Sec.  1904.5(b)(2)); and
instructions for how to determine work relatedness when employees are
injured or become ill during work travel or while working from home
(Sec.  1904.5(b)(6), (7)). Further guidance on the work-relatedness
determination, as well as useful examples, can be found on OSHA's web
page, Detailed Guidance for OSHA's Injury and Illness Recordkeeping
Rule (https://www.osha.gov/recordkeeping/entry-faq). While OSHA does
not issue citations for over-recording, to the extent that this rule
encourages employers to record only cases that they have determined are
work-related, OSHA would expect the rule to increase the accuracy of
the data that is recorded and then submitted to OSHA. Indeed, the
Chamber of Commerce appears to support this as a likely outcome,
stating that employers ``may look more closely as to whether the injury
or illness is work related and needs to be recorded'' (Docket ID 0088).
    Some commenters also expressed concern that expanded data
collection and publication would lead to greater underreporting by
employees of their workplace injuries and illnesses, thereby reducing
the data's accuracy (e.g., Docket IDs 0042, 0055, 0056, 0070, 0086,
0087). The Employers E-Recordkeeping Coalition stated that it ``is very
concerned that the increased risk of employee personal and medical
information being collected by a Federal agency and then publicized,
albeit inadvertently, will create a significant disincentive for
employees to report workplace injuries that are recordable events''
(Docket ID 0087). Worksafe and the Strategic Organizing Center
suggested that OSHA add a provision to prohibit employer practices that
discourage the reporting of injuries and illnesses by employers,
pointing to employer programs that disincentive reporting as well as
workers' fear of retaliation for reporting an injury or illness to
their employer (Docket IDs 0063, 0079).
    With respect to the impact of privacy concerns on employee
reporting, OSHA understands the importance of protecting personally
identifiable information and notes that there is a very low risk that
information that could reasonably be expected to identify individuals
directly will be disclosed as a result of this final rule. OSHA
acknowledges commenters' concerns about the potential posting of this
type of information on a publicly accessible website. However, the
posting or disclosure of information that could reasonably be expected
to identify an individual directly is not the intent, nor is it a
likely result, of this rulemaking. As explained in more detail in
Section III.B.6 of this Summary and Explanation, above, OSHA believes
it has, and will have, effective safeguards in place to prevent the
disclosure of that type of information. Further, OSHA hopes that
employers will educate their employees about the safeguards OSHA is
putting into place to protect against the disclosure of information
that could reasonably be expected to identify individuals directly.
OSHA also intends to include materials for employees in the materials
that will be created to educate interested parties about the
requirements of the rule as well as those safeguards.
    In response to Worksafe's comment proposing a new regulatory
provision prohibiting employer practices that discourage employee
reporting, OSHA notes that the recordkeeping regulations, at Sec.
1904.35(b)(1)(i), already require employers to establish reasonable
procedures for reporting work-related illnesses and injuries that do
not deter or discourage employees from accurately reporting their
injuries or illnesses. Furthermore, the regulations explicitly prohibit
employers from discharging or otherwise discriminating against
employees for reporting work-related injuries and illnesses (Sec.
1904.35(b)(1)(iv); see also Sec.  1904.36). And as OSHA clarified in
the 2016 final rule which contained these recordkeeping provisions, a
workplace safety incentive program could be found to violate Sec.
1904.35 if employees are penalized for reporting work-related injuries
or illnesses as part of the program (81 FR 29673-74). OSHA further
stated that the changes were designed to ``promote accurate recording
of work-related injuries and

illnesses by preventing the under-recording that arises when workers
are discouraged from reporting these occurrences'' (81 FR 29669). Thus,
OSHA has addressed this issue in its regulations since 2016. Moreover,
OSHA has recognized since at least 2012 that incentive programs that
discourage employees from reporting injuries and illnesses by denying a
benefit to employees who report an injury or illness may be prohibited
by Section 11(c) (see https://www.osha.gov/laws-regs/standardinterpretations/2012-03-12-0; 81 FR 29673-74).
    In contrast to those who argued that the final rule will lead to
less accurate data, other commenters argued that the expanded data
collection and publication will lead to more accurate data, because of
increased transparency and oversight (e.g., Docket IDs 0049, 0066,
0084, 0089). For example, the United Food and Commercial Workers
International Union (UFCW) stated, ``We anticipate that the requirement
that companies submit data electronically will improve the quantity,
quality, and accuracy of their records, and increase OSHA's and the
public's oversight ability, all of which will improve worker health and
safety also'' (Docket ID 0066). Cal/OSHA noted that the increased
transparency created by the publication of the data will encourage and
support accuracy in injury and illness reporting (Docket ID 0084).
    OSHA agrees with commenters who stated that the final rule will
result in improved accuracy of injury and illness records, due to
increased transparency and oversight by OSHA, employees, and others, as
well as awareness by employers that their records could be subject to
additional scrutiny. Section 1904.32 already requires company
executives subject to part 1904 requirements to certify the annual
summary (Form 300A); this process requires them to examine the OSHA 300
Log and certify that the annual summary is correct and complete based
on their examination of the OSHA 300 Log and their knowledge of the
process by which the information was recorded. OSHA recognizes that
most employers are diligent in complying with this requirement.
However, a minority of employers is less diligent, leading to
violations of the recordkeeping regulations. It is OSHA's hope that, if
these employers know that their data must be submitted to the agency
and may also be examined by members of the public and their own
employees, they may pay more attention to the requirements of part
1904, which could lead both to improvements in the quality and accuracy
of the information and to better compliance with Sec.  1904.32.
Increased oversight by labor unions or a company's employees could lead
to corrections to the data if, for example, a labor union discovers
that a known workplace injury of a union member is not included in the
published data and reports the omission to the employer (e.g., Docket
ID 0049). Finally, OSHA notes the comment from NIOSH suggesting various
means of investigating the effect of implementation of this final rule
on compliance with the requirements of part 1904 (Docket ID 0035,
Attachment 2). While the agency has determined that staggered
implementation, where industries with the highest injury rates would be
required to comply first, would be too confusing to implement, OSHA
encourages future studies to assess the effect of the final rule on
injury and illness recording, reporting, and data submission, and to
identify solutions if problems are found.
c. Collecting and Processing the Data From Forms 300 and 301 Will Help
OSHA Use Its Resources More Effectively
    In the preamble to the 2019 final rule, OSHA stated that collecting
and processing the Form 300 and 301 data and keeping information
confidential which could reasonably be expected to identify an employee
directly would require the agency to divert resources from other
priorities, including the analysis of Form 300A data (84 FR 392; see
also 84 FR 387). In particular, OSHA was concerned that collecting and
processing this data would prevent it from ``fully utilizing the data
from the Form 300As and severe injury reports it is already collecting
to improve its enforcement and outreach objectives to ensure compliance
with the OSH Act'' (84 FR 393). However, in the NPRM, OSHA explained
that because of improvements in available technology, it would no
longer need to rely on manual review or analysis for Form 300 and 301
data and had preliminarily determined that the agency's resource-
related concerns described in the 2019 final rule were no longer
compelling (87 FR 18541-42). In addition, OSHA explained that the
proposed rule would increase the agency's ability to focus resources on
those workplaces where workers are at high risk (87 FR 18533). In other
words, the proposal would, in some ways, save agency resources by
helping the agency be more efficient, e.g., ``allow[ing] the agency to
focus its enforcement and compliance assistance resources based on
hazard-specific information and trends, and . . . increas[ing] its
ability to identify emerging hazards, at the establishment level'' (87
FR 18538).
    A number of interested parties submitted comments on this issue and
generally agreed that the data collected and published under this final
rule will actually help OSHA use its limited resources more effectively
to protect workers. For example, some interested parties, including the
Council of State and Territorial Epidemiologists, National COSH, the
Laborers' Health and Safety Fund of North America, Worksafe, the
International Brotherhood of Teamsters, Centro de los Derechos del
Migrante, and Public Citizen, commented that requiring regular
electronic submission of injury and illness data would help OSHA to use
its limited enforcement and compliance assistance resources more
effectively (Docket IDs 0040, 0048, 0063, 0080, 0083, 0089, 0093). The
AFL-CIO agreed that because OSHA's resources are very limited, it
``must maximize the use of existing tools'' (Docket ID 0061).
    Commenters also provided examples of how this data would help OSHA
use its resources more effectively. For example, National COSH, the
National Employment Law Project, and the Centro de los Derechos del
Migrante commented that ``case-specific data will help the agency
identify the hazard-specific materials and other compliance assistance
resources they could direct to employers who report high rates of
injuries or illnesses related to those hazards,'' and ``to workers in
those industries'' (Docket IDs 0048, 0049, 0089). These commenters also
said that the data would ``aid the agency in identifying emerging
hazards . . . and focus outreach to employers and workers whose
workplaces might include those hazards.''
    Similarly, Public Citizen commented that the collected data would
enable OSHA to ``quickly pinpoint workplace hazards . . . and target
its enforcement efforts'' (Docket ID 0093). The International Union of
Painters and Allied Trades/AFL-CIO commented that this requirement
would ``ensure factors responsible for those pronounced illness and
injuries trends are identified and addressed in a timely manner for the
well-being of workers'' (Docket ID 0073). Worksafe also noted that
electronic submission would allow the agency ``to search and analyze
the data'' and provide ``timely and systematic'' injury and illness
information that will help OSHA to focus its enforcement efforts on
``hazards that are affecting workers now'' (Docket ID 0063).
    On the other hand, the Chamber of Commerce questioned whether the
data

could actually help OSHA target its enforcement efforts (Docket ID
0088, Attachment 2). The Chamber stated that injury and illness data
are complex and ``unavoidably subjective,'' and asserted that because
the log only includes work-related injuries, it does not show actual
risks--rather, ``it shows whether the employer believes that there is a
connection between the working environment and the injuries.''
Additionally, several commenters reiterated OSHA's concerns from the
2019 final rule regarding the diversion of OSHA's resources from other
important initiatives (e.g., Docket IDs 0058, 0070, 0076). Some such
commenters argued that any resource diversion would be inappropriate
because OSHA is incapable of processing and utilizing the Forms 300 and
301 data that would be received under the proposal. OSHA has addressed
those comments elsewhere in this preamble, explaining that the agency
has the capability to collect and use such data (see, e.g., Section
III.B.14.d of this Summary and Explanation). Other commenters merely
referenced OSHA's 2019 determination that its resources would be
diverted without analyzing the reasons OSHA gave for reconsidering its
previous decision. Still other commenters attacked OSHA's findings that
improvements in technology will decrease the resources required to
collect and process the Form 300 and 301 information and ensure that
information which could reasonably be expected to identify an
individual directly is not publicly released. OSHA has covered these
comments elsewhere as well (see, e.g., Section III.B.6 of this Summary
and Explanation).
    Finally, the International Bottled Water Association (IBWA) pointed
to district court rulings on the 2019 final rule and argued, ``[T]he
reviewing court agreed with OSHA's determinations that costly manual
review of collected 300 and 301 data would be needed to avoid a
meaningful risk of exposing sensitive worker information to public
disclosure, finding that the uncertain benefits of collecting the 300
and 301 data did not justify diverting OSHA's resources from other
efforts.'' (Docket ID 0076).
    IBWA's comment misconstrues the court's decision. The court did not
``agree'' with OSHA's determination. Rather, the court found that
OSHA's decision was neither arbitrary nor capricious, i.e., that OSHA
had not ``entirely failed to consider an important aspect of the
problem, [or] offered an explanation for its decision that runs counter
to the evidence before the agency'' at the time OSHA made its decision
(see State of New Jersey et al. v. Pizzella, No. 1:19-cv-00621 (D.D.C.
Jan. 11, 2021) (citation and internal quotations omitted)).
Importantly, the court stated that ``the arbitrary and capricious
standard is narrow, and a court is not to substitute its judgment for
that of the agency (id. (citation and internal quotations omitted)).
Rather, reviewing court's decisions are ``based on a consideration of
the relevant factors and whether there has been a clear error in
judgment'' (id. (citation and internal quotations omitted)). In short,
the court did not do an independent review of all the record evidence
and determine that OSHA made the correct decision. Instead, it looked
to see if OSHA considered all the relevant factors and made a
reasonable decision. The fact that an agency's decision based on the
record at the time was reasonable does not prevent the agency from
subsequently making a different reasonable decision based on new
information.\12\ That is what OSHA has done here.
---------------------------------------------------------------------------

    \12\ It also does not necessarily follow that an agency could
not have made a different, non-arbitrary-and-capricious decision
based on the record before the agency at the time it made its
original decision. This is part of the reason why reviewing courts
do not substitute their judgment for that of the agency: at times,
more than one reasonable decision could follow from a given record.
---------------------------------------------------------------------------

    After consideration of these comments, OSHA agrees with commenters
that collection of case-specific information from the Form 300 and 301
will help the agency use its enforcement and compliance assistance
resources more effectively by enabling OSHA to identify the workplaces
where workers are at high risk. As explained in the 2001 final rule,
and as identified by commenters, establishment-specific injury and
illness information will help OSHA target its intervention efforts on
the most dangerous worksites and the worst safety and health hazards,
and injury and illness data will help OSHA to identify the scope of
safety and health hazards and decide whether regulatory intervention,
compliance assistance, or other measures are warranted (see 66 FR
5917). OSHA disagrees with the Chamber's claim that the case-specific
data would not help OSHA target its enforcement efforts because it does
not show actual risks. The Chamber is correct in that a single recorded
injury or illness, in and of itself, does not necessarily indicate the
existence of a risk. Similarly, recording a work-related injury,
illness, or fatality does not mean that the employer or employee was at
fault, that an OSHA rule has been violated, or that the employee is
eligible for workers' compensation or other benefits (see Note to Sec.
1904.0). However, an injury or illness recorded under part 1904 is an
indicator of a potential risk in the workplace, i.e., the employer has
determined that a particular injury or illness of an employee meets the
definition of work-relatedness in 29 CFR 1904.5(a). In other words,
such data can indicate a failure in an area of an establishment's
safety and health program or the existence of a hazard. The fact that
they do not always do so is not persuasive (see Section III.B.4 of this
Summary and Explanation). Thus, rather than diverting OSHA's resources
from higher priority issues, OSHA has determined that the data
collected and published under this rule will help OSHA use its limited
resources more effectively to protect workers.
d. OSHA's Capacity To Collect and Process the Data From Forms 300 and
301
    The preamble to the 2019 final rule cited the costs of building the
data collection system and processing the data from Forms 300 and 301
as one reason OSHA was rescinding some of the 2016 rule's data
submission requirements (84 FR 389). As discussed throughout this
preamble, in the NPRM to this rulemaking, OSHA found that the reasons
given in the preamble to the 2019 final rule for the removal of the 300
and 301 data submission requirement are no longer compelling (87 FR
18538).
    As to the collection of the data, OSHA (and more broadly, the
Department of Labor) has the technical capacity to build the necessary
data collection system. OSHA's ability is supported by its success in
building and utilizing the system to collect data from establishments'
Forms 300A. Since 2017, the ITA has collected submissions of Form 300A
from roughly 300,000 establishments per year. In addition, OSHA's
ability to build such a system is supported by the fact that other
Department of Labor agencies, i.e., BLS and MSHA, successfully built
and are utilizing similar collection systems (see, e.g., Docket ID
0079). BLS's system, in particular, is illustrative of the Department's
ability to create and utilize such systems: each year, the BLS Survey
of Injuries and Illnesses (SOII) collects the same case-specific
information, from the same OSHA records, from roughly 200,000
employers, nearly 150,000 more submitters than will provide data to
OSHA under this final rule. NIOSH also effectively built and is using a
similar system (Docket IDs 0035, Attachment 2, 0079). Based upon this
information, it is

reasonable to anticipate that OSHA will have the technical capacity to
collect the case-specific submissions. OSHA discusses the costs to
build the data collection system in Section IV, Final Economic
Analysis.
    As to data processing, the preamble to the 2019 rule does not
specifically explain what is included in the ``processing'' of data;
however, the discussion included a comment from NIOSH ``offering to
help with data analysis'' and ``not[ing] that it has already developed
auto-coding methods for categorizing occupation and industry based on
free text data and has successfully utilized similar free text data
collected from workers' compensation claims'' (84 FR 389, referencing
Document ID 2003-A2). As explained in the NPRM for the current
rulemaking, the agency preliminarily found that these concerns about
``processing'' costs were no longer compelling, due to technological
developments in automated data coding for text-based fields that have
made it easier and more cost-effective for OSHA to efficiently use
electronically submitted, establishment-specific, case-specific injury
and illness data. As discussed below, coding data is helpful for
characterizing, analyzing, and making use of large amounts of text-
based information.
    In the preamble to the proposed rule, OSHA declared an intention to
use automated systems to assign standardized codes based on the
information contained in the text fields (e.g., type of accident is
``fall'') to categorize and more efficiently use the data (87 FR
18540). This standardized, automated coding of information from text
fields in Forms 300 and 301 is already being done by BLS. As explained
in the preamble to the proposed rule, in 2018, after the beginning of
the previous rulemaking process, BLS switched to an autocoding system
that uses deep neural networks (87 FR 18541). This system outperformed
the alternatives across all coding tasks and made an average of 24%
fewer errors than the logistic regression autocoders, and an estimated
39% fewer errors than the manual coding process.\13\ OSHA explained in
the preamble that, by 2019, according to BLS, ``automatic coding had
been expanded to include all six primary coding tasks (occupation,
nature, part, source, secondary source, and event), with the model
assigning approximately 85% of these codes.'' \14\ OSHA asked for
public comment on the issue of automated coding of text-field data and
other available technology that would enable OSHA to automatically code
these data and also specifically asked, ``In addition to the automated
methods for coding text-based data discussed above, what additional
automated methods exist to code text-based data?'' (87 FR 18547).
---------------------------------------------------------------------------

    \13\ See ``Deep neural networks for worker injury autocoding'',
Alexander Measure, U.S. Bureau of Labor Statistics, draft as of 9/
18/2017 (Ex. 96).
    \14\ See https://www.bls.gov/iif/automated-coding/deep-neural-networks.pdf.
---------------------------------------------------------------------------

    In response, NIOSH commented, that it ``collects occupational
injury data from a national probability sample of emergency
departments.'' It further explained: ``These data are collected through
the occupational supplement to the National Electronic Injury
Surveillance System (NEISS-Work) [NIOSH 2022a]. Beginning with the 2018
NEISS-Workdata, injury event or exposure and source codes from the BLS
Occupational Injury and Illness Classification System (OIICS) Version
2.01 were assigned through a machine learning algorithm with manual
quality control efforts.'' (Docket ID 0035).
    NIOSH clarified that the machine learning algorithm ``relies mostly
on the information in the narrative injury incident description
field.'' Further, NIOSH explained that it ``has continued to enhance
[its] machine learning process using more technologically advanced
approaches, including incorporating additional quantitative variables,
which has increased the coding accuracy and further reduced the need
for manual coding.'' It also noted that it recently collaborated with a
partner university to develop a machine learning algorithm that assigns
Bureau of Census industry codes based on the narrative fields of
employer name and business type (Docket ID 0035).
    Similarly, the Strategic Organizing Center (SOC) referenced the
work that BLS has done, stating that BLS ``faced a problem of similar
magnitude when constructing the addition to the Annual Survey of
Occupational Injuries and Illnesses in the early 1990's--the Detailed
Case and Demographic series, based on its sampling of the exact same
data types from employers Form 301's'' and it ``developed and refined
the Occupational Injury and Illness Coding System (OIICS).'' SOC
extolled BLS's system: ``[t]his system is now successfully used
annually to code all those cases, with extraordinary benefits for all
parties interested in both the BLS survey and the underlying data from
the employer sources themselves'' (Docket ID 0079).
    In contrast, AIHA commented, ``Automated methods to analyze text-
based responses are very difficult to develop due to the variation of
words and writing styles used around the United States. It would be
more cost effective to expand the use of checkboxes and radio buttons
to assist in interpreting and extracting data from text responses.''
(Docket ID 0030). Similarly, the U.S. Poultry and Egg Association
commented, ``the idea that OSHA will assess the OSHA 301's is
unrealistic. The amount of data from the OSHA 301 will be massive and
the answers for most questions are not standardized'' (Docket ID 0053).
    The Phylmar Regulatory Roundtable also expressed doubts about
OSHA's ability to process the data it would receive pursuant to the
proposed rule, commenting that, ``[t]he amount of information and data
points that this regulation will produce is exponentially larger than
what OSHA currently collects from Form 300A alone.'' It added that
``[i]t is also not clear whether, despite the use of technology such as
AI or deep learning models to process and interpret the data, OSHA has
the resources in place to constructively utilize the information.'' PRR
estimated that OSHA would receive ``1,065,363'' documents if the
proposed rule was promulgated, a number which PRR claimed is ``3 times
more than the number of documents OSHA has experience working with''
(Docket ID 0094).
    The Employers E-Recordkeeping Coalition (Coalition) similarly
expressed concerns with OSHA's plans, arguing that ``[t]he proposed use
of an automated system to assign standardized codes based on text
identified in the 300 and 301 forms is unrealistic.'' Specifically, the
Coalition doubted that a system which relies on keyword searches would
be helpful because ``[they] are literal in the sense that computers
find terms wherever they appear--even if part of a larger phrase or
used in a different context. Words often have multiple meanings, so
keyword searches tend to return irrelevant results (false positives),
failing to disambiguate unstructured text.'' The Coalition added that
such ``searches also may fail to identify useful information that does
not use the express search terms (false negatives).'' Further, it
noted, ``OSHA's proposed use depends on employers typing words without
spelling errors, abbreviated text, or industry-specific language,
acronyms or codes that are not encapsulated in a word search. Under
these conditions, OSHA would miss mountains of pertinent information,
be flooded by

irrelevant information, and, in our view, simply would not effectively
identify workplaces that should be targeted for enforcement.'' The
Coalition concluded: ``[a]n accurate analysis of employer 300 and 301
information requires individualized analyses by real people--not IT
systems using word searches'' (Docket ID 0087; see also Docket ID
0076).
    In response, OSHA notes that no coding system, including manual
coding, is 100% accurate. However, as discussed in the preamble to the
proposed rule, a system to collect and autocode text-based data from
OSHA Forms 300 and 301 already exists, and BLS is effectively using it
(see, e.g., Docket ID 0102 \15\). In fact, BLS continues to expand use
of autocoding, explaining that ``For survey year 2020, all cases
mentioning `covid' or `corona' were manually coded due to their novel
nature and prevalence, dropping the percentage of cases autocoded.
Since then, COVID-19 cases were integrated into the autocoder training
process, allowing for the automated coding of approximately 92 percent
of codes for survey year 2021. Starting with survey year 2021, BLS
expanded collection of case data from all sampled establishments to
include details for cases involving days of job transfer or restriction
only. Previously BLS collected complete details only for cases
involving days away from work. Biennial estimates of detailed case
circumstances for cases involving days away from work, job transfer, or
restriction covering survey years 2021-2022 will first be published in
the fall of 2023.'' \16\ Chart 1, below, illustrates the SOII autocoder
performance for data collected annually.
---------------------------------------------------------------------------

    \15\ Measure, Alexander. ``Six Years of Machine Learning in the
Bureau of Labor Statistics.'' Advances in Business Statistics,
Methods and Data Collection, Jan. 2023, pp. 561-72.
    \16\ https://www.bls.gov/iif/automated-coding.htm.
    [GRAPHIC] [TIFF OMITTED] TR21JY23.000

    NIOSH also currently has the capability to accurately autocode
text-based data related to occupational injuries and illnesses. OSHA is
continuing discussions with BLS and NIOSH about adopting and/or
modifying their autocoding source code to create a pilot system where
the autocoding of OSHA data collected by OSHA could be tested and
compared to manual coding of the same data. Upon successful testing and
adoption of the autocoding system, OSHA plans to consult and work with
BLS, NIOSH, and other agencies with experience autocoding text-based
occupational safety and health data for long-term system maintenance to
continuously update the neural network code and refine automation of
the data. Until the autocoding system has been tested and is in place,
OSHA intends to only use and publish uncoded data. Both uncoded and
coded data can be useful for OSHA, as well as researchers, employers,
and employees.
    Once the data are coded, OSHA expects to use the data similarly to
how the agency currently uses coded data from the Severe Injury
Reporting (SIR) program (see Docket ID 0005 for an example of a search
interface for the data that will be collected under this final rule).
OSHA also intends to combine the coded data with other data sources
(e.g., inspection data or SIR data) to increase the utility of the data
for both the agency as well as other users (e.g., employers, employees,
researchers, and the public). The specific estimated cost burden on
OSHA and employers for data collection and processing is discussed in
Section IV, Final Economic Analysis, below.
e. Data Submission
    In the preamble to the proposed rule, OSHA also asked the following
two questions related to helping employers meet the requirements of the
proposed rule:
     Are there electronic interface features that would help
users electronically submit part 1904 data, particularly for case data
from the OSHA Form 300 and Form 301 and for

establishments that submit using batch files? For example, would it be
helpful for OSHA to provide a forms package or software application
that exports the required files into a submission-ready format?
     What features could OSHA provide to help establishments
determine which submission requirements apply to their establishment?
    OSHA received a number of comments related to these questions.
Electric Boat commented that their company currently uses proprietary
recordkeeping software to compile injury and illness data. Data from
the Form 300A is then manually entered in order to submit it to OSHA.
Electric Boat asked how OSHA will require data on the Forms 300 and 301
to be submitted and noted that manually entering data for each case
would be difficult, costly, and could result in errors in the submitted
data. The company asked for ``clarification on the method of submission
and whether or not scanned versions or PDF uploads of the forms would
be an acceptable means of submission'' (Docket ID 0028).
    The Sheet Metal and Air Conditioning Contractors' National
Association expressed concern about being required to use OSHA-provided
software on their systems, alleging that this would require additional
resources for familiarization with the software and that it could
create potential cyberliability claims for their member companies
(Docket ID 0046). On the other hand, AIHA urged OSHA to ``consider
providing software with recordkeeping logic to enable the completion of
data forms and automatic generation of logs for posting and reporting.
. . . Employers struggle with interpreting recordkeeping requirements,
and a user interface could include interpretation logic as well as
assist in paperwork completion'' (Docket ID 0030). The AFL-CIO
similarly stated that it would be useful for OSHA to provide basic
software for ``injury and illness recordkeeping from which the data can
be easily uploaded/reported to OSHA through a secure website as OSHA
envisions'' (Docket ID OSHA-2013-0023-1350, Attachment 2). And Cal/OSHA
``encourage[d] the design of a data submission system that is
compatible with other existing electronic systems used to track and
report establishment-specific injury and illness data'' (Docket ID
0084).
    For the expanded data collection under this final rule, OSHA plans
to continue to enable three methods of data submission: manual data
entry, batch file, and API. In manual data entry, the user enters the
data into a web form and then submits the web form. In batch file
submission, the user uploads a csv file (a delimited text file in which
commas separate the values). In API (application programming
interface), the user uses a software program that communicates directly
with OSHA's data collection program. In response to Cal/OSHA's comment,
OSHA notes that the API submission method is compatible with other
existing electronic systems used to track and report injury and illness
data. In addition, OSHA intends to continue to require electronic
submission of the recordkeeping data, i.e., OSHA will not permit the
uploading of scanned documents or pdfs.
    None of the data submission methods described above require
establishments to use OSHA-provided software on their systems. Indeed,
OSHA has never provided, and does not intend to require employers to
use, OSHA-developed software for data submission. OSHA, however, is
aware that some employers--particularly small employers--might find
OSHA-provided software useful for data submission, as reflected in the
comments from the AIHA and the AFL-CIO. OSHA will therefore consider
developing and providing such software in the future; however, use of
such software would not be required and the other data submission
options would remain available. Regardless of whether OSHA decides to
provide such software, OSHA expects that developers of proprietary
recordkeeping software will expand their applications that enable
automated electronic submission of the required information from the
OSHA Form 300A to also include submission of information from the Forms
300 and 301; this is further discussed in the Final Economic Analysis,
below.
    AIHA noted that ``Built-in error checks for key data problems would
be helpful,'' stating that the usefulness of the online data could be
affected by errors in submissions: ``For example, the 2020 data for
NAICS codes in the 331500 industry series contain five entries with
more than 150,000 hours worked per employee. In one case, an employer
with 150 employees reported working 24 million hours. On the other
hand, there were a couple of anomalies in the opposite direction,
including an employer with 27 employees who reported a total of only 40
hours worked for the entire year, less than two hours per employee. The
result of these obvious errors is that the average hours for the
industry were 3,713 per worker, almost double the expected number. . .
. OSHA should consider adding some editing features that would
highlight potential errors.'' (Docket ID 0030).
    In response, OSHA notes that the Injury Tracking Application (ITA)
already contains built-in edits that warn users of potential data
errors, including warnings about too many or too few hours worked per
employee. However, OSHA decided to allow the user to bypass the warning
in order to avoid discouraging or prohibiting the user from meeting
their reporting obligations. Each year, OSHA follows up with users who
submitted questionable data by informing them of the potential errors
and providing step-by-step guidance on how to correct the error. OSHA
encourages data corrections, but does not require them. This follow-up
process is limited to establishments under Federal OSHA jurisdiction.
OSHA anticipates incorporating similar built-in edits into the expanded
ITA for collection of Form 300/301 information in order to warn users
of potential errors in their submissions; the agency, however, does not
intend to prevent users from submitting their information if they
bypass the warning.
    On a related topic, the Coalition for Workplace Safety (CWS)
requested that OSHA ``establish clear procedures for employers to make
corrections to already-submitted data, and improve internal processes
to ensure those corrections are reflected in the publicly posted data''
because ``[c]urrently, upon notice from an employer of a required
correction, it takes months for OSHA to make these corrections online''
(Docket ID 0058). OSHA notes that these comments seem to reflect a
misunderstanding of the process for correcting injury and illness
information that has already been submitted. For changes to data for
the current collection year, the Injury Tracking Application allows
respondents to edit their already submitted data, and those changes
take place immediately within the application. To make the data
publicly available, OSHA posts each year's data on its public website
three times: (1) an initial file is posted in April of the collection
year; (2) an updated file is posted in September of the collection
year; and (3) a final file is posted in the beginning of the following
year. Users may also make requests for changes to previous years via
the Help Request Form on the Frequently Asked Questions page for the
Injury Tracking Application (https://www.osha.gov/injuryreporting/ita/help-request-form). During the six years OSHA has been collecting
information from the Form 300A, OSHA is aware of only one request to
change the data for an establishment in the publicly posted

file. That change was made within days, and a revised file was posted.
Because this system has been working so far to incorporate changes made
to already-submitted data, OSHA intends to continue to follow these
procedures for correcting and posting updated data.
    More generally, the NSC recommended that OSHA develop tools and
resources to help employers understand the forms and questions, ``which
could include a mentoring program allowing for larger, more
sophisticated employers to assist small and mid-sized businesses with
reporting'' (Docket ID 0041). While OSHA certainly does intend to
develop additional tools and resources to enable employers to comply
with the final rule, it does not currently have plans to develop such a
mentoring program. However, OSHA encourages collaboration between
regulated entities, whether as part of industry associations, union
efforts, or the type of collaboration mentioned by NSC. In addition,
OSHA notes that the compliance assistance materials the agency will
offer could be used as part of such collaborative efforts.
    Regarding the means of determining an establishment's NAICS codes
and number of employees, NIOSH recommended that employers use, as a
starting point, the NAICS and employee counts that are reported
quarterly, on a per-establishment basis, to their State workforce
agencies. NIOSH noted that these reports are submitted as part of their
unemployment insurance (UI) filings and/or as part of the Quarterly
Census of Employment and Wages (QCEW), a Federal-State partnership
(Docket ID 0035). In addition, NIOSH suggested that ``a single summary
`lookup' table be provided to make it easy to simply look up any
industry and see the requirements for form submission by establishment
size.'' Furthermore, NIOSH suggested that OSHA could provide a table or
tables that would include different generations of NAICS codes, to
account for the fact that different employers will be using NAICS codes
from different years. (Docket ID 0035, Attachment 2).
    In response, OSHA agrees with NIOSH that it would be appropriate
for employers to use the reports they make to State workforce agencies
as a starting point for determining their NAICS and employee numbers.
OSHA also concurs that a look-up table by industry and establishment
size could help establishments determine whether and how they are
affected by the data submission requirements. The agency currently has
a look-up app at https://www.osha.gov/itareportapp to help employers
determine if their establishment is required to submit 300A data to
OSHA, based on State location, peak employment in the previous year,
whether the establishment is a government facility, and the
establishment's NAICS code. The agency plans to modify the app to cover
the new requirements before they become effective.
    Finally, OSHA asked the following question in the proposal about
requiring versus allowing establishments that already have accounts in
the ITA to update their accounts to the 2022 NAICS: ``Going forward,
OSHA intends to use the 2022 NAICS in the ITA for establishments that
are newly creating accounts. However, for establishments that already
have accounts in the ITA, the version of NAICS used is the 2012 NAICS.
BLS anticipates that establishments that already have accounts in the
ITA, are also subject to the SOII, and have 2022 NAICS codes that are
different from their 2012 NAICS codes, would be unable to use the data-
sharing feature . . . to prefill their BLS SOII submission with data
already submitted through the OSHA ITA, unless these establishments
updated their accounts to revise their industry classification from the
2012 NAICS to the 2022 NAICS. What are the advantages and disadvantages
of requiring establishments that already have accounts in the ITA to
update their accounts to the 2022 NAICS? How much time would an
establishment require to determine whether their 2022 NAICS is
different from their 2012 NAICS? How much time would an establishment
require to edit their NAICS code in the ITA to reflect any changes?''
(87 FR 18547).
    In response to this question, NIOSH expressed a preference for all
users to update their NAICS codes to the 2022 version in the OSHA ITA:
``As potential end users of the data, NIOSH believes the use of
multiple NAICS code schemes will require extra work to analyze the data
and increase the potential for errors during data entry and data
analysis because the codes often change between versions. . . . For end
users who are interested in analyzing the submitted data, the first
step will be to crosswalk the codes across the various coding schemes,
mapping old codes to new codes so that a single coding scheme can be
used. Depending on the changes from version to version, crosswalking
codes is often a tedious, time-consuming task and can potentially
introduce error when the crosswalked categories are not the same or
certain codes cannot be easily crosswalked.'' (Docket ID 0035,
Attachment 2).
    CWS also commented on the issue of updating NAICS codes in the OSHA
ITA: ``OSHA also states that establishments creating new accounts
within the Injury Tracking Application (``ITA'') that OSHA uses for
data submission will be identified using 2022 NAICS codes, while
establishments with existing ITA accounts will continue to be
identified by the 2017 NAICS code. These inconsistencies will cause
confusion for employers, may require employers to keep multiple sets of
records, and may result in either over- or under-reporting.'' (Docket
ID 0058).
    OSHA has decided to allow, but not require, employers that already
have accounts in the ITA to update the NAICS for their establishments
to the 2022 codes. OSHA understands NIOSH's concern about the time-
consuming and potentially inaccurate process of using crosswalks to
convert from 2012 NAICS to 2022 NAICS when using the data for research
purposes. However, the same concern applies to individual
establishments using a crosswalk to update their NAICS. In fact, end
users of the data may have more experience with NAICS and crosswalk use
than those submitting data. OSHA has therefore determined not to burden
establishments that already have accounts in the ITA with a requirement
to update their NAICS codes from 2012 NAICS to 2022 NAICS.
Establishments will have the option to update, but the update will not
be required. Establishments that want to take advantage of the data-
sharing feature to prefill their BLS SOII submission with data
submitted to OSHA will, therefore, be able to use that feature if they
update their NAICS.
    In response to CWS comment, OSHA notes that establishments creating
new accounts in the ITA choose their NAICS from a pull-down menu of
NAICS codes; with an update optional but not required, the only
difference under this final rule will be that the pull-down menu will
be loaded with 2022 NAICS codes instead of 2012 NAICS codes. (No
accounts in the ITA use the 2017 codes, as the Coalition mistakenly
stated in its comment). Establishments that already have accounts in
the ITA will not have to do anything with respect to their NAICS codes.
It is not clear to OSHA why this would cause confusion for employers,
require employers to keep multiple sets of records, or result in over-
or under-reporting. And, even if it did, an employer could simply
choose to update their NAICS code in the ITA.

f. Tools To Make the Collected Data From Forms 300 and 301 More Useful
    In the preamble to the proposed rule, OSHA also asked for comment
about tools that would make the published data more available and
useful to interested parties (including employers, employees, job-
seekers, customers, researchers, workplace safety consultants, and the
general public) (87 FR 18543). Several commenters provided suggestions
for ways to make published data more useful to interested parties.
NIOSH's primary concern was that ``some data users might draw
unwarranted conclusions about the overall safety record of
establishments or employers when the numbers of employees and injuries
are low.'' To prevent misinterpretation, NIOSH suggested that ``OSHA
could publish statistical estimates of the extent to which an observed
injury rate for an individual industry or establishment is predictive
of future injury rates, or the extent to which any such injury rate
reflects the underlying risk of injury.'' NIOSH also commented that to
address potential inaccuracies in OIICS codes and ``increase data
users' understanding of the degree of reliability of the coding, OSHA
may consider posting or making available the probabilities of code
accuracy that are generated by the autocoding system, both on the
individual injury case level and the aggregate level'' (Docket ID
0035).
    Additionally, Unidos U.S., Farmworker Justice, and Texas RioGrande
Legal Aid suggested that OSHA ``publish the data in a way that is
accessible, searchable, and sortable using a greater level of detail
than is currently available'' and make the data ``available in a way
that allows the public to search for injuries and deaths among workers
in specific industries--including by six-digit NAICS codes'' and to
``refine that data by type of hazard down to the most detailed
subcategories of event, exposure, or source, and then to sort by other
relevant fields such as location, employer, race, and ethnicity''
(Docket ID 0078). Additionally, the commenters suggested that OSHA make
the data available in multiple languages, including Spanish, to
``ensure that Spanish-speaking Latinos themselves have access to the
information'' (Docket ID 0078).
    The International Brotherhood of Teamsters suggested that OSHA
``develop tools and resources within its website, especially where data
is to be downloaded, that would allow better user interface and help
users understand what they are looking at and what conclusions to
draw,'' such as providing more information on Total Case Rate (TCR),
and Days Away Restricted or Transferred (DART) rates (Docket ID 0083).
    OSHA will take these comments into consideration when designing
tools and applications to make the published data more available and
useful to interested parties. As discussed above, there are
considerable potential benefits to occupational safety and health
resulting from publishing the collected data, and the easier it is for
all interested parties to access and use the published data, the more
these benefits will be realized.

C. Section 1904.41(b)(1)

    Section 1904.41(b)(1) of the final rule includes clarifying
information on the injury and illness record submission requirements
for establishments of various sizes that are contained in final Sec.
1904.41(a)(1) and (2). The information, like many of the provisions in
part 1904, is conveyed in question-and-answer format. The final
provision addresses the question of whether every employer has to
routinely make an annual electronic submission of information from part
1904 injury and illness recordkeeping forms to OSHA. The answer
clarifies that not every employer has to routinely submit this data,
and that, in fact, only three categories of employers must routinely
submit information from these forms. The answer then describes the
three categories of employers and the information they must submit. The
first category is establishments that had 20-249 employees at any time
during the previous calendar year, and are classified in an industry
listed in appendix A. Establishments in this category must submit the
required information from Form 300A to OSHA once a year. The second
category is establishments that had 250 or more employees at any time
during the previous calendar year, and are required by part 1904 to
keep records. Establishments in this second category must also submit
the required information from Form 300A to OSHA once a year. The third
category is establishments that had 100 or more employees at any time
during the previous calendar year, and are classified in an industry
listed in appendix B. Establishments in this category must submit the
required information from Forms 300 and 301 to OSHA once a year, in
addition to the required information from Form 300A.
    The answer in Sec.  1904.41(b)(1) also specifies that employers in
these three categories have to submit the required information by the
date listed in Sec.  1904.41(c) of the year after the calendar year
covered by the form. Since the date in paragraph (c) is March 2, that
means that, for example, employers must submit the required information
covering calendar year 2023 by March 2, 2024. Finally, the answer
clarifies that establishments that are not in any of the three
categories must submit information to OSHA only if OSHA notifies that
establishment that it must do so for an individual data collection.
    Proposed Sec.  1904.41(b)(1) would have provided employers with
further clarity on which employers and establishments needed to submit
data under proposed Sec.  1904.41(a)(1) and (2) and how the
requirements of those provisions interacted with each other. These
proposed provisions, like the final provision, were written in
question-and-answer format to help employers easily identify the
information they seek.
    Proposed Sec.  1904.41(b)(1)(i) reiterated the question posed in
the previous version of Sec.  1904.41(b), which asked whether every
employer has to routinely make an annual electronic submission of
information from part 1904 injury and illness recordkeeping forms to
OSHA. The proposed answer was updated to be consistent with the
requirements in proposed Sec.  1904.41(a)(1) and (2). Proposed Sec.
1904.41(b)(1)(ii) would have clarified that an establishment that has
100 or more employees, and is in an industry included in both appendix
A and appendix B, need only make one submission of the OSHA Form 300A
in order to fulfill the requirements of both proposed Sec.
1904.41(a)(1) and (2).
    OSHA welcomed public comment on proposed Sec.  1904.41(b)(1)(i) and
(ii), including on whether the proposed provisions appropriately
clarified the proposed requirements for employers. OSHA did not receive
any comments specifically related to the text of proposed Sec.
1904.41(b)(1), and the agency has addressed comments related to the
substantive submission requirements in Sec.  1904.41(a)(1) and (2),
above. Therefore, OSHA has decided to finalize Sec.  1904.41(b)(1) with
changes from the proposal to reflect the revised structure of final
Sec.  1904.41(a)(1) and (2). Final Sec.  1904.41(b)(1) therefore
describes three categories of establishments that are required to
submit information under the final rule, as opposed to the two
categories described in proposed Sec.  1904.41(b)(1)(i). The three
categories are: (1) establishments with 20-249 employees in industries
on appendix A that are required to submit information from their Form
300A under final Sec.  1904.41(a)(1)(i); (2) establishments

with 250 or more employees that are required to keep records under part
1904 and are required to submit information from their Form 300A under
final Sec.  1904.41(a)(1)(ii); and (3) establishments with 100 or more
employees in industries on appendix B that are required to submit
information from their OSHA Forms 300 and 301.
    Similar to the proposal, the remainder of final Sec.  1904.41(b)(1)
notes that employers with establishments falling into any of these
three categories must submit the required information by the date
listed in paragraph (c) of this section of the year after the calendar
year covered by the form. The example given in the final regulatory
text--which specifies that submission for 2023 forms must occur in
2024--has been updated to reflect the first year OSHA anticipates
employers having to submit information under this final rule. Finally,
the provision specifies that if an establishment is not in any of the
three specified categories, the employer must submit information to
OSHA only if OSHA notifies the employer to do so for an individual data
collection. OSHA anticipates that final Sec.  1904.41(b)(1), along with
the additional compliance information the agency intends to issue, will
assist employers in determining their compliance responsibilities under
the final rule.
    Proposed Sec.  1904.41(b)(1)(ii) has not been included in the final
rule; it is no longer necessary due to the restructuring of the final
regulation. As discussed above, final Sec.  1904.41(a)(1) relates only
to the OSHA Form 300A, and final Sec.  1904.41(a)(2) relates only to
the OSHA Forms 300 and 301. This restructuring is expected to eliminate
any confusion regarding whether an establishment might be required to
submit information from its Form 300A twice. Therefore, there is only
one question under final Sec.  1904.41(b)(1), as opposed to the two
that were proposed.
    One commenter requested additional guidance related to how the
submission requirements will work. S.W. Anderson Company asked for
clearer guidance for companies in designated industries that have 100
employees across multiple sites. The company stated that ``we have just
reached the 100-employee threshold. We have previously only submitted
electronically the OSHA 300A for our company headquarters since we have
more than 20 employees. Our other locations all have less than 20
employees'' (Docket ID 0008).
    In response, OSHA clarifies that this final rule does not affect
how employees are counted for recordkeeping or information submission
purposes under part 1904. As OSHA states in reporting requirement FAQs
on the agency's Injury Tracking Application website (https://www.osha.gov/injuryreporting), OSHA's electronic reporting requirements
are based on the size of the establishment, not the firm. An
establishment is a single physical location where business is conducted
or where services or industrial operations are performed (see 29 CFR
1904.46). Therefore, under the facts described by this commenter, if
the firm has only one establishment (the company's headquarters) with
more than 20 employees, that is the only establishment for which the
commenter might need to submit injury and illness information. That
single establishment would have to submit the required information from
its Form 300A under final Sec.  1904.41(a)(1)(i) if the establishment
falls under a NAICS code listed in appendix A. The company would not,
however, have to submit information from its Form 300 or 301 for that
establishment, regardless of NAICS, because the establishment does not
have at least 100 employees. More generally, OSHA plans to revise and
expand the FAQs on its recordkeeping website as part of its compliance
efforts related to this final rule.

D. Section 1904.41(b)(9)

    Section 1904.41(b)(9) of the final rule specifies which information
employers must submit from the OSHA Forms 300 and 301. Final Sec.
1904.41(b)(9) asks and answers the following question: If I have to
submit information under paragraph (a)(2) of this section, do I have to
submit all of the information from the recordkeeping forms? Paragraph
(a)(2) contains the submission requirements for information from the
OSHA Forms 300 and 301.
    The answer in the final rule is no, employers who have to submit
information under paragraph (a)(2) of this section must submit all the
information from the OSHA Forms 300 and 301 except for the following
case-specific information:
     Employee name (column B), from the Log of Work-Related
Injuries and Illnesses (OSHA Form 300).
     Employee name (field 1), employee address (field 2), name
of physician or other health care professional (field 6), and facility
name and address if treatment was given away from the worksite (field
7) from the Injury and Illness Incident Report (OSHA Form 301).
    Proposed Sec.  1904.41(b)(9) was the same as final Sec.
1904.41(b)(9). In the preamble to the proposed rule, OSHA explained
that collecting data from these fields would not add to OSHA's ability
to identify establishments with specific hazards or elevated injury and
illness rates. Therefore, OSHA proposed excluding these fields from the
submittal requirements to minimize any potential release or
unauthorized access to any PII contained in those fields. Because the
data collection would not include the information from these fields,
there would be no risk of public disclosure of the information from
these fields through the data collection. OSHA requested comment on all
aspects of proposed Sec.  1904.41(b)(9), including whether the proposed
specified fields should be excluded from data that would be collected,
and whether other data should be similarly excluded to protect employee
privacy or for other reasons. OSHA also asked more specific questions,
as addressed below.
1. Collecting Employee Names
    In the preamble to the proposed rule, OSHA specifically asked the
following question about collecting employee names, in the context of
data-sharing between OSHA and BLS: ``OSHA is proposing not to collect
employee names under proposed Sec.  1904.41(a)(2) and (b)(9),
consistent with worker privacy concerns expressed in public comments
during previous rulemakings. However, BLS uses the ``employee name''
field on the Form 300 and Form 301 in their data collection for the
SOII. Beginning in 2021, a data-sharing feature has allowed some
establishments that are required to submit Form 300A information to
both OSHA and BLS, under the current regulation, to use their data
submission to the OSHA ITA in their submission to the BLS SOII. BLS
anticipates an inability to use this data-sharing feature for
establishments required to submit under proposed Sec.  1904.41(a)(2),
unless OSHA requires these establishments to submit the ``employee
name'' field on the Form 300 and 301. Without the data-sharing feature,
establishments that submit data to OSHA under proposed Sec.
1904.41(a)(2), and that also submit data to the BLS SOII, would not be
able to use their OSHA data submission of case-specific data to prefill
their BLS SOII submission. What would be the advantages and
disadvantages, in terms of employer burden and worker privacy concerns
or otherwise, of requiring all establishments subject to proposed Sec.
1904.41(a)(2) to submit employee names, to support this data-sharing
feature for Form 300 and 301 submissions? (Please note that OSHA would
not intend to publish employee names.)'' (87 FR 18547).

    In response, OSHA received multiple comments about the desirability
of data-sharing between BLS and OSHA, but there were no comments
supporting the collection of employee names. In fact, as discussed in
more detail above in this preamble, numerous commenters expressed
concerns about worker privacy and advocated that employee names be
excluded from the data submission.
    The Coalition for Workplace Safety commented in support of data-
sharing, ``Employers who submit data to OSHA should not be required to
separately submit the same data to BLS. These duplicative reporting
requirements are unacceptable, and OSHA's current proposal only serves
to exacerbate this existing problem'' (Docket ID 0058). Similarly, the
National Association of Manufacturers commented that it would be in the
best interest of OSHA and manufacturers for OSHA to gather detailed
information about workplace injuries and illnesses ``in conjunction
with the BLS SOII survey rather than in a separate data collection
process'' (Docket ID 0068). However, the Coalition for Workplace Safety
and the National Association of Manufacturers also expressed great
concern in their comments that collection of case-specific information
from the Form 300 and Form 301 would risk employee privacy.
    Other commenters also expressed support for data-sharing without
expressing support for collection of employee names. For example, the
American College of Occupational and Environmental Medicine commented
in support of avoiding duplicate reporting and encouraged streamlining
and simplifying the importation of data from OSHA to SOII (Docket ID
0037). Similarly, the National Safety Council commented, ``OSHA and BLS
should continue their collaboration to enable more businesses to
benefit from single reporting and make reporting easier'' (Docket ID
0041).
    Having reviewed the comments on this issue as well as the comments
on employee privacy described in more detail elsewhere in this
preamble, OSHA has decided not to collect employee names under final
Sec.  1904.41(a)(2) and (b)(9). This decision is consistent with worker
privacy concerns expressed in a number of public comments during this
rulemaking and discussed elsewhere in this preamble. Not collecting
employee names is, of course, the best way to ensure that this
information does not get released online. The agency also, however,
recognizes the value in providing ways to reduce the time and burden
for employers that are required to submit data to both OSHA and BLS. As
such, the agency will continue to work with BLS to identify and
implement data-sharing methods that do not require submission of
employee names to OSHA in order to reduce the burden for the subset of
establishments that are required to submit their Form 300 and 301 data
to OSHA and also to submit data to the BLS SOII.
2. Excluding Other Specified Fields
    In addition, in the preamble to the proposed rule, OSHA welcomed
more general public comment on proposed Sec.  1904.41(b)(9), including
whether the proposed specified fields should be excluded from data that
would be collected, and whether other data should be similarly excluded
to protect employee privacy or for other reasons (87 FR 18546). OSHA
asked that any comments suggesting exclusion of other fields or data
from the proposed submission requirements also address whether the
exclusion of that particular field or data from collection would hinder
OSHA's ability to use the collection to protect employee safety and
health. Exclusion of employee names is discussed above. Similar to
employee names, there were no comments arguing that OSHA should collect
the fields listed in proposed Sec.  1904.41(b)(9) (i.e., from Form 301
employee address (field 2), name of physician or other health care
professional (field 6), facility name and address if treatment was
given away from the worksite (field 7)).
    However, there were some commenters that wanted additional fields
to be excluded. For example, the Plastics Industry Association
commented that OSHA should not collect job title, department, gender,
birth date, date of hire, and date of death to avoid identifying
individual employees, and urged excluding job titles in particular
because there may only be a small number of employees, or a single
employee, with a job title in a facility (Docket ID 0086). Other
comments discussed elsewhere in the preamble also expressed concern
that employees may be identified by the data fields OSHA intends to
make public, (see, e.g., Docket IDs 0062, 0094). The Plastics Industry
Association also commented on the possibility that these data fields
could be cross-referenced with other data available publicly online,
such as social network accounts like LinkedIn, to identify employees
(Ex. 86). Similarly, R. Savage commented that ``job title, date of
hire, date of injury, and social media'' could be used to identify the
injured employee (Ex. 18). However, other commenters countered that the
detailed data can be used to improve workplace safety and health, (see,
e.g., Docket IDs 0030, 0079, 0090). The Plastics Industry Association's
comments did not address whether the exclusion of these fields from the
collection would hinder OSHA's ability to use the collection to protect
employee safety and health.
    In response to these concerns and, as discussed elsewhere in this
preamble, OSHA has determined that the benefits of collecting the data
for improving safety and health outweigh potential privacy concerns.
Each of these data variables included in the data collection gives OSHA
the ability to identify unique hazards. The age of workers is relevant
to indicating increased hazards for certain age groups. The date of
hire demonstrates when injuries disparately impact new employees versus
more experienced employees. An injury that occurs mostly in recent
hires may indicate a greater need for training and monitoring new
employees, while other illnesses or injuries can occur predominantly in
longer term employees. Gender is similarly helpful to indicate workers
at higher risk. For example, women are at a higher risk for workplace
violence. Job titles aid OSHA in indicating specific jobs with higher
rates of illnesses and injuries. The date of injury and date of death
are also useful to OSHA for identifying hazards. For example, certain
illnesses may have a lag time between the date of injury and the date
of death. Other injuries and illnesses may have a seasonal component,
such as heat illnesses in the summer.
    Further, as part of OSHA's determination that the benefits of
collecting and publishing the data outweigh potential privacy concerns,
the agency emphasizes that it will be able to adequately protect
workers' information that could reasonably be expected to identify
individuals directly. OSHA notes that employee birth dates will not be
made available to OSHA for outreach, enforcement, or research/
analytical purposes.\17\ Instead, establishments will enter the birth
date, the system will convert the information to age, and OSHA will
retain the age. The data from the fields for age (calculated from date
of birth in field 3),

date hired (field 4), gender (field 5), whether the employee was
treated in an emergency room (field 8), and whether the employee was
hospitalized overnight (field 9) will be collected, but these fields
will not be published. OSHA also notes regarding the date of death
field that deceased individuals do not have a right to privacy;
further, since January 1, 2015, Sec.  1904.39(a)(1) has required
employers to report the death or hospitalization or amputation or lose
of an eye of any employee as a result of a work-related incident within
eight hours of the death, and OSHA publishes the reports at https://www.osha.gov/severeinjury, including narrative information. In
addition, as discussed elsewhere, HIPAA does not apply.
---------------------------------------------------------------------------

    \17\ Note that, as explained in the Privacy Impact Assessment
(Docket ID 0107), establishments that submit their data by uploading
a csv file (see III.B.14.e Data Submission) will include the Date of
Birth field in the csv file, and the csv files will be temporarily
stored in a secure, encrypted folder on the Department's IT network
(see III.B.9 Risk of cyber attack) for technical support purposes
only, and purged on a regular basis.
---------------------------------------------------------------------------

    After consideration of these comments, OSHA has decided to exclude
the following fields from the data collection, as proposed:
     Log of Work-Related Injuries and Illnesses (OSHA Form
300): Employee name (column B).
     Injury and Illness Incident Report (OSHA Form 301):
Employee name (field 1), employee address (field 2), name of physician
or other health care professional (field 6), facility name and address
if treatment was given away from the worksite (field 7).

E. Section 1904.41(b)(10)

    Section 1904.41(b)(10) of the final rule addresses how
establishments identify themselves in their electronic recordkeeping
submissions. As noted above, OSHA's recordkeeping regulation requires
employers to maintain and report their injury and illness data at the
establishment level. An establishment is defined as a single physical
location where business is conducted or where services or industrial
operations are performed (see 29 CFR 1904.46). Part 1904 injury and
illness records must be specific for each individual establishment. The
text of final Sec.  1904.41(b)(10) is in question-and-answer format and
responds to the question of whether a company may use numbers or codes
as its establishment name when submitting data to OSHA. The answer to
the question is yes, a company may use numbers or codes as its
establishment name. However, the submission must also include a legal
company name, either as part of the establishment name or separately as
the company name.
    Final Sec.  1904.41(b)(10) is identical to the proposed provision
except for changing ``company name'' to ``legal company name.'' The
final version of Sec.  1904.41(b)(10) is intended to address a problem
OSHA identified with the previous rule, which was that the company name
was not required. Specifically, as OSHA explained in the preamble of
the proposed rule, the ITA (the data submission portal) includes two
text fields which OSHA uses to identify each establishment: Company
Name and Establishment Name. The Establishment Name field is a
mandatory field, and users must provide a unique Establishment Name for
each establishment associated with their user account. In contrast, the
Company Name field is an optional field. OSHA's review of five years of
data electronically submitted under Sec.  1904.41 showed that some
firms submitted data with codes in the required Establishment Name
field and nothing in the optional Company Name field. For example, in
the 2020 submissions of 2019 Form 300A data, users submitted data for
more than 18,000 establishments with a code in the Establishment Name
field and no information in the Company Name field. The data are
considerably less useful and more difficult for both OSHA and other
interested parties to work with when establishments have a code in the
Establishment Name field and no information in the Company Name field.
For example, it is not possible for a data user to search for data by
company for companies that use codes without including a company name.
In addition, without the legal company name, OSHA is unable to
determine whether a particular establishment in that company met the
reporting requirements.
    To address this problem of missing data under the previous rule,
OSHA proposed a provision to require employers who use codes for the
Establishment Name to include a legal company name. The proposed
provision, Sec.  1904.41(b)(10), provided: ``My company uses numbers or
codes to identify our establishments. May I use numbers or codes as the
establishment name in my submission? Yes, you may use numbers or codes
as the establishment name. However, the submission must include the
company name, either as part of the establishment name or separately as
the company name.''
    The final provision, Sec.  1904.41(b)(10), states: ``My company
uses numbers or codes to identify our establishments. May I use numbers
or codes as the establishment name in my submission? Yes, you may use
numbers or codes as the establishment name. However, the submission
must include the legal company name, either as part of the
establishment name or separately as the company name.''
    OSHA changed ``company name'' to ``legal company name'' in the
final regulatory text to clarify that the legal company name should be
entered as opposed to a more generic company name. For example,
``Company X, LLC'' would be entered if that is the legal company name
for the establishment, not ``Company X.'' This clarification is
consistent with the Summary and Explanation for proposed Sec.
1904.41(b)(10), which stated ``[t]he submission must include the legal
company name, either as part of the establishment name or separately as
the company name'' (87 FR 18523, 18546 (March 30, 2022)). All companies
must enter a legal company name, either as part of the establishment
name field or the company name field. Users will be reminded during
data submission that the information about the establishment must
include the company's legal name, either in the establishment field or
in the company name field.
    OSHA welcomed public comment on the proposed requirement to submit
the company name, including any comments on the utility of such a
requirement and how the company name should be included in an
establishment's submission (87 FR 18456). The agency received a number
of comments in response to the comment solicitation on this topic. For
example, Worksafe supported the proposed requirement to submit both
establishment name and company name (Docket ID 0063). Similarly, Cal/
OSHA commented, ``The proposed inclusion of employers' entity names,
which we support, makes detailed information usable even when employers
use numbers or codes to identify their facilities'' (Docket ID 0084).
In their comment, Seventeen AGs also supported the requirement, which
they described as ``critical[ ]'' (Docket ID 0045). The comment further
described the proposal as an improvement to existing reporting
requirements, noting that the requirement to disclose a legal name will
aid job-seekers in making informed decisions about the injury and
illness data for a specific employer (Docket ID 0045).
    In contrast, several organizations argued against requiring a
company name. For example, the National Propane Gas Association argued
that ``any research to evaluate the general performance or safety of a
particular industry can be investigated on the basis of industry NAICS
code; not company name'' (Docket ID 0050). OSHA recognizes the value of
data that is industry-wide for industry-based research, but there is
additional value obtained through collecting and

publishing company names. OSHA intends to use the data to engage in
company-specific activities to effectively address occupational health
and safety issues, and such activities require the company name.
    The Phylmar Regulatory Roundtable (PRR) also opposed OSHA's
proposed requirement to include the legal company name. It explained
that it is concerned ``about OSHA's, and particularly the public's,
ability to remain objective. To alleviate this concern, PRR recommends
OSHA does not publish this information publicly, does not collect the
company name, and uses this data for statistical purposes only''
(Docket ID 0094). In addition, the Association of the Wall and Ceiling
Industry also expressed strong opposition to including the company's
name, noting its concern ``about provisions in the proposed rule that
would unintentionally and unnecessarily harm construction businesses,''
such as ``any requirement that would result in public access to any
affected company's name and address, and/or signatory executive's name
and telephone number'' (Docket ID 0043). The National Propane Gas
Association similarly argued that OSHA's assessment of the utility of
the collected information did ``not include the regulated companies
because there is no evaluation of the potential damage by
misunderstanding or misconstruing the information that is proposed for
the public website'' (Docket ID 0050). It further stated that ``[t]he
injury and illness reports do not include explanations of employees'
conduct, variations from company policies, common practices, or
comparisons to indicate positive safety practices, days without
injuries or illnesses, or other safeguards companies implement''
(Docket ID 0050).
    OSHA understands these commenters' concerns. However, as discussed
elsewhere, OSHA notes that it has published injury and illness data by
company name since 2009, and most establishments were already
submitting company name under the previous requirements. Despite this
history, opposing commenters did not provide any examples of burden or
damage resulting from the publication of company names, nor is OSHA
aware of any. Moreover, as discussed in more detail in Section III.G of
this Summary and Explanation, OSHA's existing Note to Sec.  1904.0
makes clear that ``[r]ecording or reporting a work-related injury,
illness, or fatality does not mean that the employer or employee was at
fault, that an OSHA rule has been violated, or that the employee is
eligible for workers' compensation or other benefits.'' Further, OSHA
notes that the signatory executive's name and telephone number will not
be collected or published under the final rule, nor were they under the
previous rule. Consequently, OSHA does not find these comments
persuasive.
    OSHA agrees with comments that inclusion of the legal company name
will improve workplace safety and health. The primary purpose of
collecting the company name is to make the data more useful for OSHA
for activities at the company level, such as inspection targeting,
compliance outreach, research, and assessment of company-wide
compliance with the submission requirement. With the company name
included, OSHA will, for example, be able to identify company-wide
trends of occupational illnesses or injuries. Additionally, interested
parties may also use company name data to improve workplace health and
safety or to inform themselves about the injury and illness records of
specific employers.
    One commenter offered an example of how it used company-specific
information to improve workplace safety. The Strategic Organizing
Center explained in its comment how it used the release of the 2020 and
2021 Injury Tracking Application data to publish reports on the rate of
serious injuries at a particular company, which was much higher than
the rate at other similar businesses. After the reports were published,
the company responded by announcing that safety improvements were
underway. OSHA agrees with this commenter that ``the availability of
more detailed information, including names and locations of employers,
allows employers and others to make more meaningful comparisons''--and,
as a result, can lead to improvements in worker safety and health
(Docket ID 0079).
    After consideration of these comments, OSHA has decided to require
establishments to submit company name, as proposed, in order to aid
both OSHA and other interested parties in using the data more
effectively. Users will be reminded during data submission that the
information about the establishment must include the company's legal
name, either in the establishment field or in the company name field.

F. Section 1904.41(c)

    Section 1904.41(c) of the final rule requires employers to
electronically submit the required information to OSHA by March 2 of
each year. The final provision simplifies the regulatory language in
Sec.  1904.41(c)(1)-(2) of the previous rule concerning the dates by
which establishments must make their annual submissions. Previously,
Sec.  1904.41(c)(1) included information for establishments on what to
submit to OSHA during the phase-in period of the 2016 final rule and
the deadlines for submission during that phase-in period. That
information is no longer relevant and, thus, OSHA removed it to
streamline the section. The substantive information already contained
in the previous Sec.  1904.41(c)(1) was consolidated into Sec.
1904.41(c) of the final rule. Like previous Sec.  1904.41(c)(2), Sec.
1904.41(c) of the final rule requires all covered establishments to
make their electronic submissions by March 2 of the year after the
calendar year covered by the form(s). Also, Sec.  1904.41(c) of the
final rule provides an updated example of that requirement, explaining
that the forms covering calendar year 2023 would be due by March 2,
2024. As the example indicates, because this final rule becomes
effective on January 1, 2024, OSHA intends for March 2, 2024 to be the
first submission deadline for the new information required to be
submitted under this rule.
    The Coalition for Workplace Safety commented, ``Employers must have
notice of the exact requirements of any final rule at the beginning of
the year for which collected data will be submitted.'' Otherwise, they
argued, employers will not have sufficient notice and time to adjust
their information collection and review processes (Docket ID 0058). The
Flexible Packaging Association made a similar comment (Docket ID 0091).
On the other hand, the AFL-CIO expressed frustration that the date of
the proposed rule ``already delayed the ability of OSHA to institute
final reporting requirements . . . until at least 2024'' (Docket ID
0061).
    OSHA does not agree that employers must have notice of the
requirements of any final rule at the beginning of the calendar year
for which the data will be submitted. The commenters who made this
assertion cite no official rule or other legal authority to support it,
and OSHA is not aware of any such rule regarding calendar years and
reporting requirements. It is OSHA's position that it was not necessary
for the final rule to be published before the end of 2022 in order for
OSHA to begin collecting 2023 data in 2024. OSHA anticipates that
employers will have sufficient time between publication of the final
rule in 2023 and the first submission deadline in 2024 to make any
changes to their submission systems that they determine should be made.
Indeed, the final rule

does not make any changes to the recordkeeping requirements for 2023;
employers will continue to record the same information as they were
required to record before this final rule was issued.
    Both the Flexible Packaging Association and the Coalition for
Workplace Safety commented that the changes in the final rule will
require technological changes within and outside of OSHA that will
require testing for accuracy and effectiveness, and that OSHA must
account for the time it will take to make such adjustments (Docket IDs
0058, 0091). To the extent that these commenters are concerned about
changes they plan to make to their own recordkeeping or data submission
systems, OSHA notes that these types of changes are not a requirement
of the final rule. The final rule simply requires submission of the
data. OSHA will continue to provide three options for employers to
submit the data (manual entry via web form, batch upload via csv file,
and API), and it will continue to be up to the individual employer to
decide which option to use. To the extent that these comments focus on
changes OSHA must make to the ITA to accept the new submissions, OSHA
has considered this issue and anticipates being prepared to accept
these submissions beginning in early 2024.
    Some commenters also argued for an annual submission date later
than March 2 to allow employers more time to collect and submit the
data from the previous year. For example, the Coalition for Workplace
Safety commented that ``OSHA should push future deadlines to allow
companies to submit past March 2; this date is too early in the year
and does not provide enough time for companies to collect and submit
this data'' (Docket ID 0058; see also Docket ID 0091). The Employers E-
Recordkeeping Coalition similarly commented: ``For example, one
national employer with approximately 700 establishments that would be
covered by the new requirement to submit 300 and 301 level data
currently takes approximately 3 months to audit and submit its injury
and illness records to ensure that its 300A data submissions are
accurate. Manually keying in every line of hundreds of 300 log data, or
if that is not necessary, at least keying in thousands of 301 Reports
would be exponentially more burdensome--likely infeasible given the
annual March 2nd submission deadline.'' (Docket ID 0087).
    In response, OSHA is not persuaded that the March 2 date is too
early in the year to submit data for the previous year. OSHA notes that
Sec.  1904.32 already requires employers to review the Form 300 Log
entries and complete, certify, and post the Form 300A annual summary no
later than February 1 of the year following the year covered by the
records. Therefore, employers must already have collected and reviewed
all of their establishments' 300 Log information for the previous year
by February 1 of each year. Having completed this review, they will
then have an additional month to submit the data. The scenario posed by
the Employers E-Recordkeeping Coalition regarding manually typing in
hundreds or thousands of lines of data would only arise if a company
with many establishments chose to enter all the data via webform. There
are three data submission methods available, as discussed further
elsewhere in this preamble, and entering data via webform would be the
least efficient method for a company with many establishments.
    After consideration of these comments, OSHA has decided to retain
the proposed data submission deadline in the final rule and require
submission of the previous calendar year's data by March 2 of each
year.

G. Additional Comments Which Concern More Than One Section of the
Proposal

1. General Comments
    There were several comments asking OSHA to add data submission
requirements for other types of establishments. For example, Worksafe
recommended adding a requirement for companies with five or more
establishments to collect and submit part 1904 occupational injury and
illness data for those work locations and establishments (Docket ID
0063). Similarly, the National Nurses Union recommended adding a
submission requirement for companies with 500 or more employees across
multiple establishments (Docket ID 0064). Neither of these
recommendations is being incorporated into the final rule. Data
submission requirements for multi-establishment companies, regardless
of the number of establishments or size of the employer, were not
included in any proposed regulatory provision or alternative in the
NPRM; nor was the topic otherwise addressed by OSHA as part of the
proposed rule. As such, OSHA does not believe that a requirement for
multi-establishment employers to submit data to OSHA would be a logical
outgrowth of the proposal. (Although OSHA believes that these
recommendations are out of the scope of the proposal, the agency notes
that it proposed similar ideas as Alternative I in the 2016 rulemaking
and rejected that Alternative, in part, due to practicality concerns.
OSHA does not believe that those concerns have been obviated in the
years since the issuance of the 2016 final rule.)
    Similarly, there was a comment expressing concern that the rule
will not capture data for workers classified as independent
contractors, and ``encourag[ing] OSHA to study the benefits of data
collection for all workers, regardless of classification, including
those who may be improperly designated as independent contractors''
(Docket ID 0045). As interested parties are generally aware, the
Occupational Safety and Health (OSH) Act of 1970 only applies to
``employment'' (see 29 U.S.C. 653(a)). Businesses do not meet the
definition of the term ``employer'' in Section 3(5) of the OSH Act, 29
U.S.C. 652(5), unless they have employees. Similarly, individuals are
not considered ``employees'' under the OSH Act unless they are employed
by an employer (29 U.S.C. 652(6)). Thus, independent contractors are
not covered under the OSH Act. The agency understands that, at times,
employees are misclassified as independent contractors and are
consequently not receiving the protections that they should. OSHA has
other initiatives to address that important issue. However, the agency
finds that it is beyond the scope of this rule, which only covers
employees.
    There were also comments asking OSHA to expand the data requested
on OSHA's recordkeeping forms. For example, the National Safety Council
commented that OSHA should collect more demographic data, such as race
or ethnic origin, and that OSHA should include a method to identify and
collect basic information on musculoskeletal disorders (MSDs) (Docket
ID 0041). Similarly, Unidos US, Farmworker Justice, and Texas RioGrande
Legal Aid commented that OSHA should require employers to report race
and ethnicity data in case-specific reports and publish the data
alongside the other case-specific information (Docket ID 0078).
ConnectiCOSH proposed a requirement for employers to document when
workers have complained about retaliation (Docket ID 0069).
    Also related to expanding the data requested on the OSHA
recordkeeping forms, the Phylmar Regulatory Roundtable (PRR) commented
that instead of requesting information from the Forms 300 and 301, OSHA
should revise the Form 300A to include more useful identifiers. For
example, including ``heat'' as a type of illness,

and ``indoor,'' ``outdoor,'' ``office,'' ``distribution facility,'' and
``off-site'' for a field titled ``location'' would give OSHA more
information without identifying employees (Docket ID 0094). More
generally, the Employers E-Recordkeeping Coalition commented that OSHA
should create a committee or task an existing committee to explore
changes to injury and illness recordkeeping, including to consider
adopting ASTM E2920-14 (Standard Guide for Recording Occupational
Injuries and Illnesses), an international standard that would allow
data comparisons with other countries (Docket ID 0087).
    These recommendations to expand or change recordkeeping forms, or
to explore broader changes to injury and illness recordkeeping, such as
adopting an ASTM standard, were not included in any proposed regulatory
provision or alternative in the NPRM, nor were these topics otherwise
addressed by OSHA as part of the proposed rule. As such, these topics
are not within the scope of this rulemaking. Similarly, comments
raising issues with OSHA's recording criteria or other parts of part
1904 that are not at issue in this rulemaking (e.g., Docket ID 0017
(related to the recordability of COVID-19 cases)) are out of scope of
this rulemaking.
    The National Safety Council (NSC) provided a comment about OSHA
enforcement of the reporting requirements: ``First, OSHA must take
steps to improve reporting compliance. The Department of Labor Office
of Inspector General report provides some key recommendations for OSHA
to improve reporting: 1. Develop guidance and train staff on
identifying underreporting, 2. Issue citations for all late reporters,
3. Clarify guidance on documenting essential decisions, collecting
evidence to demonstrate employers corrected all identified hazards, and
monitoring employer conducted investigations, and 4. Conduct
inspections on all Category 1 incidents. These are key recommendations
to improve the original data. Additionally, the National Academy of
Sciences (NAS) produced a 2018 study on OSHA data collections
acknowledging the limitations of the current data system(s) and made
several recommendations for improving and supplementing the OSHA data
that should also guide OSHA actions.'' (Docket ID 0041; see also Docket
ID 0080 (recommending OSHA evaluate procedures for compliance and
enforcement)).
    With respect to the Office of the Inspector General's 2018 Report,
OSHA Needs to Improve the Guidance for its Fatality and Severe Injury
Reporting Program to Better Protect Workers, OSHA agreed that better
case documentation can help promote consistency in the issuance of
citations, as well as the determination of whether to conduct an
inspection or a rapid response investigation. However, OSHA was
concerned that the OIG's report suggested that the burden to ensure
reporting falls on the agency when the OSH Act clearly states that it
is the employer's responsibility to comply with the standards under
Section 5(a)(2). The agency encourages employers to comply with illness
and injury reporting requirements through a variety of enforcement,
outreach, and compliance assistance tools. OSHA's full response to the
OIG's report can be found in Appendix B of that report at https://www.oig.dol.gov/public/reports/oa/2018/02-18-203-10-105.pdf.
    With respect to the National Academies of Science, Engineering, and
Medicine (NAS) report, A Smarter National Surveillance System for
Occupational Safety and Health in the 21st Century, OSHA concludes the
final rule is responsive to that report (see OSHA-2021-0006-0097). This
NAS report was the result of a joint request from NIOSH, BLS, and OSHA
to NAS, asking NAS to conduct a study in response to the need for a
more coordinated, cost-effective set of approaches for occupational
safety and health surveillance in the United States. The NAS report
suggested that electronic collection of Form 300 and 301 data would
allow OSHA to focus its interventions and prevention efforts on
hazardous industries, workplaces, exposures, and high-risk groups.
Additionally, the NAS report made recommendations on ways the public
data could be utilized by employers, researchers, government agencies,
and workers (Docket ID 0061). Further, according to the report,
collecting Form 300 and 301 data electronically would also allow for
expanding and targeting outreach to employers to improve hazard
identification and prevention efforts, and would give OSHA the
opportunity to advise employers on how their rates of injury and
illness compare with the rest of their industry. OSHA agrees with these
assessments regarding the value of electronically collecting Form 300
and 301 data, as reflected by the final rule.
    PRR commented, ``to ensure the Agency remains fair, balanced, and
trusted, any targeting for enforcement that results from submission of
Forms 300, 301 and 300A should be based on a systematic approach that
is standardized and impacts all industries in [a]ppendix B subpart E,
equally'' (Docket ID 0094). In response, OSHA agrees that it should
take a systematic approach to enforcement targeting based on the data
it collects from these recordkeeping forms. As addressed elsewhere in
this preamble (e.g., Section III.B.4 of this Summary and Explanation),
OSHA's systematic approach to enforcement in site-specific targeting
using data collected from the Form 300A is illustrated by OSHA's
directive on Site-Specific Targeting (SST) (CPL 02-01-064, issued on
February 7, 2023, https://www.osha.gov/enforcement/directives/cpl-02-01-064). In this directive, OSHA states that it will generate
inspection lists of: (1) establishments with elevated Days Away,
Restricted, or Transferred (DART) rates for CY 2021; (2) establishments
with upward trending rates for the range of CY 2019-2021; (3)
establishments that did not provide the required 2021 Form 300A data to
OSHA; and (4) establishments with low DART rates in CY 2021 to verify
data accuracy and quality control. OSHA's Office of Statistical
Analysis provides each Area Office (AO) with access to software and
databases that include the establishments on the Inspection List. AOs
must generate inspection cycles using the SST software that randomly
selects the establishments and shall determine inspection cycle size
(i.e., 5 to 50 establishments) based on available resources and the
geographic range of the office. Once initiated, the entire cycle must
be completed. Within a cycle, the AO may schedule and inspect the
selected establishments in any order that makes efficient use of
available resources.
    As indicated by the content of the directive, while OSHA does take
a systematic approach to enforcement targeting, OSHA does not agree
that any targeting for enforcement resulting from submission of the
data from Forms 300, 301, and 300A should necessarily impact all
industries in appendix B subpart E equally. If reported data were to
show a particular industry had a very high rate of occupational
illnesses or injuries, enforcement targeting that particular industry
would be appropriate. The final rule provides more accurate and
detailed information that will be used to protect workplace health and
safety.
    Reps. Foxx and Keller commented, ``DOL further revealed its
intention to reward Big Labor in its extension of the proposed rule's
comment period, citing a single request from the AFL-CIO, despite the
fact that it has routinely denied similar requests from business
stakeholders and members of Congress''

(Docket ID 0062). In response, OSHA notes that the agency received two
requests for extension of the comment period: from the AFL-CIO in a
letter dated May 5, 2022 (Docket ID 0027), and from the Employers E-
Recordkeeping Coalition in a letter dated May 20, 2022 (Docket ID
0032). OSHA determined that it would be reasonable to extend the
comment period and offered the same additional 30 days to everyone (see
87 FR 31793-4 (May 25, 2022)).
2. Misunderstandings About Scope
    Some commenters expressed concern that the proposal would expand
the number of employers required to submit data. The Chamber of
Commerce commented that the lists of designated industries in
Appendices A and B ``are long and not that limiting,'' and the National
Propane Gas Association commented, ``[a]ccording to the proposed
revisions to [a]ppendix A and proposed creation of [a]ppendix B, the
NPRM would expand reporting requirements to more establishments within
the propane industry'' (Docket IDs 0050, 0088). The National Propane
Gas Association also expressed disagreement with ``the proposed
creation of [a]ppendix B to the extent that it includes all the
industries already listed in [a]ppendix A'' (Docket ID 0050). In
response, OSHA notes that appendix B does not include all the
industries listed in appendix A; rather, appendix B is a subset of
appendix A. Additionally, as explained in the NPRM and elsewhere in
this preamble, all of the establishments that will be required to
submit information to OSHA under the new requirements in this final
rule were already required to submit information to OSHA under the
previous requirements, so it is not the case that this rule expands the
number of establishments required to report.
    The National Propane Gas Association also recommended that ``OSHA
retain the current scope and applicability of [Sec.  ]1904.41(a)(1) to
apply to employers with 250 or more employees within the industries
identified in [a]ppendix A,'' rather than ``expanding'' the requirement
to ``more employers and more establishments'' (Docket ID 0050). As
explained in the NPRM and the preamble to this final rule, OSHA did not
propose to expand the scope of [Sec.  ]1904.41(a)(1). Rather, the
agency explicitly stated that the proposal ``would not impose any new
requirements on establishments to electronically submit information
from their Form 300A,'' however, ``proposed Sec.  1904.41(a) would
remove the electronic submission requirement for certain establishments
with 250 or more employees.'' Accordingly, the commenter's concerns are
misplaced.
    The National Propane Gas Association also stated that OSHA is
proposing to increase ``the frequency of submissions'' of injury and
illness reports (Docket ID 0050). OSHA did not propose to increase the
frequency of submissions of injury and illness data; rather, employers
required to submit such data will continue to be required to do so once
a year, as under the current requirements.
3. Diversion of Resources
    In the 2019 final rule, OSHA stated that rescinding the information
submission requirements would allow employers to devote more of their
resources towards compliance with safety and health standards (84 FR
394). Similarly, several commenters to the current NPRM also asserted
that the proposed rule would be counterproductive to the goal of
improving safety and health because complying with the rule would
divert resources that would otherwise be devoted to other worker safety
and health efforts (e.g., Docket IDs 0060, 0062, 0070, 0088). In most
cases these assertions were unsupported (e.g., Docket ID 0062 (simply
asserting that compliance with the rule would divert employer resources
from workplace safety and health initiatives without further explaining
how it would do so)).
    A few commenters, however, did make more concrete statements that
might relate to this issue. For example, the Chamber of Commerce, in
challenging OSHA's economic analysis, claimed that the proposal would
require safety department personnel to spend time on preparation of the
data for submission, presumably at the cost of spending time improving
safety (Docket ID 0088). But that diversion, if it occurs, would be
required by the recordkeeping rule itself, not by the requirement to
submit records. Employers have always been required to keep accurate
records. To the extent that the argument is that employers will take
greater care with records to be submitted to OSHA and eventually
published, that is not a result of the rule so much as it is a result
of employers not having taken adequate care previously. Similarly, the
need to ensure that information that could compromise workers' privacy
is not submitted inappropriately (see, e.g., Docket ID 0081) should be
obviated by entering the information carefully in the first place (see,
e.g., the instructions on Form 301: ``Re fields 14 to 17: Please do not
include any personally identifiable information (PII) pertaining to
worker(s) involved in the incident (e.g., no names, phone numbers, or
Social Security numbers'')).
4. Lagging v. Leading Indicators
    OSHA also received several comments which focused on OSHA's
recordkeeping system's use of lagging, rather than leading indicators.
Broadly speaking, leading indicators are proactive, preventive, and
predictive measures that provide information about the effective
performance of an employer's safety and health activities. They measure
events leading up to injuries, illnesses, and other incidents and
reveal potential problems in an employer's safety and health program.
In contrast, lagging indicators measure the occurrence and frequency of
events that occurred in the past, such as the number or rate of
injuries, illnesses, and fatalities (see https://www.osha.gov/sites/default/files/OSHA_Leading_Indicators.pdf).
    On the issue of lagging versus leading indicators, the American
Society of Safety Professionals (ASSP) commented, ``ASSP advocates a