confidential commercial information. See, 350 F. Supp. 2d 394 at 403.
The court held that competitive harm would not result from OSHA's
release of lost workday injury and illness rates of individual
establishments, from which the number of employee hours worked could
theoretically be derived. Id. at 402-403. Additionally, the court
explained that most employers do not view injury and illness data as
confidential. Id. at 403.
    As noted by commenters, during the New York Times litigation, the
Secretary argued that the injury and illness rates requested in the
FOIA suit could constitute commercial information under Exemption 4 of
FOIA, 5 U.S.C. 552(b)(4). However, in the years since this decision,
the Secretary has reconsidered his position. Since 2004, in response to
FOIA requests, it has been OSHA's policy to release information from
the Form 300A on the annual average number of employees and the total
hours worked by all employees during the past year at an establishment.
Thus, there was a statement in the preamble to the proposed rule
explaining that the Secretary no longer believes the injury and illness
information entered on the OSHA recordkeeping forms constitutes
confidential commercial information. Accordingly, since the New York
Times decision in 2004, OSHA has had a consistent policy concerning the
release of information on the OSHA Form 300A.
    Sarah Wilensky commented that OSHA is required under FOIA to
disclose much of the data it accesses from an inspection or visit to a
covered establishment, and that this obligation would not change if
OSHA receives information as part of this rulemaking. (Ex. 1382). This
commenter also suggested that, similar to other information in OSHA's
possession, employers' commercially valuable information submitted as
part of this rulemaking should be subject to exemption for trade
secrets under FOIA (Ex. 1382). Another commenter, MIT Laboratories,
commented that FOIA is not of much use as a standard to protect privacy
in this rule (Ex. 1207).
    OSHA agrees with the commenters who suggested that recordkeeping
information collected as part of this final rule should be posted on
the Web site in accordance with FOIA. As discussed in the preamble to
the proposed rule, the publication of specific data elements will in
part be restricted by the provisions of FOIA. [78 FR 67259]. Currently,
when OSHA receives a FOIA request for employer recordkeeping forms, the
Agency releases all data fields on the OSHA 300A annual summary,
including the annual average number of employees and total hours worked
by employees during the year. With respect to the OSHA 300 Log, because
OSHA currently obtains part 1904 records during onsite inspections, the
Agency applies Exemption 7(c) of FOIA to withhold from disclosure
information in Column B (the employee's name). (Note that OSHA will not
collect or publish Column B under this final rule.) FOIA Exemption 7(c)
provides protection for personal information in law enforcement
records. [5 U.S.C. 552(b)(7)(c)]. OSHA currently uses Exemption 7(c) to
withhold personal information included in Column B as well as other
columns of the 300 Log. For example, OSHA would not disclose the
information in Column C (Job Title), if such information could be used
to identify the injured or ill employee.
    Similarly, OSHA uses FOIA exemptions to withhold from disclosure
Fields 1 through 9 on the OSHA 301 Incident Report. Fields 1 through 9
(the left side of the 301) includes personal information about the
injured or ill employee as well as the physician or other health care
professional. (Note that under this final rule, OSHA will not collect
or publish Field 1 (employee name), Field 2 (employee address), Field 6
(name of treating physician or health care provider), or Field 7 (name
and address of non-workplace treating facility). All fields on the
right side of the 301 (Fields 10 through 18) are generally released by
OSHA in response to a FOIA request.
    OSHA generally uses FOIA Exemption 7(c) to withhold from disclosure
any personally identifiable information included anywhere on the three
OSHA recordkeeping forms. For example, although information in Field 15
of the 301 incident report (Tell us how the injury occurred) is
generally released in response to a FOIA request, if that data field
includes any personally-identifiable information, such as a name or
Social Security number, OSHA will apply Exemption 6 or 7(c) and not
release that information. FOIA Exemption 6 protects information about
individuals in ``personnel and medical and similar files'' when the
disclosure of such information ``would constitute a clearly unwarranted
invasion of personal privacy.'' [5 U.S.C. 552(b)(6)].
    Additionally, OSHA currently uses FOIA Exemption 4 to withhold from
disclosure information on the three recordkeeping forms regarding trade
secrets or privileged or confidential commercial or financial
information. [5 U.S.C. 552(b)(4)]. However, it is OSHA's experience
that the inclusion of trade

secret information on recordkeeping forms is extremely rare. OSHA's
recordkeeping regulation does not require employers to record
information about, or provide detailed descriptions of, specific brands
or processes that could be considered confidential commercial
information. In any event, employers will have an opportunity to inform
OSHA that submitted data may contain PII or confidential commercial
information.
    Again, OSHA wishes to emphasize that it will post injury and
illness recordkeeping information collected by this final rule
consistent with FOIA.
Privacy Act
    Several commenters raised concerns about a possible conflict
between the proposed rule and the Privacy Act of 1974, 5 U.S.C. 552a.
(Exs. 1113, 1342, 1359, 1370, 1393). The American Farm Bureau
Federation (AFBF) commented, ``OSHA must consider the privacy interests
of farmers' names and home contact information and is obligated under
federal law to do a review under the Privacy Act'' (Ex. 1113). The
Society of the Plastics Industry, Inc. (SPI) commented, ``[G]iven the
nature of the information that may be filed in the Section 1904 forms,
OSHA's obligation to redact any personally identifiable medical
information from those forms, and the fact that it will be infeasible
to OSHA to meet that obligation, OSHA is precluded by the Federal
Privacy Act from issuing the rule'' (Ex. 1342). Ashok Chandran made a
similar comment (Ex. 1393).
    In response, OSHA notes that the Privacy Act regulates the
collection, maintenance, use, and dissemination of personal
identifiable information by federal agencies. Section 552a(e)(4) of the
Privacy Act requires that all federal agencies publish in the Federal
Register a notice of the existence and character of their systems of
records. The Privacy Act permits the disclosure of information about
individuals without their consent pursuant to a published routine use
where the information will be used for a purpose that is comparable to
the purpose for which the information was originally collected.
    The Privacy Act only applies to records that are located in a
``system of records.'' As defined in the Privacy Act, a system of
records is ``a group of any records under the control of any agency
from which information is retrieved by the name of the individual or by
some identifying number, symbol, or other identifying particular
assigned to the individual.'' See, 5 U.S.C. 552a(a)(5). Because OSHA
injury and illness records are retrieved neither by the name of an
individual, nor by some other personal identifier, the Privacy Act does
not apply to OSHA injury and illness recordkeeping records. As a
result, the Privacy Act does not prevent OSHA from posting
recordkeeping data on a publicly-accessible Web site. However, OSHA
again wishes to emphasize that, consistent with FOIA, the Agency does
not intend to post personally identifiable information on the Web site.
Trade Secrets Act
    The Coalition for Workplace Safety (CWS) commented that publication
of information contained in the 300, 300A, and 301 forms would be a
violation of 18 U.S.C. 1905--Disclosure of confidential information
generally, which makes it a criminal act for government officials to
disclose information concerning or relating to the trade secrets,
processes, operations, style of work, or apparatus, or to the identity,
confidential statistical data, amount or source of any income, profits,
loses, or expenditures of any person, firm, partnership, corporation,
or association (Ex. 1411).
    OSHA notes that the Trade Secrets Act, 18 U.S.C. 1905, states:
``Whoever, being an officer or employee of the United States, . . .
publishes, divulges, discloses, or makes known in any manner or to any
extent not authorized by law any information coming to him in the
course of his employment or official duties . . . or record made to or
filed with, such department or agency or officer or employee thereof,
which information concerns or relates to the trade secrets, processes,
operations, style of work, or apparatus, or to the identity,
confidential status, amount or source of any income, profits, losses,
or expenditures of any person, firm, partnership, corporation, or
association; . . . shall be fined under this title, or imprisoned not
more than one year, or both; and shall be removed from office or
employment.''
    As discussed elsewhere in this document, the information required
to be submitted under the final rule is not of a kind that would
include confidential commercial information. The information is limited
to the number and nature of recordable injuries or illnesses
experienced by employees at particular establishments, and the data
necessary to calculate injury/illness rates, i.e., the number of
employees and the hours worked at an establishment. Details about a
company's products or production processes are generally not included
on the OSHA recordkeeping forms, nor do the forms request financial
information. The basic employee safety and health data required to be
recorded do not involve trade secrets, and public availability of such
information would not enable a competitor to obtain a competitive
advantage. Accordingly, the posting of injury and illness recordkeeping
data online by OSHA is not a release of confidential commercial
information, and therefore is not a violation of the Trade Secrets Act.
In some limited circumstances, the information recorded in compliance
with part 1904 may contain commercial or financial information. OSHA
considers such information to be potentially confidential, and, as
appropriate, follows the procedures set forth in 29 CFR 70.26, which
require OSHA to contact the employer which submitted the information
prior to any potential release under FOIA Exemption 4, 5 U.S.C.
552(b)(4). Additionally, Section 15 of the OSH Act protects the
confidentiality of trade secrets. 29 U.S.C. 664. Under this final rule,
it will be OSHA policy not to post confidential commercial or financial
information on the publicly available Web site. The case description
information solicited in questions 14 through 17 on OSHA's Form 301 is
broad in nature and does not call for detailed descriptions that
include personal or commercially confidential information. The examples
provided on the form for fields 14 and 15 include ``spraying chlorine
from hand sprayer'' and ``worker was sprayed with chlorine when gasket
broke during replacement''. OSHA will add additional guidance to these
instructions to inform employers not to include personally identifiable
information (PII) or confidential business information (CBI) within
these fields.
Confidential Commercial Information
    Multiple commenters stated that the proposed rule would require
employers to submit proprietary and confidential business data to OSHA
(Exs. 0057, 0160, 0171, 0179, 0205, 0218, 0224, 0240, 0251, 0252, 0257,
0258, 1084, 1090, 1091, 1092, 1093, 1111, 1112, 1113, 1116, 1123, 1192,
1193, 1195, 1196, 1197, 1198, 1199, 1205, 1209, 1214, 1216, 1217, 1218,
1219, 1225, 1272, 1275, 1276, 1279, 1318, 1323, 1326, 1328, 1332, 1333,
1334, 1336, 1338, 1343, 1349, 1356, 1359, 1366, 1367, 1370, 1372, 1386,
1392, 1394, 1396, 1397, 1399, 1408, 1411, 1415, 1426, 1427, 1430). In
addition to the comments addressed above regarding the average number
of employees and total hours worked by employees, commenters expressed
concern about the confidentiality of other data on the

OSHA recordkeeping forms. IPC-Association Connecting Electronics
Industries made a specific comment that ``the requirement in column F
[OSHA 300 Log] to disclose the ``object/substance that directly injured
or made person ill'' creates a mechanism that could lead to disclosure
of intellectual property to competitors, both foreign and domestic,
especially in research and development facilities'' (Ex. 1334). Darren
Snikrep commented, ``The plan to provide public access to the data
means a loss of privacy for employers and may adversely affect an
employer's ability to obtain work'' (Ex. 0057). Similarly, the
Louisiana Farm Bureau commented, ``The proposed rule states that the
company's executive's signature, title, telephone number, the
establishment's name and street address, industry description, SIC or
NAICS code and employment information including annual average number
of employees, total hours worked by all employees will all be non-
protected information that is readily available to the public via the
OSHA data portal and downloadable to anyone. This invites targeting of
employers that may have no basis on actual workplace safety. We
strongly feel that an employer's information identified with OSHA
reporting should be kept private, the same as the privacy afforded
workers under the proposed OSHA rule.'' (Ex. 1386).
    On the other hand, the Associated General Contractors of Michigan
commented that recordkeeping data are not proprietary and confidential
business information: ``Companies with over 20 employees during the
reporting year must electronically report annually using the OSHA 300A
Summary Form. This type of reporting would not be a burden on employers
and would avoid `privacy issues', but would provide enough information
for a more effective enforcement effort'' (Ex. 0250). J. Wilson made a
similar comment (Ex. 0238).
    In response, OSHA again wishes to emphasize that it is not the
Agency's intention to post proprietary or confidential commercial
information on the publicly-accessible Web site. The purpose for the
publication of recordkeeping data under this final rule is to
disseminate information about occupational injuries and illnesses. OSHA
agrees with commenters who stated that recordkeeping data generally do
not include proprietary or commercial business information.
Specifically, information on the 300A annual summary, such as the
establishment's name, business address, and NAICS code, are already
publicly available.
    As discussed above, OSHA is prohibited from releasing proprietary
or confidential commercial information under FOIA Exemption 4. The term
``confidential commercial information'' means ``records provided to the
government by a submitter that arguably contain material exempt from
release under Exemption 4 of the Freedom of Information Act, 5 U.S.C.
552(b)(4), because its disclosure could reasonably be expected to cause
substantial competitive harm.'' See, Executive Order 12600,
Predisclosure notification procedures for confidential commercial
information. [June 23, 1987]. Additionally, because recordkeeping data
will be posted on a publicly-accessible Web site, when recording
injuries and illnesses at their establishment, OSHA encourages
employers not to enter confidential commercial information on the
recordkeeping forms.
Submission of Personally Identifiable Information and Employee Privacy
    OSHA received several comments in support of electronic submission
of part 1904 data with personally identifiable information (PII) (Exs.
0208, 1106, 1211, 1350, 1354, 1381, 1382, 1387, 1395). Many commenters
commented that federal and state agencies require electronic submission
of health and safety data without the misuse of personal identifiers
(Exs. 0208, 1106, 1211, 1350, 1354, 1381, 1382, 1387, 1395). For
example, the Department of Workplace Standards, Kentucky Labor Cabinet
commented that they do ``not foresee misuse of the information; other
agencies require electronic submission of similar data and have
accomplished the requirement without misuse of personal identifiers''
(Ex. 0208). Sarah Wilensky, the Service Employees International Union
(SEIU) and the California Department of Industrial Relations (DIR),
Office of the Director provided similar comments (Exs. 1382, 1387,
1395).
    The American Public Health Association (APHA) commented that OSHA's
sister agency, the Mine Safety and Health Administration (MSHA), ``has
collected and posted on its Web site far more detailed and
comprehensive information on work-place injuries than is being proposed
by OSHA'' (Ex. 1354). The AFL-CIO and the International Brotherhood of
Teamsters provided similar comments (Exs. 1350, 1381).
    However, there were also many comments opposing employer submission
of certain data from the OSHA Form 300 and 301. Thoron Bennett
commented that OSHA should not ``collect [employee] names from OSHA 300
or 301 logs'' (Ex. 0035). The International Association of Drilling
Contractors (IADC) provided a similar comment (Ex. 1199).
    The Phylmar Regulatory Roundtable commented that employers should
``not be required to submit information including names, dates of
birth, addresses, Social Security Number, etc. . . . Requiring
electronic submissions containing PII to OSHA unnecessarily creates an
opportunity for private information to accidentally become public''
(Ex. 1110). The U.S. Poultry & Egg Association, Huntington Ingalls
Industries--Newport News Shipbuilding, and Melinda Ward provided
similar comments (Exs. 1109, 1196, 1223). Huntington Ingalls
Industries--Newport News Shipbuilding also commented that employees
could ``have the ability to opt out of having their personally
identifiable information provided to OSHA'' (Ex. 1196).
    MIT Laboratories commented that ``OSHA should consider developing a
toolkit or educational materials to help employers identify information
that poses a re-identification risk in their workplace records,
especially if OSHA expect [sic] that its recordkeeping forms will
continue to elicit textual descriptions of injuries and illnesses in
the future. Such materials could help mitigate the risk that employers
will include identifying information in the form'' (Ex. 1207).
    OSHA partially agrees with commenters who stated that employers
should submit their data to OSHA with PII about employees included on
the 300 and 301 forms. In many cases, PII entered on the OSHA
recordkeeping forms includes important information that the Agency uses
for activities designed to increase workplace safety and health and
prevent occupational injuries and illnesses, including outreach,
compliance assistance, enforcement, and research. As discussed
elsewhere in this preamble, other government agencies are able to
handle vary large amounts of PII, and OSHA will follow accepted
procedures and protocols to prevent the release of such information.
    However, for some data fields, OSHA does not consider the data from
these fields necessary to meet the various stated goals of the data
collection. These fields primarily exist to help people doing incident
investigations at the establishment. Collecting data from these fields
would not add to OSHA's or any other user's ability to identify
establishments with specific hazards or elevated injury and illness
rates.

Therefore, OSHA has decided in this final rule to exclude from the
submittal requirements several fields on the OSHA Forms 300 and 301 to
minimize any potential release or unauthorized access to these data.
The data elements are:
     Log of Work-Related Injuries and Illnesses (OSHA Form
300): Employee name (column B).
     Injury and Illness Incident Report (OSHA Form 301):
Employee name (field 1), employee address (field 2), name of physician
or other health care professional (field 6), facility name and address
if treatment was given away from the worksite (field 7).
    Additionally, several commenters expressed concern about the
potential public release of personal information about employees from
the OSHA recordkeeping forms. (Exs. 0171, 0189, 0209, 0210, 0215, 0250,
0253, 1091, 1113, 1199, 1201, 1206, 1207, 1276, 1329, 1359, 1370, 1386,
1408, 1410). These commenters stated that the OSHA recordkeeping forms
contain private and highly confidential employee information, including
medical information. Some commenters also raised concerns about
previous OSHA rulemakings. For example, the National Association of
Home Builders (NAHB) commented, ``OSHA has made specific findings
related to privacy interest of employees and the utility of making
certain recordkeeping forms public. Having done so, OSHA must explain
why it is deviating from its past practice and positions . . . OSHA is
required to comply with the Administrative Procedure Act and provide a
reasoned explanation for this change of policy, starting by recognizing
past policy and a justification for the change. OSHA has not done so
here and failure to do so here makes this change arbitrary and
capricious'' (Ex. 1408).
    A few commenters suggested that OSHA should balance the public
interest of disclosure with the employee's right to privacy (Exs. 1279,
1408, 1411). NAM commented:

    In the Federal Register publishing the final rule to the Part
1904 revisions, OSHA acknowledged the existence of a U.S.
Constitutional right of privacy in personal information. In doing
so, OSHA cited to various U.S. Supreme Court and federal circuit
court decisions that have suggested that such a right exists. 66 FR
at 6054. See, e.g., Whalen v. Roe, 429 U.S. 588 (1977), Nixon v.
Adm'r of General Services, 433 U.S. 425 (1977), Paul v. Verniero,
170 F.3d 396, 402 (3d Cir. 1999), Norman-Bloodsay v. Lawrence
Berkeley Lab., 135 F.3d 1260, 1269 (9th Cir. 1998).
    Further, OSHA recognized that ``information about the state of a
person's health, including his or her medical treatment,
prescription drug use, HIV status and related matters is entitled to
privacy protection'' and that ``there are few matters that are quite
so personal as the status of one's health, and few matters the
dissemination of which one would prefer to maintain greater control
over.'' 66 FR at 6054. OSHA went on to acknowledge that ``[t]he
right to privacy is not limited to medical records. Other types of
records containing medical information are also covered.'' Id. at
6055. (citations omitted).
    After recognizing that a right of privacy exists and is entitled
to protection, OSHA applied a balancing test--weighing the
individual's interest in confidentiality against the public interest
in disclosure to employees and representatives. Id. After lengthy
analysis, OSHA concluded that allowing employees access to
information contained on the Form 301 served a legitimate public
interest--that is helping employees to protect themselves from
future injuries or illness.
    The proposed regulation discussed in these comments, ignores
this right of privacy and abandons any type of balancing test. OSHA
does not allege any reasons that making such information available
to the public outweighs the privacy interests of the individual
employees. Merely redacting an employee's name does not provide
sufficient protection from the release, even inadvertently, of other
personally identifiable information or medical information that
employees maintain a privacy interest in (Ex. 1279).

    Other commenters raised a specific concern about the release of
personal information in the agricultural industry, where many families
live on farms where they work (Exs. 1113, 1359, 1370, 1386). Commenters
stated that, under the proposed rule, a publicly-searchable database
will include information about farmers' names, their home address, as
well as other home contact information. These commenters also
emphasized that the proposed rule would lead to serious security and
privacy concerns that OSHA has not addressed.
    Additionally, the American Health Care Association/National Center
for Assisted Living (AHCA/NCAL) asked whether the proposed rule would
compromise the privacy of patients in the health care industry. This
commenter stated that they assist and care for people and that this
involves day-to-day interactions with patients, residents, and their
families--``who expect that their privacy will be protected and that
personal information about them or their conditions will not be
broadcast on OSHA's Web page'' (Ex. 1194).
    In response, OSHA disagrees with commenters who suggested that the
Agency is deviating from its past practice regarding recordkeeping
information and the privacy interest of employees. In the preamble to
the 2001 final rule revising the part 1904 recordkeeping regulation,
OSHA explained that it has historically recognized that the OSHA 300
Log and 301 Incident Report may contain information that an individual
would wish to remain confidential. [66 FR 6055]. OSHA also acknowledged
that although the entries on the 300 Log are typically brief, they may
contain medical information, including diagnosis of specific illnesses.
Id. However, OSHA concluded that disclosure of the Log and Incident
Report to employees, former employees, and their representatives
benefits these employees generally by increasing their awareness and
understanding of the safety and health hazards in the workplace. Thus,
current Sec.  1904.35, Access to records, permits employees, former
employees, and employee representatives access to information on the
OSHA recordkeeping forms. As the 2001 preamble makes clear, OSHA
authorized this right of access after balancing the privacy rights of
individuals with the public interest for disclosure. In addition, the
2001 preamble states that OSHA does not have the statutory authority to
prevent the disclosure of private information once the records are in
the possession of employees, former employees and their
representatives. [66 FR 5056].
    OSHA acknowledges commenters' concerns about the potential posting
of private employee information on a publicly-accessible Web site.
However, the posting or disclosure of private or confidential
information has never been the intent of this rulemaking. OSHA believes
it has effective safeguards in place to prevent the disclosure of
personal or confidential information contained in the recordkeeping
forms and submitted to OSHA. Specifically, as discussed above, OSHA
will neither collect nor publish the following information:
     Log of Work-Related Injuries and Illnesses (OSHA Form
300): Employee name (column B).
     Injury and Illness Incident Report (OSHA Form 301):
Employee name (field 1), employee address (field 2), name of physician
or other health care professional (field 6), facility name and address
if treatment was given away from the worksite (field 7).
    Also, OSHA's recordkeeping regulation at Sec.  1904.29(b)(10)
prohibits the release of employees' names and personal identifiers
related to ``privacy concern cases.'' OSHA will also withhold from
publication all of the information on the left-hand side of the OSHA
301 Incident Report that is submitted to OSHA (employee date of birth
(Field 3), employee date hired

(Field 4), and employee gender (Field 5)). All of the information on
the right hand side (Fields 10 through 18) will generally be posted on
the Web site (after it is scrubbed for PII). Finally, because the OSHA
300A Annual Summary does not contain any personally-identifiable
information, all of the fields on the OSHA 300A Annual Summary will be
posted.
    OSHA also acknowledges that certain data fields on the OSHA 300 and
301 may contain personally-identifiable information. It has been OSHA's
experience that information entered in Column F of the 300 Log may
contain personally-identifiable information. For example, when
describing an injury or illness, employers sometimes include names of
employees. As a result, OSHA plans to review the information submitted
by employers for personally-identifiable information. As part of this
review, the Agency will use software that will search for, and de-
identify, personally identifiable information before the submitted data
are posted.
    In response to commenters who expressed concern about the posting
of personal information from family farms, OSHA notes that it is
extremely unlikely that personal information from family farms will be
collected or posted under this final rule. Section 1904.41(a)(1) of the
final rule requires only establishments with 250 or more employees to
submit information from the three OSHA recordkeeping forms. In
addition, Sec.  1904.41(a)(2) of the final rule makes clear that only
establishments in designated industries with 20 more employees, but
fewer than 250 employees, must submit information from the OSHA 300A
annual summary. As a result, in most cases, family farms will not be
required to submit injury and illness recordkeeping data to OSHA under
this final rule.
    As discussed elsewhere in this preamble, under Sec.  1904.41(a)(3)
of the final rule, some employers with 19 or fewer employees (including
small farms) may be required to submit their injury and illness
recordkeeping data to OSHA. Farm address and contact information is
already commercially available, and the information can be purchased
from such companies as D&B and Experian. Also, address and contact
information for small farms that have been inspected by OSHA is already
on the Agency's public Web site.
    A number of commenters suggested that, even though OSHA intended to
delete employee names and other identifying information, enough
information would remain in the published data for the public to
identify the injured or ill employee (Exs. 0189, 0211, 0218, 0224,
0240, 0241, 0242, 0252, 0253, 0258, 1084, 1090, 1092, 1093, 1109, 1113,
1122, 1123, 1190, 1192, 1194, 1197, 1198, 1199, 1200, 1205, 1206, 1207,
1209, 1214, 1217, 1218, 1219, 1223, 1272, 1273, 1275, 1276, 1279, 1318,
1321, 1322, 1323, 1326, 1327, 1331, 1333, 1334, 1336, 1338, 1342, 1343,
1348, 1349, 1353, 1355, 1356, 1359, 1360, 1370, 1372, 1376, 1378, 1386,
1389, 1392, 1394, 1396, 1397, 1399, 1402, 1408, 1410, 1411, 1412, 1415,
1417, 1427, 1430). Some of these commenters were specifically concerned
about the anonymity of injured or ill employees working at small
establishments located in small communities. For example, commenters
noted that information such as type of injury or illness, date and
location of injury or illness, type of body part injured, treatment,
and job title, could be used to identify the employee.
    In response, OSHA notes that the final rule requires only
establishments with 250 or more employees to submit information from
all three OSHA recordkeeping forms. The Agency believes it is less
likely that employees in such large establishments will be identified
based on the posted recordkeeping data. By contrast, establishments
with 20 to 249 employees that are required to submit recordkeeping data
under this final rule are only required to submit their OSHA 300A
annual summary. As discussed above, the OSHA Form 300A includes only
aggregate injury and illness data from a specific establishment.
Safeguarding Collected Information
    OSHA received multiple comments on the issue of safeguarding the
information collected under this final rule. Several commenters
commented that OSHA should use and specify procedures for cybersecurity
measures to protect confidential information (Exs. 1210, 1333, 1334,
1364, 1409). For example, IPC--Association Connecting Electronics
Industries commented that ``IPC is concerned about the security of the
injury and illness data reported to OSHA. IPC asks OSHA to specify the
security measures that will be used to protect sensitive information''
(Ex. 1334).
    MIT Laboratories commented more generally about the misuse of
collected data. They stated that there is a lack of ``mechanisms that
would provide accountability for harm arising from misuse of disclosed
data . . . Accountability mechanisms should enable individuals to find
out where data describing them has been distributed and used, set forth
penalties for misuse, and provide harmed individuals with a right of
action'' (Ex. 1207). The American Road and Transportation Builders
Association (ARTBA) provided a similar comment (Ex. 1409).
    In response, when OSHA develops the data collection system, the
Agency plans to maintain two data repositories in the system: One as
OSHA's data mart (or warehouse) for prescribed data behind a secure
firewall, and a separate but similarly secured repository of data that
has been verified as scrubbed and available for public access. Both
systems will have multi-tiered access controls, and the internal system
will specifically be designed to limit access to PII to as few users as
possible. In addition, OSHA will consider the possible need to encrypt
sensitive data in the data mart repository as a safeguard, so that data
would be scrubbed (and rendered unreadable and useless) in the case of
unauthorized access. Also, as discussed above, OSHA will not collect
data from certain fields that primarily exist to help people doing
incident investigations at the establishment and that would not add to
OSHA's or any other user's ability to identify establishments with
specific hazards or elevated injury and illness rates.
    Additionally, NAM commented that, in the preamble to the 2001 final
rule, OSHA acknowledged the inability to protect personal information
in part 1904: ``In 2001, OSHA acknowledged that the agency had no means
of protecting against unwarranted disclosure of private information
contained in an employer's injury and illness records or that there
were sufficient safeguards in place to protect against misuse of
private information. But more importantly, OSHA acknowledged that
``[t]he right to collect and use [private] data for public purposes is
typically accompanied by a concomitant statutory or regulatory duty to
avoid unwarranted disclosures.'' 66 FR at 6056.'' (Ex. 1279). Other
commenters commented that there is no assurance that OSHA will be able
to protect the privacy of the employee once the recordkeeping data is
submitted (Exs. 0187, 1217, 1275).
    In response, OSHA disagrees with commenters who suggested the
Agency will not be able to protect employee information. As discussed
above, two ways OSHA can protect the privacy of employee information
are by not collecting certain information and by not releasing
personally identifiable information on the publicly-accessible Web
site. With respect to safeguarding the information submitted by
employers, OSHA is strongly committed

to maintaining the confidentiality of the information it collects, as
well as the security of its computer system. All federal agencies are
required to establish appropriate administrative and technical
safeguards to ensure that the security of all media containing
confidential information is protected against unauthorized disclosures
and anticipated threats or hazards to their security or integrity.
Regardless of the category of information, all Department of Labor
agencies must comply with the Privacy and Security Statement posted on
DOL's Web site. As part of its efforts to ensure and maintain the
integrity of the information disseminated to the public, DOL's IT
security policy and planning framework is designed to protect
information from unauthorized access or revision and to ensure that the
information is not compromised through corruption or falsification.
    Posting of the annual summary in the workplace is not public
disclosure.
    The International Association of Amusement Parks (IAAP) commented
that OSHA only addressed the privacy concern by stating in the preamble
to the proposed rule that an employer already has the obligation to
publish recordkeeping data when they post the OSHA 300A. IAAP
commented, however, that ``[t]his posting of the annual summary data by
an employer is not comparable to posting injury and illness data on a
searchable, publicly accessible database. Employers can post the annual
summary data on employee bulletin boards which are typically not
located in places where the public has access'' (Ex. 1427). The
American Fuel & Petroleum Association (AFPA) also noted that ``[w]ith
respect to posting annual summary data, the information stays within
the place of employment. Even if an employee decides to distribute the
information, the reach would probably be limited to the immediate,
surrounding area'' (Ex. 1336).
    In response, OSHA notes that one of the objectives of this
rulemaking is to produce a wider public dissemination of information
about recordable occupational injuries and illnesses. The Annual
Summary does not include personally-identifiable information, and the
posting of the information on the Web site should not involve privacy
or confidentiality concerns. With respect to the posting on the Web
site of information from the 300 Log and 301 Incident Report for
establishments with 250 or more employees, such posting will not
include personally-identifiable information. Again, the goal of the
final rule is to disseminate injury and illness data, not to
disseminate personal information about employers or employees.
Privacy Concern Cases
    Some commenters raised concerns about the proposed rule and the
protection of personally identifiable employee information included in
``privacy concern cases'' (Exs. 0150, 1207, 1279, 1335, 1339). Under
OSHA's existing recordkeeping regulation, Sec.  1904.29(b)(6)) requires
employers to withhold the injured or ill employee's name from the 300
Log for injuries and illnesses defined as ``privacy concern cases.''
Section 1904.29(b)(7) defines privacy concern cases as those involving
(i) an injury or illness to an intimate body part or the reproductive
system; (ii) an injury or illness resulting from a sexual assault;
(iii) a mental illness; (iv) a work-related HIV infection, hepatitis
case, or tuberculosis case; (v) needlestick injuries and cuts from
sharp objects that are contaminated with another person's blood or
other potentially infectious material, or (vi) any other illness, if
the employee independently and voluntarily requests that his or her
name not be entered on the log. Additionally, Sec.  1904.29(b)(10)
includes provisions addressing employee privacy if the employer decides
voluntarily to disclose the OSHA 300 and 301 forms to persons other
than those who have a mandatory right of access under Sec.  1904.35.
The paragraph requires employers to remove or hide employees' names or
other personally identifiable information before disclosing the forms
to persons other than government representatives, former employees, or
authorized representatives, as required by Sec. Sec.  1904.40 and
1904.35, except in three cases. The employer may disclose the forms,
complete with personally-identifiable information, only to: (i) An
auditor or consultant hired by the employer to evaluate the safety and
health program; (ii) the extent necessary for processing a claim for
workers' compensation or other insurance benefits; or (iii) a public
health authority or law enforcement agency for uses and disclosures for
which consent, an authorization, or opportunity to agree or disagree or
object is not required under 45 CFR 164.512 (Privacy Rule).
    In its comments, NAM stated that OSHA failed to address how Sec.
1904.29(b)(6)-(10) would be affected by the proposed rule. NAM
commented that there may be differences between employers and OSHA as
to what is considered personally identifiable information.

    Assume that an employer voluntarily provides its OSHA Forms 300
and 301 to an outside safety and health organization. In choosing to
do so, the employer is required to redact the employees' names and
``other personally identifying information.'' Depending on a variety
of factors, the employer chooses to redact certain information,
including job titles and dates of injuries. Yet, months later when
OSHA receives this employer's injury and illness records it decides
to only redact the employees' names. The safety and health
organization could put both sets of data together--something OSHA
seems to want to encourage--and the safety and health organization
could conceivably identify various individuals. Using this
information, the safety and health organization contacts the
employee. In many instances, the employee may not want to be
contacted or have their information used and disseminated any
further, constituting an unwarranted and ongoing invasion of the
employee's privacy (Ex. 1279).

    Additionally, Portland Cement commented: ``The Agency has not shown
the regulated community in this proposal what a revised Form 300, if
developed, would show, and explicit wording in the proposed 1904.41
would require the employee's name to be shown in the electronic
submission to OSHA. Because the Agency has clearly defined ``privacy
concern cases'' in part 1904.29(b)(6) for when employers may keep
confidential the identity of the injured or ill employee, there are
concerns about why OSHA did not more clearly and explicitly address
naming the employee in the proposed electronic submission requirement
found in proposed 1904.41, and why the Agency did not provide a revised
OSHA Form 300 for review in the proposed regulation'' (Ex. 1335).
    In response, OSHA agrees with commenters who stated that the
confidentiality of privacy concern cases is extremely important. The
requirements in existing Sec.  1904.29(b)(6) through (10) were issued
by OSHA in 2001 as a result of the Agency's strong commitment to
protect the identity of employees involved in privacy concern cases. As
discussed above, the final rule requires employers at establishments
with 250 or more employees to submit information about the employee and
the employee's injury/illness recorded on the 300 and 301 forms, except
employee name and address, treating physician name, and treating
facility name and address. This includes the information related to
privacy concern cases. Since OSHA will have the relevant information
from the forms, employers are not required to submit the confidential
list of privacy concern cases.

    Also as discussed above, OSHA will not collect or post information
from Column B (the employee's name) from the 300 Log or from Fields 1,
2, 6, or 7 from the 301 Incident Report. In addition, OSHA will not
post information from Fields 3 through 5 of the 301 Incident Report.
Information in items 14 through 17 will be scrubbed for PII before
being released publicly. This will ensure that information about an
employee's name, address, date of birth, date hired, and gender is not
disclosed. OSHA also does not intend to post any other information on
the Web site that could be used to identify an individual.
Additionally, OSHA will conduct a special review of submitted privacy
concern case information to ensure that the identity of the employee is
protected.
    With respect to NAM's comment regarding the definition of
``personally-identifiable information,'' OSHA uses the definition
provided in the May 22, 2007, OMB Memorandum for the Heads of Executive
Departments and Agencies, ``Safeguarding Against and Responding to the
Breach of Personally Identifiable Information.'' The term ``personally-
identifiable information'' refers to information which can be used to
distinguish or trace an individual's identify, such as their name,
Social Security number, biometric records, etc. alone, or when combined
with other personal or identifying information which is linked or
linkable to a specific individual, such as date and place of birth,
mother's maiden name, etc. Based on this definition, certain
information included on the OSHA recordkeeping forms is personally
identifiable information. For example, an employee's name, address,
date of birth, date hired, and gender would be personally identifiable
information and not subject to posting on the publicly-accessible Web
site as establishment-specific data. (However, note that OSHA will not
collect information about the employee's name or address under this
final rule.)
    Other information included on the OSHA forms may also be personally
identifiable information. As mentioned by a commenter, depending on the
circumstances at a specific establishment, the information in Column C
(Job Title) from the 300 Log could be used to identify an employee who
was involved in a privacy concern case. In fact, OSHA's current
recordkeeping Frequently Asked Question (FAQ) 29-3 permits an employer
to delete information (such as Job Title) if they believe it will
identify the employee. However, OSHA also believes that because only
establishments with 250 or more employers will be required to submit
the OSHA 300 Log and 301 Incident Report, it is less likely that
information related to Job Title can be used to identify an employee.
    OSHA further notes that comments that suggested additional
categories for privacy concern cases are not within the scope of this
rulemaking. Any revision to existing Sec.  1904.29(b)(6) through (10)
would require separate notice and comment rulemaking.
Confidential Information Protection and Statistical Efficiency Act
    Several commenters stated that the online posting of covered
employers injury and illness recordkeeping data violates the
Confidential Information Protection and Statistical Efficiency Act of
2002 (CIPSEA) (Pub. L. 107-347, December 17, 2002) (Exs. 1225, 1392,
1399). These commenters noted that CIPSEA prohibits BLS from releasing
establishment-specific injury and illness data to the general public or
to OSHA, and that OSHA has not adequately addressed how the release of
part 1904 information under this rulemaking is consistent with the
Congressional mandate expressed in the law.
    Two commenters also stated that publishing data from the OSHA
recordkeeping forms would circumvent Congress's intent from 2002 (Exs.
1193, 1430). These commenters noted that data on the 300 and 301 forms
are already reported to BLS, and when Congress passed CIPSEA, it made
the determination that such information should be confidential and
prohibited BLS from releasing establishment-specific data to the
general public or to OSHA.
    In response, OSHA notes that CIPSEA provides strong confidentiality
protections for statistical information collections that are conducted
or sponsored by federal agencies. The law prevents the disclosure of
data or information in identifiable form if the information is acquired
by an agency under a pledge of confidentiality for exclusively
statistical purposes. See, section 512(b)(1). BLS, whose mission is to
collect, process, analyze, and disseminate statistical information,
uses a pledge of confidentiality when requesting occupational injury
and illness information from respondents under the BLS Survey.
    The provisions of CIPSEA apply when a federal agency both pledges
to protect the confidentiality of the information it acquires and uses
the information only for statistical purposes. Conversely, the
provisions of CIPSEA do not apply if information is collected or used
by a federal agency for any non-statistical purpose. As noted elsewhere
in this document, the information collected and published by OSHA in
the final rule will be used for several purposes, including for the
targeting of OSHA enforcement activities. Therefore, the CIPSEA
confidentiality provisions are not applicable to the final rule.
Data Quality Act
    Peter Strauss commented that OSHA is entitled to collect the
workplace injury and illness records as prescribed by the proposed
rule, but the Data Quality Act assures against the mishandling of such
data (Ex. 0187). Another commenter, Society of Plastics Industry, Inc.,
commented: ``Let us assume, solely for purposes of further analysis,
and contrary to its stated purpose, that the publication of this
information was designed solely to inform affected employers and
employees of workplace incidents, and implicitly workplace conditions,
so they could take remedial and/or preventive measures to prevent
incidents from happening again. OSHA would be publishing information
that has not been investigated or otherwise verified through
appropriate quality controls, that would be misleading (in that it
would be published without any meaningful context and in a manner
designed to convey employer responsibility notwithstanding any
accompanying disclaimers), and that may very well contain personal
identifiers or personally identifiable information that could
effectively result in the unlawful disclosure of personal medical
information. This type of publication would conflict with the goals of
the OSH Act, the requirements of the Data Quality Act, and the
requirements of the applicable privacy laws'' (Ex. 1342).
    In response, OSHA notes that the Data Quality Act, or Information
Quality Act, was passed by Congress in Section 115 of the Treasury and
General Government Appropriations Act for Fiscal Year 2001 (Pub. L.
106-554; H.R. 5658). The Act directs the Office of Management and
Budget (OMB) to issue government-wide guidelines that ``provide policy
and procedural guidance to federal agencies for ensuring and maximizing
the quality, objectivity, utility, and integrity of information
(including statistical information) disseminated by federal agencies.''
The Act also requires other federal agencies to publish their own
implementation guidelines that include ``administrative mechanisms
allowing affected persons to seek and obtain correction of information
maintained

and disseminated by the agency'' that does not comply with the
guidelines issued by OMB. The Department of Labor issued its
implementing guidelines on October 1, 2002. [http://www.dol.gov/informationquality.htm]. The purpose of these guidelines is to
establish Departmental guidelines for implementing an information
quality program at DOL and to enhance the quality of information
disseminated by DOL.
    The DOL Guidelines state that ``dissemination'' includes agency
initiated or sponsored distribution of information to the public.'' It
does not include ``agency citations to or discussion of information
that was prepared by others and considered by the agency in the
performance of its responsibilities, unless an agency disseminates it
in a manner that reasonably suggests that the agency agrees with the
information.'' OSHA notes that it will make no determination as to
whether the Agency agrees with the recordkeeping information
electronically submitted under the final rule. In addition, with the
exception of redacting personally identifiable information, OSHA will
not amend the raw recordkeeping data submitted by employers. As a
result, the provisions of the Information Quality Act, as well as the
DOL information quality guidelines, do not apply to the recordkeeping
information posted on the public Web site.
    Although the provisions of the Information Quality Act do not
apply, OSHA still wishes to emphasize that, as part of its efforts to
ensure accuracy, the Agency encourages affected employers, employees,
and other individuals to seek and obtain, where appropriate, correction
of recordkeeping data posted on the public Web site. OSHA believes that
in most cases, informal contacts with the Agency will be appropriate.
However, OSHA will also make available on its Web site a list of
officials to whom requests for corrections should be sent and where and
how such officials may be contacted. The purpose of this correction
process is to address inaccuracies in the posted information, not to
resolve underlying substantive policy or legal issues.
Health Insurance Portability and Accountability Act
    Several commenters raised concerns about whether the proposed rule
would hinder individual privacy rights under the Health Insurance
Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191.
Some of these commenters stated that the HIPAA privacy regulation at 45
CFR parts 160 and 164 (Privacy Rule), prohibits OSHA from public
disclosure of personally-identifiable health information. Other
commenters expressed the concern that employers would be in violation
of the Privacy Rule if this rulemaking requires them to submit
protected health information to OSHA (Exs. 0218, 0224, 0240, 0252,
1084, 1093, 1109, 1111, 1123, 1197, 1200, 1205, 1206, 1210, 1214, 1217,
1218, 1223, 1272, 1275, 1279, 1331, 1338, 1342, 1362, 1370, 1386, 1402,
1408).
    In response, OSHA notes that on December 28, 2000, the U.S.
Department of Health and Human Services (HHS) issued a final rule,
Standard for Privacy of Individually-Identifiable Health Information
(65 FR 82462). The rule was modified on August 14, 2002 (67 FR 53182),
which is codified at 45 CFR parts 160 and 164. Collectively known as
the ``Privacy Rule,'' these standards protect the privacy of
individually identifiable health information (``protected health
information'' or ``PHI''), but is balanced to ensure that appropriate
uses and disclosures of PHI still may be made when necessary to treat a
patient, to protect the nation's public health, and for other critical
purposes. A covered entity may not use or disclose protected health
information unless permitted by the Privacy Rule. See, 45 CFR 164.502.
    As required by HIPAA, the provisions of the Privacy Rule only apply
to ``covered entities.'' The term ``covered entity'' includes health
plans, health care clearinghouses, and health care providers who
conduct certain financial and administrative transactions
electronically. See, 45 CFR 160.103. OSHA notes that the Agency does
not fall within the definition of a covered entity for purposes of the
Privacy Rule. Therefore, the use and disclosure requirements of the
Privacy Rule do not apply to OSHA, and do not prevent the Agency from
publishing injury and illness recordkeeping information under this
final rule.
    Additionally, OSHA agrees with commenters who suggested that the
Agency consider applying the principles set forth in the Privacy Rule
for the de-identification of health information. OSHA believes that
health information is individually identifiable if it does, or
potentially could, identify the individual. As explained by commenters,
once protected health information is de-identified, there may no longer
be privacy concerns under HIPAA. Again, it is OSHA's policy under the
final rule not to release any individually-identifiable information. As
discussed elsewhere in this document, procedures are in place to ensure
that individually-identifiable information, including health
information, will not be publicly posted on the OSHA Web site.
    With respect to the issue of whether HIPAA prevents covered
entities from disclosing PHI to employers, and/or directly to OSHA, the
Agency notes that the Privacy Rule specifically includes several
exemptions for disclosures of health information without individual
authorization. Of particular significance, is 45 CFR 164.512--Uses and
disclosures for which authorization or opportunity to agree or object
is not required. These standards, in themselves, do not compel a
covered entity to disclose PHI. Instead, they merely permit the covered
entity to make the requested disclosure without obtaining authorization
from affected individuals. Section 164.512(a) of the Privacy Rule
permits covered entities to use and disclose PHI, without
authorization, when they are required to do so by another law. HHS has
made clear that this disclosure encompasses the full array of binding
legal authorities, including statutes, agency orders, regulations, or
other federal, state or local governmental actions having the effect of
law. See, 65 FR 82668. As a result, the Privacy Rule does not allow a
covered entity to restrict or refuse to disclose PHI required by an
OSHA standard or regulation.
    A covered entity may also disclose PHI without individual
authorization to ``public health authorities'' and to ``health
oversight agencies.'' See, 45 CFR 164.512(b) and (d). The preamble to
the Privacy Rule specifically mentions OSHA as an example of both. See,
65 FR 82492, 82526.
    The Privacy Rule also permits a covered entity who is a member of
the employer's workforce, or provides health care at the request of an
employer, to disclose to employers protected health information
concerning work-related injuries or illnesses or work-related medical
surveillance in situations where the employer has a duty under the OSH
Act, the Mine Act, or under a similar state law to keep records on or
act on such information. Section 164.512(b)(1)(v)(C) specifically
permits a covered entity to use or disclose protected health
information if the employer needs such information in order to comply
with obligations under 29 CFR parts 1904 through 1928.
Americans With Disabilities Act
    The New York Farm Bureau (NYFB) commented that the Americans with
Disabilities Act of 1990 (ADA), 42

U.S.C. 12101 et seq. prohibits the release of health and disability-
related information (Ex. 1370). NYFB specifically requested that OSHA
explain how compliance with the electronic reporting requirement can be
accomplished while meeting the requirements of the ADA.
    In response, OSHA notes that Section 12112(d)(3)(B) of the ADA
permits an employer to require a job applicant to submit to a medical
examination after an offer of employment has been made but before
commencement of employment duties, provided that medical information
obtained from the examination is kept in a confidential medical file
and not disclosed except as necessary to inform supervisors, first aid
and safety personnel, and government officials investigating compliance
with the ADA. Section 12112(d)(4)(C) requires that the same
confidentiality protection be accorded health information obtained from
a voluntary medical examination that is part of an employee health
program.
    By its terms, the ADA requires confidentiality for information
obtained from medical examinations given to prospective employees, and
from medical examinations given as part of a voluntary employee health
program. The OSHA injury and illness records are not derived from pre-
employment or voluntary health programs. The information in the OSHA
injury and illness records is similar to that found in workers'
compensation forms, and may be obtained by employers by the same
process used to record needed information for workers' compensation and
insurance purposes. The Equal Employment Opportunity Commission (EEOC),
the agency responsible for administering the ADA, recognizes a partial
exception to the ADA's strict confidentiality requirements for medical
information regarding an employee's occupational injury or workers'
compensation claim. See EEOC Enforcement Guidance: Workers'
Compensation and the ADA, 5 (September 3, 1996). Therefore, it is not
clear that the ADA applies to the OSHA injury and illness records.
    Even assuming that the OSHA injury and illness records fall within
the literal scope of the ADA's confidentiality provisions, it does not
follow that a conflict arises. The ADA states that ``nothing in this
Act shall be construed to invalidate or limit the remedies, rights, and
procedures of any federal law.'' See, 29 U.S.C. 12201(b). In enacting
the ADA, Congress was aware that other federal standards imposed
requirements for testing an employee's health, and for disseminating
information about an employee's medical condition or history,
determined to be necessary to preserve the health and safety of
employees and the public. See, H.R. Rep. No. 101-485 pt. 2, 101st
Cong., 2d Sess. 74-75 (1990), reprinted in 1990 U.S.C.C.A.N. 356, 357
(noting, e.g. medical surveillance requirements of standards
promulgated under OSH Act and federal Mine Safety and Health Act, and
stating ``[t]he Committee does not intend for [the ADA] to override any
medical standard or requirement established by federal . . . law . . .
that is job-related and consistent with business necessity''). See
also, 29 CFR part 1630 App. p. 356. The ADA recognizes the primacy of
federal safety and health regulations; therefore such regulations,
including mandatory OSHA recordkeeping requirements, pose no conflict
with the ADA. Cf. Albertsons, Inc. v. Kirkingburg, 527 U.S. 555, (1999)
(``When Congress enacted the ADA, it recognized that federal safety and
health rules would limit application of the ADA as a matter of law.'').
    The EEOC has also recognized both in the implementing regulations
at 29 CFR part 1630, as well as in interpretive guidelines, that the
ADA yields to the requirements of other federal safety and health
standards and regulations. The implementing regulation codified at 29
CFR 1630.15(e) explicitly states that an employer's compliance with
another federal law or regulation may be a defense to a charge of
violating the ADA.
    Additionally, the EEOC Technical Assistance Manual on the ADA
states that the ``ADA does not override health and safety requirements
established under other Federal laws . . . For example, . . . Employers
also must conform to health and safety requirements of the U.S.
Occupational Safety and Health Administration (OSHA).'' For these
reasons, OSHA does not believe that the mandatory submission and
publication requirements in Sec.  1904.41 of this final rule conflict
with the confidentiality provisions of the ADA.
Other Issues
Alternate Forms
    Some commenters commented that the requirement for electronic
submission of part 1904 injury and illness data will lead to the
elimination of alternate or equivalent recordkeeping forms by employers
(Exs. 1385, 1399). Littler Mendelson, P.C. commented: ``Many employers
utilize equivalent forms--particularly insurance and accident
investigation forms in place of the Form 301. In establishing a
requirement for electronic reporting in a particular software format
OSHA will be mandating the use of a specific form and eliminating the
widespread use of equivalent forms by employers. This change has not
been identified or evaluated (benefits, or lack thereof) under the
Paperwork Reduction Act provisions applicable to this rulemaking.
Littler believes that the incremental benefit (if any) proposed in this
rulemaking is significantly outweighed by the increased paperwork
duplication which would be created by the use of mandatory forms and
elimination of equivalent forms'' (Ex. 1385).
    In response, OSHA notes that existing Sec.  1904.29(a) provides
that employers must use the OSHA 300 Log, 301 Incident Report, and 300A
Annual Summary, or equivalent forms, when recording injuries and
illnesses under part 1904. Section 1904.29(b)(4) states that an
equivalent form is one that has the same information, is as readable
and understandable, and is completed using the same instructions as the
OSHA form it replaces. OSHA is aware that many employers use an
insurance form instead of the 301 Incident Report, or supplement an
insurance form by adding any additional information required by OSHA.
    As discussed above, under the final rule, employers have two
options for submitting recordkeeping data to OSHA's secure Web site.
First, employers can directly enter data in a web form. Second,
employers will be provided with a means of electronically transmitting
the information, including information from equivalent forms, to OSHA.
This is similar to how BLS collects data from establishments under the
SOII. Accordingly, the final rule does not change the option for
employers to use alternate or equivalent forms when recording OSHA
injuries and illnesses.
No Fault Recordkeeping Policy
    There were many comments that the proposed rule would reverse
OSHA's long-standing ``no fault'' recordkeeping policy (Exs. 0160,
0174, 0179, 0192, 0218, 0224, 0240, 0251, 0255, 1084, 1091, 1092, 1093,
1109, 1113, 1123, 1191, 1192, 1194, 1197, 1199, 1200, 1214, 1218, 1272,
1273, 1276, 1279, 1323, 1324, 1328, 1329, 1334, 1336, 1338, 1342, 1343,
1349, 1359, 1370, 1386, 1391, 1394, 1397, 1399, 1401, 1411, 1427). For
example, the Coalition for Workplace Safety commented that ``[i]n 2001,
OSHA revised the recordkeeping requirements and the foundation of those
revisions in what

OSHA deemed a ``no-fault'' system . . . For a variety of reasons OSHA
concluded that a ``geographic'' presumption was the most comprehensive
way to achieve Congress's objective for determining work-related
injuries and illness. However, at the same time, OSHA recognized that
the ``geographic'' presumption did not necessarily correlate to an
employer's behavior and therefore injuries and illness that were beyond
an employer's control would be recorded . . . [n]ow, OSHA intends to
use this no-fault system to target employers for enforcement efforts,
to shame employers into compliance, to allow members of the public to
make decisions about with which companies to do business, and to allow
current employees to compare their workplaces to the ``best''
workplaces for safety and health. This proposed regulation
fundamentally upends the no-fault system that OSHA originally adopted
in 2001'' (Ex. 1411). The International Association of Drilling
Contractors (IADC) also commented that ``the presumption under the NPRM
is that all injuries or illnesses are preventable, suggesting all
incidents are the fault of the employer. The proposal essentially turns
the ``no fault'' reporting system into one where employers will be
blamed for idiosyncratic events arising as a result of forces beyond
their control or actions by workers in direct contravention of
workplace rules. This is a clear abandonment of the ``no-fault'' system
in favor of OSHA's controversial and counterproductive ``regulation by
shaming'' enforcement doctrine. Surprisingly, OSHA fails to even
acknowledge its reversal, or provide any justification or an analysis
for this significant change'' (Ex. 1199).
    In response, OSHA disagrees with commenters who commented that the
Agency has reversed its ``no fault'' recordkeeping policy. The Note to
Sec.  1904.0 of OSHA's existing recordkeeping regulation continues to
provide that the recording or reporting of a work-related injury,
illness, or fatality does not mean that an employer or employee was at
fault, that an OSHA rule has been violated, or that the employee is
eligible for workers' compensation or other benefits. As noted
elsewhere in this preamble, the purpose of this rulemaking is to
improve workplace safety and health through the collection of useful,
accessible, establishment-specific injury and illness data to which
OSHA currently does not have direct, timely, and systematic access. The
information acquired through this final rule will assist employers,
employees, employee representatives, researchers, and the government to
better identify and correct workplace hazards.
    OSHA also disagrees with commenters who suggested that the Agency
will use the ``no fault'' recordkeeping system to target employers for
enforcement efforts. As discussed elsewhere in this preamble, and
consistent with the Agency's longstanding practice, OSHA will use a
neutral administrative plan when targeting employers for onsite
inspection, similar to how the Agency has administered enforcement
activities under the Site-Specific Targeting program.
Section 1904.41(a)(3) Seems To Give OSHA Unlimited Power
    Andrew Sutton commented that the language in proposed Sec.
1904.41(a)(3) appears to give OSHA ``unfettered discretion.'' This
section would have provided that upon notification, you must
electronically send to OSHA or OSHA's designee the requested
information, at the specified time interval, from the records that you
keep under part 1904. According to the commenter, this section might be
seen to give too much power to OSHA for ad hoc data collection: ``In
fact, the authority contained in this section could be said to make the
whole rest of 1904.41 redundant; OSHA could enact the whole rest of the
proposed regulation via the power granted here.'' (Ex. 0245).
    In response, OSHA notes that, like the proposed rule, Sec.
1904.41(a)(3) of the rule requires that, upon request, employers must
electronically submit their OSHA part 1904 records to OSHA or OSHA's
designee. This section replaces OSHA's existing regulation at Sec.
1904.41, Annual OSHA injury and illness survey of ten or more
employers. In recent years, OSHA has used the authority in Sec.
1904.41 to conduct surveys through the OSHA Data Initiative (ODI).
    It has never been OSHA's intention to exercise unfettered
discretion when collecting injury and illness records. Like the
existing regulation, Sec.  1904.41(a)(3) of the final rule provides
OSHA with authority to conduct surveys of employers regarding their
occupational injuries and illnesses. Historically, the information
collected through these surveys has assisted OSHA in identifying trends
in workplace hazards, evaluating the effectiveness of OSHA enforcement
activities, and gathering information for the promulgation of new
occupational safety and health standards and regulations.
    OSHA further notes that data collection under final Sec.
1904.41(a)(3) would be subject to the Paperwork Reduction Act, which
provides that federal agencies generally cannot conduct or sponsor a
collection of information, and the public is not required to respond to
an information collection, unless it is approved by OMB and displays a
valid OMB Control Number. Also, pursuant to the PRA, notice of
information collections must be published in the Federal Register. As a
result, employers will be able to determine which employers are within
a survey group and which information will be collected each year before
the survey begins. Once a survey has been given an OMB control number
under the PRA, any substantive or material modification would require a
new PRA clearance.
    In addition, final Sec.  1904.41(b)(7) provides that employers who
are partially exempt from keeping injury and illness records under
existing Sec. Sec.  1904.1 and/or 1904.2 are required to submit
recordkeeping data only if OSHA notifies them they will be required to
participate in a particular information collection under Sec.
1904.41(a)(3). OSHA will notify these employers in writing in advance
of the year for which injury and illness records will be required.

D. The Final Rule

    The final rule is similar to the proposed rule in requiring
employers to electronically submit part 1904 records to OSHA. However,
there are also several differences from the proposed rule. The major
differences between the final rule and the proposed rule include the
following:
    1. In the final rule, establishments with 250 or more employees
that are required to keep part 1904 records must electronically submit
some of the information from the three recordkeeping forms that they
keep under part 1904 (OSHA Form 300A Summary of Work-Related Injuries
and Illnesses, OSHA Form 300 Log of Work-Related Injuries and
Illnesses, and OSHA Form 301 Injury and Illness Incident Report) to
OSHA or OSHA's designee once a year. In the proposed rule, these
establishments would have been required to electronically submit all of
the information from the OSHA Form 300 and OSHA Form 301 quarterly, and
electronically submit all of the information from the OSHA Form 300A
annually.
    2. In the final rule, for establishments with 20 to 249 employees,
the list of designated industries who must report in appendix A to
subpart E of part 1904

is based on a three-year average of BLS data from 2011, 2012, and 2013.
In the proposed rule, the list of designated industries in appendix A
to subpart E of part 1904 would have been based on one year of BLS data
from 2009.
    Under the final rule, employers have the following requirements:
    1. Sec.  1904.41(a)(1)--Establishments with 250 or more employees
that are required to keep part 1904 records must electronically submit
the required information from the three recordkeeping forms that they
keep under part 1904 (OSHA Form 300A Summary of Work-Related Injuries
and Illnesses, OSHA Form 300 Log of Work-Related Injuries and
Illnesses, and OSHA Form 301 Injury and Illness Incident Report) to
OSHA or OSHA's designee annually. This information must be submitted no
later than March 2 of the year after the calendar year covered by the
form. The establishments are not required to submit the following
information:
    a. Log of Work-Related Injuries and Illnesses (OSHA Form 300):
Employee name (column B).
    b. Injury and Illness Incident Report (OSHA Form 301): Employee
name (field 1), employee address (field 2), name of physician or other
health care professional (field 6), facility name and address if
treatment was given away from the worksite (field 7).
    2. Sec.  1904.41(a)(2)--Establishments with 20-249 employees that
are classified in a designated industry listed in appendix A to subpart
E of part 1904 must electronically submit the required information from
the OSHA Form 300A annually to OSHA or OSHA's designee. This
information must be submitted no later than March 2 of the year after
the calendar year covered by the form.
    3. Sec.  1904.41(a)(3)--Establishments must electronically submit
the requested information from their part 1904 records to OSHA or
OSHA's designee after notification from OSHA.
    Overall, the final rule's provisions requiring regular electronic
submission of injury and illness data will allow OSHA to obtain a much
larger database of timely, establishment-specific information about
injuries and illnesses in the workplace. This information will help
OSHA use its resources more effectively by enabling OSHA to identify
the workplaces where workers are at greatest risk. This information
will also help OSHA establish a comprehensive database that the Agency,
researchers, and the public can use to identify hazards related to
reportable events and to identify industries and processes where these
hazards are prevalent. The change from quarterly to annual reporting of
information from OSHA Form 300 and OSHA Form 301 by establishments with
250 or more employees will also lessen the burden of data collection on
both employers and OSHA.
    Note that OSHA will phase in implementation of the data collection
system. In the first year, all establishments required to routinely
submit information under the final rule will be required to submit only
the information from the Form 300A (by July 1, 2017). In the second
year, all establishments required to routinely submit information under
the final rule will be required to submit all of the required
information (by July 1, 2018). This means that, in the second year,
establishments with 250 or more employees that are required to
routinely submit information under the final rule will be responsible
for submitting information from the Forms 300, 301, and 300A. In the
third year, all establishments required to routinely submit under this
final rule will be required to submit all of the required information
(by March 2, 2019). This means that beginning in the third year (2019),
establishments with 250 or more employees will be responsible for
submitting information from the Forms 300, 301, and 300A, and
establishments with 20-249 employees in an industry listed in appendix
A to subpart E of part 1904 will be responsible for submitting
information from the Form 300A by March 2 each year. This will provide
sufficient time to ensure comprehensive outreach and compliance
assistance in advance of implementation.
    In addition, consistent with E.O. 13563, OSHA plans to conduct a
retrospective review, once the Agency has collected three full years of
data. OSHA will use the findings of the retrospective review to assess
the electronic submission requirements in the final rule and modify
them as appropriate and feasible.

IV. Section 1902.7--Injury and Illness Recording and Reporting
Requirements

    In 1997, OSHA issued a final rule at Sec.  1904.17, OSHA Surveys of
10 or More Employers that required employers to submit occupational
injury and illness data to OSHA when sent a survey form. The Sec.
1904.17 rule enabled the Agency to conduct a mandatory survey of the
1904 data, which was named the OSHA Data Initiative (ODI). When OSHA
issued the 1997 rule, the Agency determined that the States were not
required to adopt a rule comparable to the federal Sec.  1904.17 rule
(62 FR 6441).
    In 2001, Sec.  1952.4(d) (now Sec.  1902.7(d)) was added to the
final rule to continue to provide the States with the flexibility to
participate in the OSHA Data Initiative under the federal requirements
or the State's own regulation (66 FR 5916-6135). At its outset, Federal
OSHA conducted the OSHA data collection in all of the states, including
those which administered approved State Plans. However, Federal OSHA
then began to collect data only in the State-Plan States that wished to
participate. The current Sec.  1902.7(d) allowed the individual States
to decide, on an annual basis, whether or not they would participate in
the OSHA data collection. If the State elected to participate, the
State could either adopt and enforce the requirements of current Sec.
1904.41 as an identical or more stringent State regulation, or could
defer to the federal regulation and federal enforcement with regard to
the mandatory nature of the survey. If the State deferred to the
current federal Sec.  1904.41 regulation, OSHA's authority to implement
the ODI was not affected either by operational agreement with a State-
Plan State or by the granting of final State-Plan approval under
section 18(e).
    In this rulemaking, the proposed rule would have required State-
Plan States to adopt requirements identical to those in 29 CFR 1904.41
in their recordkeeping and reporting regulations as enforceable State
requirements, as provided in section 18(c)(7) of the OSH Act. The data
collected by OSHA as authorized by Sec.  1904.41 would have been made
available to the State-Plan States. Nothing in any State Plan would
have affected the duties of employers to comply with Sec.  1904.41.
    Three State-Plan States submitted comments on the proposed rule--
Kentucky (Ex. 208), North Carolina (Ex. 1195), and California (Ex.
1395). However, they did not comment specifically on this part of the
proposed rule. OSHA also did not receive any other comments on this
part of the proposed rule.
    The final rule is the same as the proposed rule. State-Plan States
must adopt requirements identical to those in 29 CFR 1904.41 in their
recordkeeping and reporting regulations as enforceable State
requirements, as provided in section 18(c)(7) of the OSH Act. OSHA will
make the data collected by OSHA under this final rule available to the
State Plan States. Nothing in any State plan will affect the duties of
employers to comply with Sec.  1904.41.

V. Section 1904.35 and Section 1904.36

A. Background

    One of the goals of the final rule is to ensure the completeness
and accuracy

of injury and illness data collected by employers and reported to OSHA.
Therefore, Sec.  1904.35 of the final rule contains three new
provisions that promote complete and accurate reporting of work-related
injuries and illnesses by requiring employers to provide certain
information on injury and illness reporting to employees, clarifying
that employer reporting procedures must be reasonable, and prohibiting
employers from retaliating against employees for reporting work-related
injuries and illnesses, consistent with the existing prohibition in
section 11(c) of the OSH Act.
    In the initial comment period and at the public meeting, many
commenters expressed concern that the public availability of OSHA data
would motivate some employers to under-record injuries and illnesses,
in part by attempting to reduce the number of recordable injuries and
illness their employees report to them. See, e.g., Exs. 0114, 1327,
1647, 1648, 1651, 1675, 1695. Exs. 0165, 01-09-2014 Tr. at 54-55; 01-
10-2014 Tr. at 52-55. In addition, commenters in both comment periods
pointed to numerous studies finding that under-recording is already a
serious issue. See, e.g., Exs. 1675, 1679, 1685, 1695. OSHA concludes
that the rulemaking record supports these concerns. Therefore, this
final rule includes provisions intended to promote accurate recording
of work-related injuries and illnesses by preventing the under-
recording that arises when workers are discouraged from reporting these
occurrences. The rule also establishes an additional mechanism for OSHA
to enforce the existing statutory prohibition on employer retaliation
against employees.
    Specifically, the rule makes three changes to Sec. Sec.  1904.35
and 1904.36 consistent with the proposed changes set forth in the
August 14, 2014 Supplemental Notice of Proposed Rulemaking. The final
rule (1) requires employers to inform employees of their right to
report work-related injuries and illnesses free from retaliation; (2)
clarifies the existing implicit requirement that an employer's
procedure for reporting work-related injuries and illnesses must be
reasonable and not deter or discourage employees from reporting; and
(3) prohibits employers from retaliating against employees for
reporting work-related injuries or illnesses, consistent with the
existing prohibition in section 11(c) of the OSH Act.
    The final rule also makes a technical edit to Sec.  1904.35(a)(3)
to clarify that the rights of employees and their representatives to
access injury and illness records are governed by Sec.  1904.35(b)(2).
Section 1904.35(a)(3) does not alter any of the substantive rights or
limitations contained in Sec.  1904.35(b)(2).

B. The Proposed Rule

    On January 9 and 10, 2014, OSHA held a public meeting to discuss
the November 8, 2013 Notice of Proposed Rulemaking. Many meeting
participants expressed concern that the proposal to publish
establishment-specific injury and illness data on OSHA's publicly
available Web site might cause an increase in the number of employers
that adopt policies or practices that have the effect of discouraging
or deterring employees from reporting, including policies that result
in retaliation against employees who report work-related injuries and
illnesses. See, e.g., Exs. 0165, 01-09-2014 Tr. at 33-40. Such policies
and practices, when successful in deterring employee reporting, would
undermine the benefits of the rule by compromising the accuracy of
records and result in injustice for employees who do report their work-
related injuries and illnesses and then suffer retaliation for doing
so. OSHA seeks to ensure that employers, employees, and the public have
access to the most accurate data possible about injuries and illnesses
in workplaces so that they can take the most appropriate steps to
protect worker safety and health.
    Therefore, on August 14, 2014, OSHA issued a Supplemental Notice of
Proposed Rulemaking to address this issue. OSHA requested comment on
``whether to amend the proposed rule to (1) require that employers
inform their employees of their right to report injuries and illnesses;
(2) require that any injury and illness reporting requirements
established by the employer be reasonable and not unduly burdensome;
and (3) prohibit employers from taking adverse action against employees
for reporting injuries and illnesses.''
    Some commenters took issue with procedural aspects of the
supplemental notice to the propose rule. A few commenters asserted that
the supplemental notice to the proposed rule denied the public the
opportunity to meaningfully comment because it did not include proposed
regulatory text and was not specific enough about what conduct was to
be prohibited. Exs. 1566, 1650. However, under the Administrative
Procedure Act, proposed regulatory text is not required; agencies must
only include ``either the terms or substance of the proposed rule or a
description of the subjects and issues involved.'' 5 U.S.C. 553(b)(3).
Here, the proposal explained the substance of the proposed rule and the
subjects and issues involved. In addition, the specificity and detail
of the comments OSHA received indicate that commenters understood the
issues under discussion. Furthermore, as discussed below, the final
regulatory text closely tracks the concepts and language used in the
proposal, meaning the proposal provided sufficient notice to the public
of the conduct to be prohibited. See Chocolate Mfrs. Ass'n v. Block,
755 F.2d 1098, 1105 (4th Cir. 1985) (notice is sufficient as long as
the final rule is a ``logical outgrowth'' from the notice). Therefore,
the supplemental notice to the proposed rule provided adequate notice
for commenters.
    Other commenters, including the American Coatings Association,
stated that the amendments suggested by the supplemental proposal were
outside the scope of the original November 8, 2013 proposal (Ex. 1548).
OSHA agrees that these changes to Sec. Sec.  1904.35 and 1904.36 were
outside the scope of the original proposal. That is why OSHA published
a supplemental proposal and extended the public comment period. The
final amendments to Sec. Sec.  1904.35 and 1904.36 are within the scope
of the supplemental proposal, and are therefore permissible under the
Administrative Procedure Act.

C. The Final Rule

    The final rule includes three new provisions in Sec.  1904.35.
These provisions follow directly and logically from the August 14, 2014
Supplemental Notice of Proposed Rulemaking. First, the final rule
amends paragraphs (a)(2) and (b)(1)(iii) to require employers to inform
employees of their right to report work-related injuries and illnesses
free from retaliation. Second, paragraph (b)(1)(i) of the final rule
clarifies that the reporting method already implicitly required by this
section must be reasonable and not deter or discourage employees from
reporting. And third, paragraph (b)(1)(iv) of the final rule prohibits
employers from retaliating against employees for reporting work-related
injuries or illnesses under section 1904.35 consistent with the
existing prohibition contained in section 11(c) of the OSH Act.
Section 1904.35, Paragraphs (a)(2) and (b)(1)(iii): Employee
Information on Reporting
    The final rule strengthens paragraph (a) of Sec.  1904.35 by
expanding the previous requirement for employers to inform employees
how to report work-related injuries and illnesses so that the rule now
includes a mandate to inform

employees that they have a right to report work-related injuries and
illnesses free from retaliation by their employer as described in
paragraph (b)(1)(iii) of the final rule. OSHA has determined that this
enhanced information-provision requirement will improve employee and
employer understanding of their rights and responsibilities related to
injury and illness reporting and thereby promote more accurate
reporting.
    The rulemaking record supports OSHA's determination that requiring
employers to inform employees of their reporting rights will improve
the quality of employers' injury and illness records. Commenters
provided numerous examples and studies showing that many employees
avoid reporting injuries and illnesses because they are afraid that
doing so will result in retaliation. For example, Lipscomb et al.
(2012) found that many carpenters' apprentices avoided reporting
injuries and filing workers compensation claims because they feared
discipline, termination, or other adverse action. Exs. 1648, 1675,
1695. Other researchers discovered similar fears among a variety of
worker populations. See, e.g., Moore et al. (2013) (construction),
Southern Poverty Law Center and Alabama Appleseed (2013) (poultry
processing), Nebraska Appleseed (2009) (meatpacking), Lashuay and
Harrison (2006) (California low-wage workers), Scherzer et al. (2005)
(hotel room cleaners), Pransky et al. (1999) (manufacturing) (Exs.
1648, 1675, 1685, 1695). See also below regarding actual retaliation
against workers for reporting work-related injuries and illnesses. A
2009 survey by the U.S. Government Accountability Office (GAO) found
that two thirds of occupational health practitioners observed worker
fear of disciplinary action for reporting workplace injuries and
illnesses (Exs. 1675, 1695). Although some commenters questioned
whether underreporting is a real problem, the examples and studies
cited above have convinced OSHA that employee fear of retaliation is a
real barrier to reporting of work-related injuries and illnesses and
that the information-provision requirements in the final rule will
allay workers' fear of retaliation and lead to more accurate reporting.
Section 1904.35(b)(1)(i): Reasonable Reporting Procedures
    The final rule amends paragraph (b)(1)(i) of Sec.  1904.35 to state
explicitly that employer procedures for employee reporting of work-
related illnesses and injuries must be reasonable. The previous version
of Sec.  1904.35(b)(1)(i) already required employers to set up a way
for employees to report work-related injuries and illnesses promptly.
The final rule adds new text to clarify that reporting procedures must
be reasonable, and that a procedure that would deter or discourage
reporting is not reasonable, as explained in a 2012 OSHA enforcement
memorandum. See OSHA Memorandum re: Employer Safety Incentive and
Disincentive Policies and Practices (Mar. 12, 2012). Although the
substantive obligations of employers will not change, the final rule
will have an important enforcement effect for the minority of employers
who do not currently have reasonable reporting procedures.
    The rulemaking record supports OSHA's decision to include these
clarifying revisions to paragraph (b)(1)(i) in the final rule.
Commenters cited studies suggesting that employees are deterred from
reporting injuries and illnesses where the procedure for doing so is
too difficult. For example, Scherzer et al. (2005) found that many
hotel room cleaners failed to report work-related pain to management
because it took too many steps to do so (Ex. 1695). The revisions to
paragraph (b)(1) clarify that such unduly burdensome reporting
procedures would violate the final rule.
    Commenters also raised concerns about rigid prompt-reporting
requirements in place at some workplaces that have resulted in employee
discipline for late reporting even though employees could not
reasonably have reported their injuries or illnesses earlier. See,
e.g., Exs. 1675, 1679, 1695, 1696. Several of these commenters
highlighted issues related to musculoskeletal disorders because such
disorders develop over time and therefore cannot be reported
immediately after an individual incident. The comment by the AFL-CIO
(Ex. 1695) typifies the views of these commenters:

    Many employers have policies that require the immediate
reporting of a work-related injury by the worker, and for some
employers failure to follow this requirement will result in
discipline, regardless of the circumstances. In some cases workers
may be unaware that they have suffered an injury, since the pain or
symptoms do not manifest until later . . . This is particularly true
for musculoskeletal injuries. The worker reports the injury when
they recognize it has occurred, but are disciplined because the
reporting did not occur until after the event that caused the injury
occurred.

    OSHA shares these concerns. Employer reporting requirements must
account for injuries and illnesses that build up over time, have
latency periods, or do not initially appear serious enough to be
recordable. The United Food and Commercial Workers International Union
provides several examples of food processing workers receiving
discipline for ``late'' reporting where it was not reasonable to have
expected the injured employee to report earlier. In one such case, a
worker reported shoulder and neck pain that had developed gradually due
to work-related repetitive motions beginning one week earlier. Although
there was no single incident that precipitated the injury, the worker
received a ``final warning'' for failure to ``timely report an injury''
(Ex. 1679). This policy was not reasonable because it did not allow for
reporting within a reasonable time after the employee realized that he
or she had suffered a work-related injury.
    OSHA disagrees with comments that express support for employers who
require immediate reporting of injuries and illnesses on the grounds
that such requirements are necessary for accurate recordkeeping, to
prevent fraud, and to address injuries before they get worse (Exs.
1449, 1658, 1663). OSHA recognizes that employers have a legitimate
interest in maintaining accurate records and ensuring that employees
are reporting genuine work-related injuries and illnesses in a
reasonably prompt manner. These interests, however, must be balanced
with fairness to employees who cannot reasonably discover their
injuries or illnesses within a rigid reporting period and with the
overriding objective of part 1904 to ensure that all recordable work-
related injuries and illnesses are recorded. Accordingly, for a
reporting procedure to be reasonable and not unduly burdensome, it must
allow for reporting of work-related injuries and illnesses within a
reasonable timeframe after the employee has realized that he or she has
suffered a work-related injury or illness.
    A few commenters questioned whether reporting of work-related
injuries and illnesses is properly characterized as an employee right,
as opposed to an employee obligation. The Act provides that employees
and employers ``have separate but dependent responsibilities and rights
with respect to achieving safe and healthful working conditions.'' 29
U.S.C. 651(b)(2). Part 1904 imposes the obligation to record and report
work-related injuries and illnesses on the employer. See 29 CFR 1904.4.
In turn, employers may require employees to report work-related
injuries and illnesses, as long as the procedures for doing so are
reasonable and the employer does not retaliate against employees when
they report.

    Some commenters expressed concern that the requirement described in
the proposed rule--that reporting procedures ``be reasonable and not
unduly burdensome''--was ambiguous and vague. See, e.g., Exs. 1532,
1566. The final rule provides that employers must establish a
``reasonable'' procedure for employees to report work-related injuries
and illnesses and clarifies that a reporting procedure is not
reasonable if it would deter or discourage a reasonable employee from
reporting. OSHA did not include the phrase ``unduly burdensome'' in the
final rule. The ``reasonable person'' standard is an objective standard
that is well-established and applied in many areas of the law, and
which can be applied by laypeople without the use of experts. See
Godfrey v. Iverson, 559 F.3d 569, 572 (D.C. Cir. 2009). OSHA believes
the final rule's requirement that employers establish a reporting
procedure that would not deter or discourage a reasonable employee from
reporting work-related injuries and illnesses is sufficiently clear to
notify employers of their obligations under the rule while giving
employers flexibility to design policies that make sense for their
workplaces. Like the previous version of the rule, the final rule
imposes a performance requirement rather than prescribing specific
procedures employers must establish, and therefore gives employers
flexibility to tailor their programs to the needs of their workplaces.
See 66 FR 6052 (Jan. 19, 2001).
Section 1904.35(b)(1)(iv): Prohibition of Discrimination Against
Employees for Reporting a Work-Related Injury or Illness
    The final rule adds paragraph (b)(1)(iv) to Sec.  1904.35 to
incorporate explicitly into part 1904 the existing prohibition on
retaliating against employees for reporting work-related injuries or
illnesses that is already imposed on employers under section 11(c) of
the OSH Act. As discussed in the Legal Authority section of this
preamble, paragraph (b)(1)(iv) of the final rule does not change the
substantive obligations of employers. Rather, paragraph (b)(1)(iv)
provides OSHA an enhanced enforcement tool for ensuring the accuracy of
employer injury and illness logs. Section 1904.36 of the final rule
further clarifies that section 11(c) also prohibits retaliating against
employees for reporting work-related injuries or illnesses, as
explained in the 2012 OSHA enforcement memorandum. See OSHA Memorandum
re: Employer Safety Incentive and Disincentive Policies and Practices
(Mar. 12, 2012). OSHA believes only a minority of employers engages in
prohibited retaliation, and the final rule will enable more effective
enforcement against those employers.
    A number of commenters stated that there is no need to amend Sec.
1904.35 to prohibit retaliating against employees for reporting
injuries and illnesses because Section 11(c) of the Act already
prohibits such retaliation. See, e.g., Exs. 1473, 1549, 1655, 1662.
OSHA disagrees. Although the substantive obligations of employers will
not change under the new rule, the rule will have an important
enforcement effect. Section 11(c) only authorizes the Secretary to take
action against an employer for retaliating against an employee for
reporting a work-related illness or injury if the employee files a
complaint with OSHA within 30 days of the retaliation. 29 U.S.C.
660(c). The final rule provides OSHA with an additional enforcement
tool for ensuring the accuracy of work-related injury and illness
records that is not dependent on employees filing complaints on their
own behalf. Some employees may not have the time or knowledge necessary
to file a section 11(c) complaint or may fear additional retaliation
from their employer if they file a complaint. The final rule allows
OSHA to issue citations to employers for retaliating against employees
for reporting work-related injuries and illnesses and require abatement
even if no employee has filed a section 11(c) complaint.
    Additionally, as noted by one commenter, adding a prohibition on
retaliation to part 1904 provides clear notice to employers of what
actions are prohibited, which will help to prevent retaliatory acts
from occurring in the first place (Ex. 1561). In other words, the final
rule serves a preventive purpose as well as a remedial one. The new
rule also differs from section 11(c) because it is specifically
designed to promote accurate recordkeeping. For comparison, under the
medical removal protection (MRP) provision of the lead standard, if an
employer denies MRP benefits in retaliation for an employee's exercise
of a right under the Act, OSHA can cite the employer and seek the
benefits as abatement, because payment of the benefits is important to
vindicate the health interests underlying MRP; section 11(c) is not an
exclusive remedy. United Steelworkers, AFL-CIO v. St. Joe Resources,
916 F.2d 294, 298 (5th Cir. 1990). Likewise, here OSHA can cite
employers under the final rule in order to advance the rule's purpose
of promoting accurate recordkeeping, which is grounded in OSHA's
authority under Section 8(c)(2) of the OSH Act (29 U.S.C. 657(c)(2)) to
require employers to maintain accurate records of work-related injuries
and illnesses.
    OSHA anticipates that feasible abatement methods for violations of
paragraph (b)(1)(iv) will mirror some of the types of remedies
available under section 11(c); the goal of abatement would be to
eliminate the source of the retaliation and make whole any employees
treated adversely as a result of the retaliation. For example, if an
employer terminated an employee for reporting a work-related injury or
illness, a feasible means of abatement would be to reinstate the
employee with back pay. See McKennon v. Nashville Banner Pub. Co., 513
U.S. 352, 362 (1995) (citing Franks v. Bowman Transp. Co., 424 U.S.
747, 764 (1976)) (``[T]he object of compensation is to restore the
employee to the position he or she would have been in absent the
discrimination.''); St. Joe Resources, 916 F.2d at 299 (Occupational
Safety and Health Review Commission may order employers to pay back pay
as abatement for violations of the MRP requirements). If an employer
retaliates against an employee for reporting a work-related illness or
injury by denying a bonus to a group of employees, feasible means of
abatement could include revising the bonus policy to correct its
retaliatory effect and providing the bonus retroactively to all of the
employees who would have received it absent the retaliation.
    Some commenters acknowledged that the proposed rule gives OSHA
additional enforcement tools but argued that doing so impermissibly
interferes with section 11(c) by infringing on an employee's right to
bring a section 11(c) claim and by eliminating section 11(c)'s 30-day
window for employees to bring complaints. The final rule does not
abrogate or interfere with the rights or restrictions contained in
section 11(c). An employee who wishes to file a complaint under section
11(c) may do so within the statutory 30-day period regardless of
whether OSHA has issued, or will issue, a citation to the employer for
violating the final rule. OSHA believes that many employees will
continue to file 11(c) complaints because of the broader range of
equitable relief and punitive damages available under that provision.
Finally, one commenter suggested that retaliation cases are too complex
and fact-based to be suitable subjects of enforcement citations. Ex.
1645. OSHA disagrees. OSHA regularly issues citations based on complex
factual scenarios and will provide its staff with appropriate training
about enforcing the final rule.

    Discrimination citable under paragraph (b)(1)(iv) could include
termination, reduction in pay, reassignment to a less desirable
position, or any other adverse action that ``could well dissuade'' a
reasonable employee from reporting a work-related injury or illness.
See Burlington Northern & Santa Fe Railway Co. v. White, 548 U.S. 53,
57 (2006) (holding that the test for determining whether a particular
action is materially adverse is whether it would deter a reasonable
person from engaging in protected activity under Title VII). The
Burlington Northern case considered whether a particular action would
deter a reasonable person from filing a claim of sex discrimination. In
the context of the final rule, the test would be whether the action
would deter a reasonable employee from reporting a work-related injury
or illness. Commenters placed substantial emphasis on three specific
types of policies, discussed in more detail below: Disciplinary
policies, post-accident drug testing policies, and employee incentive
programs.
    Commenters cited numerous examples of employers disciplining
employees who report injuries regardless of whether the employee
violated company safety policy. See, e.g., Exs. 1675, 1679, 1681, 1691,
1695, 1696. Although it is an employer's duty to enforce safety rules,
disciplining an employee simply for reporting an injury or illness
deters employees from reporting injuries and illnesses without
improving safety. Numerous commenters identified cases in which
employers suspended, reassigned, or even terminated employees simply
for being injured. See, e.g., Ex. 1695, attachment 16 (employee
suspended, placed on work restrictions, and threatened with termination
for having too many OSHA-recordable injuries), Ex. 1675 (employees
suspended for having been injured), Ex. 1681 (employees harassed and
terminated for reporting injuries or filing for workers compensation),
Ex. 1679 (employees terminated for being injured). Some commenters
pointed out progressive disciplinary policies involving increasingly
serious sanctions for additional reports. See, e.g., Exs. 1675, 1695.
Others pointed to employer policies that make employees who report
injuries ineligible for promotions (Ex. 1675) or automatically give
poor performance evaluations to employees who report OSHA-recordable
injuries (Ex. 1696). A report by the U.S. House of Representatives
Committee on Education and Labor made a similar finding that many forms
of ``direct intimidation'' are used by employers to discourage
reporting. See Hidden Tragedy: Underreporting of Workplace Injuries and
Illnesses, Majority Staff Report by the Committee on Education and
Labor, U.S. House of Representatives (June 2008); Exs. 1675, 1679,
1695. Under paragraph (b)(1)(iv) of the final rule, OSHA can issue
citations to employers who discipline workers for reporting injuries
and illnesses when no legitimate workplace safety rule has been
violated.
    In addition, the United Steel, Paper and Forestry, Manufacturing,
Energy, Allied Industrial and Service Workers International Union (USW)
identified a number of cases where employers engaged in pretextual
disciplinary actions--asserting that an employee was being disciplined
for violating a safety rule where the real reason was the employee's
injury or illness report (Ex. 1675). This includes situations when
reporting employees are disciplined more severely than other employees
who worked in the same way, or when reporting employees are selectively
disciplined for violation of vague work rules such as ``work
carefully'' or ``maintain situational awareness.'' Vague work rules are
particularly subject to abuse by the employer and would not be
considered legitimate workplace safety rules when they are used
disproportionately to discipline workers who have reported an injury or
illness. In contrast, a legitimate workplace safety rule should require
or prohibit specific conduct related to employee safety or health so it
can be applied fairly and not used as a pretext for retaliation. The
AFL-CIO identified a series of cases in which a Michigan administrative
law judge upheld findings of the Michigan Occupational Safety and
Health Administration that AT&T used these types of vague safety
policies as pretext for retaliating against employees who reported
workplace injuries. See Ex. 1695 (citing AT&T Servs. v. Aggeler, No. D-
11-242-1 (Mich. Admin. Hearing Sys., Jan. 13, 2013); AT&T Servs. v.
Wright, No. D-11-101-1 (Mich. Admin. Hearing Sys., Apr. 8, 2013); AT&T
Servs. v. Swift, No. D-11-200-1 (Mich. Admin. Hearing Sys., Mar. 6,
2013); AT&T Servs. v. West, No. D-11-311-1 (Mich. Admin. Hearing Sys.,
Apr. 23, 2013)). And even a legitimate work rule may not be applied
selectively to discipline workers who report work-related illnesses or
injuries but not employees who violate the same rule without reporting
a work-related injury or illness. Paragraph (b)(1)(iv) of the final
rule authorizes OSHA to issue citations to employers who engage in such
pretextual disciplinary actions.
    OSHA believes that the majority of employers do not discipline
employees unless they have actually broken a legitimate workplace
safety or health rule and do not selectively discipline employees who
violate legitimate work rules only when they also report a work-related
injury or illness. But in the minority of workplaces where employers
may sanction employees for reporting, it is no surprise that workers
are deterred from reporting because they fear the consequences of doing
so. See above regarding worker fear of reporting work-related injuries
and illnesses. Data collected during OSHA's National Emphasis Program
on Injury and Illness Recordkeeping (Recordkeeping NEP) show that among
the surveyed workplaces where such disciplinary policies exist,
approximately 50 percent of workers reported that the policy deterred
reporting. See Analysis of OSHA's National Emphasis Program on Injury
and Illness Recordkeeping, Prepared for the Office of Statistical
Analysis, Occupational Safety and Health Administration, by ERG (Nov.
1, 2013); Ex. 1835. Therefore, OSHA expects that enforcement of the
provisions in the final rule will improve the rate and accuracy of
injury and illness reporting.
    OSHA received a number of comments expressing concern that this
section of the final rule will have a chilling effect on employers
disciplining employees who violate safety rules, thereby contributing
to a less safe work environment. It is important to note that the final
rule prohibits employers only from taking adverse action against an
employee because the employee reported an injury or illness. Nothing in
the final rule prohibits employers from disciplining employees for
violating legitimate safety rules, even if the same employee who
violated a safety rule also was injured as a result of that violation
and reported that injury or illness (provided that employees who
violate the same work rule are treated similarly without regard to
whether they also reported a work-related illness or injury). What the
final rule prohibits is retaliatory adverse action taken against an
employee simply because he or she reported a work-related injury or
illness.
    Commenters also pointed to policies mandating automatic post-injury
drug testing as a form of adverse action that can discourage reporting.
See, e.g., Exs. 1675, 1695. Although drug testing of employees may be a
reasonable workplace policy in some situations, it is often perceived
as an invasion of privacy, so if an injury or illness is very

unlikely to have been caused by employee drug use, or if the method of
drug testing does not identify impairment but only use at some time in
the recent past, requiring the employee to be drug tested may
inappropriately deter reporting. The U.S. House of Representatives
Committee on Education and Labor has recognized that ``to intimidate
workers, employers may require that workers are tested for drugs or
alcohol [after every incident or injury], irrespective of any potential
role of drug intoxication in the incident'' (Exs. 1675, 1679, 1695).
The Committee also pointed to Scherzer et al. (2005), which found that
32 percent of surveyed Las Vegas hotel workers who reported work-
related pain were forced to take drug tests, even though studies like
Krause et al. (2005) show that such injuries are often caused by
physical workload, work intensification, and ergonomic problems--not by
workplace mistakes that could have been caused by drugs. Id. The
American National Standards Institute (ANSI) has similarly recognized
the need for drug testing programs to be ``carefully designed and
implemented to ensure employees are not discouraged from effective
participation in [injury and illness reporting programs]'' (Ex. 1695).
    OSHA believes the evidence in the rulemaking record shows that
blanket post-injury drug testing policies deter proper reporting.
Morantz and Mas (2008) conducted a study on a large retail chain and
found that post-accident drug testing caused a substantial reduction in
injury claims. The authors found suggestive evidence that at least part
of that reduction was due to the reduced willingness of employees to
report accidents (Ex. 1675). Crant and Bateman (1989) describe privacy
concerns and other individual factors that can affect employee
willingness to participate in drug testing programs and report
accidents. Id. OSHA's Recordkeeping NEP data also supports that
hypothesis because many workers reported that such post-injury drug
testing programs deterred reporting (Ex. 1695).
    Some commenters stated their belief that drug testing of employees
is important for a safe workplace; some expressed concern that OSHA
planned a wholesale ban on drug testing (Exs. 1667, 1674). To the
contrary, this final rule does not ban drug testing of employees.
However, the final rule does prohibit employers from using drug testing
(or the threat of drug testing) as a form of adverse action against
employees who report injuries or illnesses. To strike the appropriate
balance here, drug testing policies should limit post-incident testing
to situations in which employee drug use is likely to have contributed
to the incident, and for which the drug test can accurately identify
impairment caused by drug use. For example, it would likely not be
reasonable to drug-test an employee who reports a bee sting, a
repetitive strain injury, or an injury caused by a lack of machine
guarding or a machine or tool malfunction. Such a policy is likely only
to deter reporting without contributing to the employer's understanding
of why the injury occurred, or in any other way contributing to
workplace safety. Employers need not specifically suspect drug use
before testing, but there should be a reasonable possibility that drug
use by the reporting employee was a contributing factor to the reported
injury or illness in order for an employer to require drug testing. In
addition, drug testing that is designed in a way that may be perceived
as punitive or embarrassing to the employee is likely to deter injury
reporting.
    A few commenters also raised the concern that the final rule will
conflict with drug testing requirements contained in workers'
compensation laws. This concern is unwarranted. If an employer conducts
drug testing to comply with the requirements of a state or federal law
or regulation, the employer's motive would not be retaliatory and the
final rule would not prohibit such testing. This is doubly true because
Section 4(b)(4) of the Act prohibits OSHA from superseding or affecting
workers' compensation laws. 29 U.S.C. 653(b)(4).
    Finally, many commenters expressed concern with the retaliatory
nature of the employee incentive programs at some workplaces, providing
myriad examples. See, e.g., Exs. 1661, 1675, 1679, 1695. Employee
incentive programs take many forms. An employer might enter all
employees who have not been injured in the previous year in a drawing
to win a prize, or a team of employees might be awarded a bonus if no
one from the team is injured over some period of time. Such programs
might be well-intentioned efforts by employers to encourage their
workers to use safe practices. However, if the programs are not
structured carefully, they have the potential to discourage reporting
of work-related injuries and illnesses without improving workplace
safety. The USW provided many examples of employer incentive policies
that could discourage reporting of work-related injuries and illnesses.
Ex. 1675. One employer had a policy that involved periodic prize
drawings for items such as a large-screen television; workers who
reported an OSHA-recordable injury were excluded from the drawing. Id.
The American College of Occupational and Environmental Medicine noted
that many of its member physicians reported knowledge of situations
where employers discouraged injury and illness reporting through
incentive programs predicated on workers remaining ``injury free,''
leading to peer pressure on employees not to report (Ex. 1661).
    In addition, in recent years, a number of government reports have
raised concerns about the effect of incentive programs on injury and
illness reporting. A 2012 GAO study found that rate-based incentive
programs, which reward workers for achieving low rates of reported
injury and illnesses, may discourage reporting. Ex. 1695. Other, more
positive incentive programs, which reward workers for activities like
recommending safety improvements, did not have the same effect. A
previous GAO study had also highlighted incentive programs as a cause
of underreporting of work-related injuries and illnesses (Exs. 1675,
1695). The 2008 House Report listed examples of problematic incentive
programs and found that ``depending on how an incentive program is
structured, reluctance to lose the bonus or peer pressure from other
crew members whose prizes are also threatened reduces the reporting of
injuries and illnesses in the job, rather than reducing the actual
number of workplace injuries and illnesses'' (Exs. 1675, 1679, 1695).
In 2006, a report by the California State Auditor found that an
employee incentive program had likely caused the significant
underreporting of injuries by the company working on reconstruction of
a portion of the San Francisco Bay Bridge (Ex. 1695). The company
offered employees monetary incentives up to $1,500 only if zero
recordable injuries were reported. This kind of incentive program is
especially likely to discourage reporting because not only will the
injured employee not receive the prize after reporting an injury, but
the employee is even less likely to report out of fear of angering or
disappointing the coworkers who will also be denied the prize, or
because the coworkers actively pressure the worker not to report.
    OSHA has previously recognized that incentive programs that
discourage employees from reporting injuries and illnesses by denying a
benefit to employees who report an injury or illness may be prohibited
by section 11(c). See OSHA Memorandum re:

Employer Safety Incentive and Disincentive Policies and Practices (Mar.
12, 2012); see also ANSI/AIHA Z10-2012, Ex. 1695, attachment 5
(``incentive programs . . . should be carefully designed and
implemented to ensure employees are not discouraged from effective
participation in [injury and illness reporting programs''). The same
memorandum pointed out that, to the extent incentive programs cause
under-reporting, they can result in under-recording of injuries and
illnesses, which may lead to employer liability for inaccurate
recordkeeping. The latter concern is what is being addressed by this
final rule's prohibition on employers using incentive programs in a way
that impairs accurate recordkeeping.
    Some commenters expressed satisfaction with existing safety
incentive programs that provide monetary incentives to employees who
maintain low blood lead levels, and requested that OSHA not undermine
such programs (Exs. 1488, 1654, 1683). OSHA does not intend the final
rule to categorically ban all incentive programs. However, programs
must be structured in such a way as to encourage safety in the
workplace without discouraging the reporting of injuries and illnesses.
    The specific rules and details of implementation of any given
incentive program must be considered to determine whether it could give
rise to a violation of paragraph (b)(1)(iv) of the final rule. It is a
violation of paragraph (b)(1)(iv) for an employer to take adverse
action against an employee for reporting a work-related injury or
illness, whether or not such adverse action was part of an incentive
program. Therefore, it is a violation for an employer to use an
incentive program to take adverse action, including denying a benefit,
because an employee reports a work-related injury or illness, such as
disqualifying the employee for a monetary bonus or any other action
that would discourage or deter a reasonable employee from reporting the
work-related injury or illness. In contrast, if an incentive program
makes a reward contingent upon, for example, whether employees
correctly follow legitimate safety rules rather than whether they
reported any injuries or illnesses, the program would not violate this
provision. OSHA encourages incentive programs that promote worker
participation in safety-related activities, such as identifying hazards
or participating in investigations of injuries, incidents, or ``near
misses.'' OSHA's Voluntary Protection Program (VPP) guidance materials
refer to a number of positive incentives, including providing t-shirts
to workers serving on safety and health committees; offering modest
rewards for suggesting ways to strengthen safety and health; or
throwing a recognition party at the successful completion of company-
wide safety and health training. See Revised VPP Policy Memo #5:
Further Improvements to the Voluntary Protection Programs (August 14,
2014).

VI. Final Economic Analysis and Regulatory Flexibility Certification

A. Introduction

    Executive Orders 12866 and 13563 require that OSHA estimate the
benefits, costs, and net benefits of proposed and final regulations.
Executive Orders 12866 and 13563, the Regulatory Flexibility Act, and
the Unfunded Mandates Reform Act also require OSHA to estimate the
costs, assess the benefits, and analyze the impacts of certain rules
that the Agency promulgates. Executive Orders 12866 and 13563 direct
agencies to assess all costs and benefits of available regulatory
alternatives and, if regulation is necessary, to select regulatory
approaches that maximize net benefits (including potential economic,
environmental, public health and safety effects, distributive impacts,
and equity). Executive Order 13563 emphasizes the importance of
quantifying both costs and benefits, reducing costs, harmonizing rules,
and promoting flexibility.
    In the proposal, OSHA estimated that this rule would have economic
costs of $11.9 million per year, including $10.7 million per year to
the private sector, with costs of $183 per year for affected
establishments with 250 or more employees and $9 per year for affected
establishments with 20 or more employees in designated industries. The
Agency believed that the annual benefits, while unquantified,
significantly exceed the annual costs.
    In this final rule, OSHA estimates that the rule will have economic
costs of $15.0 million per year, including $14 million per year to the
private sector with costs of $214 per year to affected establishments
with 250 or more employees and $11.13 per year for affected
establishments with 20 to 249 employees in designated industries. The
Agency continues to believe that the annual benefits, while
unquantified, significantly exceed the annual costs.
    The final rule is not an ``economically significant regulatory
action'' under Executive Order 12866 or the Unfunded Mandates Reform
Act (UMRA) (2 U.S.C. 1532(a)), and it is not a ``major rule'' under the
Congressional Review Act (5 U.S.C. 801 et seq.). The Agency estimates
that the rulemaking imposes far less than $100 million in annual
economic costs. In addition, it does not meet any of the other criteria
specified by UMRA or the Congressional Review Act for a significant
regulatory action or major rule. This Final Economic Analysis (FEA)
addresses the costs, benefits, and economic impacts of the final rule.
    The final rule will make four changes to the existing recording and
reporting requirements in part 1904. These changes in existing
requirements differ somewhat from those in the proposed rule.
    First, OSHA will require establishments that are required to keep
injury and illness records under part 1904, and that had 250 or more
employees in the previous year, to electronically submit the required
information from all three OSHA recordkeeping forms to OSHA or OSHA's
designee, on an annual basis.
    Second, OSHA will require establishments that are required to keep
injury and illness records under part 1904, had 20 to 249 employees in
the previous year, and are in certain designated industries, to
electronically submit the required information from the OSHA annual
summary form (Form 300A) to OSHA or OSHA's designee, on an annual
basis.
    Third, OSHA will require all employers who receive notification
from OSHA to electronically submit the requested information from their
injury and illness records to OSHA or OSHA's designee. Any such
notification will be subject to the approval process established by the
Paperwork Reduction Act.
    Fourth, OSHA will require employers to inform employees of their
right to report injuries and illness and prohibit discrimination
against employees who report injuries and illnesses.
    The final rule does not add to or change any employer's obligation
to complete, retain, and certify injury and illness records. The final
rule also does not add to or change the recording criteria or
definitions for these records. The only changes are that, under certain
circumstances, employers will be obligated to submit information from
these records to OSHA in an electronic format and to assure that
employees have, and understand they have, a right to report injuries
and illnesses without fear of discrimination. OSHA requested comments
and received many helpful comments throughout this process. For
example, one commenter suggested that OSHA should run a pilot program
of electronic reporting (Ex. 1109). In many

ways, OSHA's previous collection of these data through the OSHA Data
Initiative (the ODI) was a lengthy pilot program, and a successful one
which lasted for almost 20 years. This final rule is an extension of
that effort, by expanding the collection to involve more establishments
and to collect a larger set of injury and illness data. For many of the
establishments affected by this final rule, the data submitted will be
identical to the data that was collected by the ODI.
    As OSHA explained in the preamble to the proposed rule, the
electronic submission of information to OSHA would be a relatively
simple and quick matter. In most cases, submitting information to OSHA
would require several basic steps: (1) Logging on to OSHA's web-based
submission system; (2) entering basic establishment information into
the system (the first time only); (3) copying the required injury and
illness information from the establishment's records into the
electronic submission forms; and (4) hitting a button to submit the
information to OSHA. In many cases, especially for large
establishments, OSHA data are already kept electronically, so step 3
would be less time-intensive relative to cases in which records are
kept on paper. The submission system, as anticipated, would also save
an establishment's information from one submission to the next, so step
2 might be eliminated for most establishments after the first
submission.
    Many commenters questioned whether the process would be this
simple. OSHA will first examine the costs of the activities outlined