An inquiry asked how OSHA's recordkeeping access rules work when injury and illness records live in a software application: who can see the confidential list of names for privacy concern cases, and whether permanent online login access can replace paper copies.
OSHA confirmed that government representatives do have access to the privacy concern case list. Under 29 CFR 1904.29(b)(6), employers must withhold injured employees' names from the OSHA 300 log for privacy concern cases, entering 'privacy concern case' instead, and must keep a separate confidential list of those names and case numbers. That list must be provided to government representatives on request during inspections.
Beyond the government, disclosure of forms with personally identifying information is limited under 29 CFR 1904.29(b)(10) to an auditor or consultant hired to evaluate the safety and health program, the extent necessary to process a workers' compensation or insurance claim, or a public health authority or law enforcement agency. Names must be removed or hidden before giving forms to anyone else.
On software itself: nothing in the recordkeeping rule prohibits online database access, but individuals keep the right to request paper copies, and the system must support differentiated access — full access for government representatives, but individual employees see only their own 301 incident reports. Finally, OSHA does not approve, endorse, recommend, or certify any recordkeeping software product.