The 300 Log is a document employees have a right to see, so the rule carves out a short, exclusive list of cases where the name comes off.
The list. You must consider the following to be privacy concern cases: an injury or illness to an intimate body part or the reproductive system; an injury or illness resulting from a sexual assault; mental illnesses; HIV infection, hepatitis, or tuberculosis; needlestick injuries and cuts from sharp objects that are contaminated with another person's blood or other potentially infectious material; and other illnesses, if the employee voluntarily requests that his or her name not be entered on the log (29 CFR 1904.29(b)(7)). May you add others? No — this is a complete list (29 CFR 1904.29(b)(8)). The sixth item covers illnesses only; an employee cannot ask to have an injury anonymized.
How to record. If you have a privacy concern case, do not enter the employee's name on the 300 Log; enter "privacy case" in the space normally used for the name, and keep a separate, confidential list of the case numbers and employee names so that cases can be updated and information provided to the government if asked (29 CFR 1904.29(b)(6)). The privacy case list is itself a record retained for five years (29 CFR 1904.33(a)).
Going further. If you reasonably believe that the description of the injury itself could identify the person even with the name withheld, you may use discretion in describing the case on the Log (29 CFR 1904.29(b)(9)). When you give access to the forms to anyone other than the government or an authorized representative, you must remove or hide the names of privacy concern cases before release (29 CFR 1904.29(b)(10)).
Needlestick cases are the one category that surprises people outside healthcare: a contaminated sharps injury in any workplace is a privacy concern case by rule, request or not.