Today OSHA formally published a Notice of Proposed Rulemaking (NPRM) in the Federal Register revising the Obama-era regulation,  Improve Tracking of Workplace Injuries and Illnesses. The proposed rule rescinds the requirement for establishments with 250 or more employees to electronically submit information from the OSHA 300 Log and 301 Form and adds a requirement for covered establishments to include the Employer Identification Number (EIN) with their submissions.

Due to the potential risk of disclosure of private employee information and the lack of uncertain enforcement benefits from collecting the 300 Log and 301 Form, OSHA is proposing to eliminate that requirement.  In the Federal Register OSHA noted,

The injury and illness data electronically submitted to OSHA from Form 300A…gives OSHA a great deal of information to use in identifying high-hazard establishments for enforcement targeting. To that end, OSHA has designed a targeted enforcement mechanism for industries experiencing higher rates of injuries and illnesses based on the summary data.  By contrast, OSHA has provisionally determined that electronic submission of Forms 300 and 301 adds uncertain enforcement benefits, while significantly increasing the risk to worker privacy, considering that those forms, if collected by OSHA, could be found disclosable under FOIA [Freedom of Information Act].

Further, OSHA is proposing to add a requirement for employers to include their EIN in an effort to avoid duplicative reporting.

Collecting EINs would increase the likelihood that the Bureau of Labor Statistics (BLS) would be able to match data collected by OSHA under the electronic reporting requirements to data collected by BLS for the Survey of Occupational Injury and Illness (SOII).

OSHA has specifically raised the following questions:

1. What risks to worker privacy are posed by the electronic collection of information from Forms 300 and 301 from establishments with 250 or more workers?  How likely are these risk to materialize?  How could OSHA make them less likely, and what resources would be required? Given the limitations identified above, what are the benefits of electronically collecting this information?
2. Besides the Bureau of Labor Statistics, what other agencies or organizations in the public and private sectors use automated coding (autocoding) systems for text data in data collections?
3. Besides the Department of Health and Human Services, what other agencies and organizations in the public and private sectors use automated de-identification systems to remove PII from text data before making the data available to the public? What challenges have they faced in using those systems to keep PII protected?
4. Would employers required to electronically report information to OSHA under part 1904 consider the EIN to be exempt from disclosure [under FIOA], either as confidential business information of for another reason? Are there any circumstances where the EIN would be considered Personally Identifiable Information (PII)? OSHA also seeks comments on privacy concerns that might arise from employers submitting their EIN.

Unfortunately, the proposed regulation does not address the anti-retaliation provisions including whether certain policies are considered unreasonable and deter employees from reporting injuries and illnesses and therefore are in violation of the rule.  The agency had previously vocalized that policies such as certain drug testing and safety incentive programs were prohibited under the rule. As such, that employers would be subject to citations for such allegedly discriminatory policies despite Congressional intent that Section 11(c) of the OSH Act provide the exclusive remedy for employees who experience retaliatory and discriminatory conduct in relation to safety and health.

OSHA made clear in the proposed rule that the agency was only seeking comments on the electronic submission and EIN and “not on any other aspects of part 1904.”  This signals OSHA is unlikely to change those Obama-era requirements despite significant objection from the employer community.

Public comments are due 60 days from today’s publication, September 30.