OSHA Form 300A: Posting deadlines, filing rules and penalties

Key takeaways

OSHA Form 300A is the annual summary of work-related injuries and illnesses, posted from February 1 through April 30.

Employers with 11 or more employees at any point in the year must keep and post it, with narrow exemptions for small and low-hazard employers.

Three establishment tiers must also file their 300A data through OSHA’s Injury Tracking Application by March 2.

A company executive has to certify the totals, and a safety director or HR manager cannot sign in their place.

Keep each summary for five years, and hand employees the Form 300 log by the end of the next business day on request.

OSHA Form 300A is the annual summary of work-related injuries and illnesses, and covered employers must post it from February 1 through April 30. Any employer with 11 or more employees at any point in the year has to keep one, unless a partial exemption applies.

The federal recordkeeping forms are free, so the compliance work is in the totals, the signature, and the dates. This guide covers who files, what belongs in each field, and how the posting window works.

It also sets out the three electronic submission tiers that most summaries of this rule collapse into one. You get the current penalty amounts too, plus the points where California diverges from federal OSHA.

What is OSHA Form 300A?

Form 300A is the Summary of Work-Related Injuries and Illnesses. It rolls 12 months of Form 300 entries into totals. Those totals cover recordable cases, days away from work, job transfers, and the injury and illness categories. Employees read the same numbers when the form goes up on the wall.

The duty comes from 29 CFR Part 1904, the OSHA recordkeeping rule. Any employer required to keep injury records completes one summary per establishment, per year. The form is still required in a year with zero recordable cases. In that case the totals read zero and an executive signs it anyway.

How the 300A differs from Forms 300 and 301

OSHA recordkeeping runs on three forms with three separate jobs. Only one of them is ever posted where employees can read it.

Form 300 is the detail, Form 301 is the case file, and Form 300A is the number the public sees. Form 301 is OSHA’s own incident report, and many practices capture the same details on an internal incident report form first. Whichever you use, the log and the summary have to agree.

Who has to complete and post the summary

Coverage turns on two questions: how many people worked at the establishment, and which industry it sits in.

• Required: employers with 11 or more employees at any point during the calendar year keep OSHA records and post Form 300A.
• Partially exempt by size: employers with 10 or fewer employees are generally excused from routine recordkeeping. Narrow exceptions still apply.
• Partially exempt by industry: certain low-hazard industries are excused even above 11 employees. Retail, insurance, real estate, and finance are the common examples.
• Counted per establishment: the threshold applies to each physical site, not to the company. Twelve employees spread across three locations may not trip it anywhere.
• Still covered by the reporting rules: a partially exempt employer must still report a fatality, an inpatient hospitalization, an amputation, or an eye loss.

Being exempt from the routine paperwork is not the same as being outside the rule. OSHA can also ask a partially exempt employer to keep records for a survey year. Details on the boundaries sit in OSHA’s Injury Tracking Application FAQs.

What goes on the form

Every field on the summary is pulled from the Form 300 log or from payroll. Nothing on it is an estimate, which is why inspectors reconcile it line by line.

• Establishment details: legal business name, street address, city, state, and the industry description plus its NAICS code.
• Employment figures: the annual average number of employees and the total hours worked by all employees during the year.
• Case totals: total deaths, cases with days away from work, cases with job transfer or restriction, and other recordable cases.
• Day counts: total days away from work and total days of job transfer or restriction across all cases.
• Injury and illness categories: injuries, skin disorders, respiratory conditions, poisonings, hearing loss, and all other illnesses.
• Certification: the name, title, signature, and date of the company executive who attests that the entries are true, accurate, and complete.

The certification is the field most often filled in wrongly. Under 29 CFR 1904.32 the signer must be the company owner or an officer of the corporation. The highest-ranking official at the establishment, or that person’s supervisor, also qualifies. A safety director or HR administrator does not.

How to fill it out, step by step

The work is a reconciliation, not a data-entry job. Run it in this order and the totals hold up under review.

1. Close the log first. Review all 12 months of Form 300 entries and confirm each case is genuinely recordable before you total anything.
2. Enter the establishment details. Add the name, address, industry description, and NAICS code. Multi-site employers complete a separate summary for each location.
3. Total the cases by column. Add up deaths, days-away cases, job-transfer cases, and other recordable cases. Then total the day counts and the six illness categories.
4. Add the employment figures. Pull the annual average employee count and total hours worked from payroll, since both feed the incidence-rate calculation.
5. Check the arithmetic against the log. Compare each total back to the Form 300 lines. Transposition errors and non-recordable cases are the two usual culprits.
6. Get the executive signature. Have the qualifying official read the summary, then sign and date the certification block.
7. Print and post it. Put the signed summary up in the same spot employees already check for workplace notices.

If you want an incidence rate for benchmarking, divide total recordable cases by total hours worked, then multiply by 200,000. That standardizes the figure to 100 full-time employees, so you can compare your site against published industry rates.

Posting rules: When and where it goes up

The window never moves. Every covered establishment posts its summary across the same three months, in a spot employees pass every day.

• Posting period: February 1 through April 30 each year. The summary stays up continuously for the whole 89-day window.
• Where it goes: wherever employee notices already live, such as a break room board, a time clock, or a staff corridor.
• One per site: each establishment posts its own summary. A single company-wide sheet does not satisfy the rule for multiple locations.
• Digital posting: an electronic copy is acceptable only where every employee at that site can reach it and read it easily.
• Coming down: May 1 is the first day the summary can be removed. The signed original then goes into the retention file.

The posting dates are the easy part. The two that trip practices up are the certification deadline underneath February 1, and the filing deadline a month later.

Inspectors check posting during and just after the window. A summary that went up on February 10 is a late posting, even though April 30 has not passed yet.

Electronic submission through OSHA’s Injury Tracking Application

Posting the summary and filing it with OSHA are two separate duties. Three establishment tiers have to file electronically, and they do not all send the same forms.

• Deadline: March 2 of the year after the calendar year the summary covers. Data for 2026 is due by March 2, 2027.
• How to file: use OSHA’s Injury Tracking Application. You create an account, register each establishment, and enter or upload the summary data.
• What the ITA wants: the case totals, the day counts, the six illness categories, the annual average employee count, and total hours worked.
• Check the appendix, not your assumption: the high-hazard lists are defined by NAICS code. Many outpatient and residential care codes appear on them.
• Filing does not replace posting: an establishment that submits through the ITA still posts a copy on the wall from February 1 to April 30.

How long to keep the records

Under 29 CFR 1904.33 you keep the summary, the Form 300 log, and the Form 301 reports for five years. The clock starts at the end of the year they cover. A 2026 summary is therefore on file through December 31, 2031.

Two things extend that clock. Records tied to an open citation or an ongoing OSHA investigation stay until the matter closes. Injury records also follow their own schedule, separate from the medical record retention rules that govern patient charts.

Access matters as much as retention. Under 29 CFR 1904.35 an employee, a former employee, or their representative can ask for the Form 300 log or their own Form 301. You have to provide it by the end of the next business day.

Five years of paper in a back office makes that hard. Practices that keep the summaries in audit-ready compliance software can pull any year on request instead.

Penalties for late posting or a missed filing

Recordkeeping citations carry the same maximums as any other OSHA violation. The figures below are the 2026 amounts, unchanged from January 2025.

• Other-than-serious violation: a violation that would not directly or immediately cause injury. Up to $16,550 per violation.
• Serious violation: a hazard that could cause injury or illness the employer knew or should have known about. Up to $16,550 per violation.
• Willful or repeated violation: deliberate non-compliance, or a repeat of the same standard. Up to $165,514 per violation.
• Failure to post: cited as a recordkeeping violation on its own. It stands whether or not anyone was injured that year.
• False statement: knowingly falsifying injury data or the certifying signature carries criminal exposure under 29 U.S.C. § 666(g).

Penalty maximums adjust each January for inflation, so confirm the current figures on OSHA’s penalty page before you cite them in a policy document.

Six mistakes that show up in inspections

The same six findings recur across recordkeeping citations. Each one is cheap to prevent and awkward to fix after the fact.

• The wrong person signed. A safety director or HR manager in the certification block invalidates it. Name the qualifying executive in your procedure so the question never comes up in February.
• Totals do not match the log. Transposed digits and non-recordable cases both inflate the counts. Reconcile the summary against the Form 300 lines before anyone signs.
• Posted late. February 1 is the deadline, not the start of a grace period. Work backward and close the log in mid-January.
• Posted somewhere nobody looks. A locked office or a portal half the staff cannot reach fails the visibility test. Use the board employees already read.
• Establishment data is wrong. A stale address or the wrong NAICS code makes the summary look unreliable and can move you into the wrong submission tier.
• Filed nothing when filing was required. If your site falls in one of the three ITA tiers, skipping the March 2 submission is a violation on its own.

California employers and Cal/OSHA

California runs its own state plan, so federal OSHA rules reach California employers through Cal/OSHA. The summary itself is the same form, but four practical differences are worth knowing.

• Same window, tighter culture: Cal/OSHA also requires posting from February 1 through April 30. Many California employers post in late January to leave room for error.
• Check the state guidance: confirm the current forms and instructions with the California Division of Occupational Safety and Health before you post.
• Higher penalties: California’s penalty schedule is generally stricter than the federal one, including for recordkeeping findings.
• Multi-state employers: keep separate records per site and apply the rules of the state each site sits in, not the rules at head office.

Washington, Oregon, and the other state-plan jurisdictions can also go beyond the federal floor, so verify locally if you operate outside federal OSHA states. Recordkeeping rarely travels alone, either. The inspector who asks for your 300A will usually ask for your written OSHA emergency action plan in the same visit.

How Pabau keeps injury records audit-ready

In most practices the injury record lives in three places at once. There is a paper incident form in a drawer, a spreadsheet someone maintains, and a folder of scanned summaries on a shared drive. That works until an employee asks for the log and you have one business day to produce it.

Practice management software like Pabau keeps the whole chain in one system. Staff log an incident through a digital form, the entry is timestamped and attributed, and the record sits alongside the rest of your compliance documentation. Retention is a setting rather than a calendar reminder, so a 2026 summary is still findable in 2031.

That changes what February looks like. Instead of rebuilding the year from a drawer, you export the log, reconcile the totals, and hand the executive a summary to sign. The five-year file stays searchable, so a records request takes minutes rather than an afternoon.

Keep injury records ready for a records request

Log incidents through digital forms, keep every entry timestamped and attributed, and retrieve any year’s summary in seconds. Your team spends February reconciling totals instead of rebuilding the log from paper.

Book a demo

Conclusion

Form 300A is a short form with a long tail. The sheet takes an hour. The totals on it depend on 12 months of honest logging, and the signature depends on someone with authority reading it first.

So the useful work happens in January, not in February. Close the log, reconcile the counts, confirm which ITA tier your site falls in, and book the executive’s time before the deadline arrives. Do that and posting is a five-minute task.

The trade-off worth remembering is storage. Five years of retention is easy to promise and hard to honor on paper, and the next-business-day access rule is where that shows. Book a demo to see how Pabau keeps your injury log, incident reports, and signed summaries retrievable for the full retention period.

Continue your research

Want to know what a reviewer actually looks at? Medical chart audit walks through how records get sampled and scored during a compliance review.

Planning for the incident itself, not just the paperwork? Crisis management plan gives you an escalation chain and a staff communication script to fill in.

Frequently asked questions