Tracking of Workplace Injuries and Illnesses

Citation84 FR 380
Record Number2019-00101
Published date25 January 2019
SectionRules and Regulations
CourtLabor Department,Occupational Safety And Health Administration
Federal Register, Volume 84 Issue 17 (Friday, January 25, 2019)
[Federal Register Volume 84, Number 17 (Friday, January 25, 2019)]
                [Rules and Regulations]
                [Pages 380-406]
                From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
                [FR Doc No: 2019-00101]
                [[Page 379]]
                Vol. 84
                Friday,
                No. 17
                January 25, 2019
                Part II Department of Labor----------------------------------------------------------------------- Occupational Safety and Health Administration-----------------------------------------------------------------------29 CFR Part 1904 Tracking of Workplace Injuries and Illnesses; Final Rule
                Federal Register / Vol. 84, No. 17 / Friday, January 25, 2019 / Rules
                and Regulations
                [[Page 380]]
                -----------------------------------------------------------------------
                DEPARTMENT OF LABOR
                Occupational Safety and Health Administration
                29 CFR Part 1904
                [Docket No. OSHA-2013-0023]
                RIN 1218-AD17
                Tracking of Workplace Injuries and Illnesses
                AGENCY: Occupational Safety and Health Administration (OSHA), Labor.
                ACTION: Final rule.
                -----------------------------------------------------------------------
                SUMMARY: To protect worker privacy, the Occupational Safety and Health
                Administration (OSHA) is amending the recordkeeping regulation by
                rescinding the requirement for establishments with 250 or more
                employees to electronically submit information from OSHA Forms 300 and
                301. These establishments will continue to be required to maintain
                those records on-site, and OSHA will continue to obtain them as needed
                through inspections and enforcement actions. In addition to reporting
                required after severe injuries, establishments will continue to submit
                information from their Form 300A. Such submissions provide OSHA with
                ample data that it will continue seeking to fully utilize. In addition,
                OSHA is amending the recordkeeping regulation to require covered
                employers to submit their Employer Identification Number (EIN)
                electronically along with their injury and illness data submission,
                which will facilitate use of the data and may help reduce duplicative
                employer reporting. Nothing in the final rule revokes an employer's
                duty to maintain OSHA Forms 300 and 301 for OSHA inspection. These
                actions together will allow OSHA to improve enforcement targeting and
                compliance assistance, decrease burden on employers, and protect worker
                privacy and safety.
                DATES: This final rule becomes effective on February 25, 2019.
                 Collections of information: There are collections of information
                contained in this final rule. (See Section XI, Paperwork Reduction
                Act). Notwithstanding the general date of applicability that applies to
                all other requirements contained in the final rule, affected parties do
                not have to comply with the collections of information until the
                Department of Labor publishes a separate document in the Federal
                Register announcing that the Office of Management and Budget has
                approved them under the Paperwork Reduction Act.
                ADDRESSES: In accordance with 28 U.S.C. 2112(a)(2), OSHA designates
                Edmund Baird, Acting Associate Solicitor of Labor for Occupational
                Safety and Health, Office of the Solicitor, Room S-4004, U.S.
                Department of Labor, 200 Constitution Avenue NW, Washington, DC 20210,
                to receive petitions for review of the final rule.
                FOR FURTHER INFORMATION CONTACT:
                 For press inquiries: Frank Meilinger, OSHA Office of
                Communications, telephone: (202) 693-1999; email:
                meilinger.francis2@dol.gov.
                 For general and technical information: Amanda Edens, Director,
                Directorate of Technical Support and Emergency Management, telephone:
                (202) 693-2300; email: edens.mandy@dol.gov.
                SUPPLEMENTARY INFORMATION:
                Table of Contents
                I. Background
                 A. Introduction
                 B. Regulatory History
                II. Legal Authority
                III. Summary and Explanation of the Final Rule
                 A. Rescission of Requirement for Certain Establishments To
                Submit Data From OSHA Forms 300 and 301 to OSHA Electronically
                 B. New Requirement To Include Employer Identification Number
                With Injury and Illness Data Submitted to OSHA Electronically Under
                29 CFR 1904.41
                IV. Final Economic Analysis and Regulatory Flexibility Analysis
                 A. Introduction
                 B. Cost Savings
                 C. New Costs (From the EIN Collection)
                 D. Net Cost Savings
                 E. Benefits
                 F. Economic Feasibility
                 G. Regulatory Flexibility Certification
                 H. Executive Order 13771: Reducing Regulation and Controlling
                Regulatory Costs
                V. Unfunded Mandates
                VI. Federalism
                VII. State-Plan States
                VIII. Environmental Impact Assessment
                IX. Paperwork Reduction Act
                X. Consultation and Coordination With Indian Tribal Governments
                Citation Method
                 In the docket for this rulemaking found at http://www.regulations.gov, every submission was assigned a document
                identification (ID) number that consists of the docket number (OSHA-
                2013-0023) followed by an additional four-digit number. For example,
                the document ID number for the proposed rule is OSHA-2013-0023-1922.
                Some document ID numbers include one or more attachments, such as one
                of the submissions by the National Institute for Occupational Safety
                and Health (NIOSH). (See Document ID OSHA-2013-0023-2003).
                 When citing exhibits in the docket in this preamble, OSHA includes
                the term ``Document ID'' followed by the last four digits of the
                document number; the attachment number or other attachment identifier,
                if applicable (designated as ``A,'' followed by the number of the
                attachment); page numbers, if applicable; and, in a limited number of
                cases, a footnote number (designated as ``Fn''). In a citation that
                contains two or more document ID numbers, the document ID numbers are
                separated by semi-colons. For example, a citation referring to an
                attachment to the National Association of Home Builders' comments and
                the second attachment to the United Steelworkers' comments would be
                indicated as follows: (Document ID 2044-A1, pp. X-X; 2086-A2, p. X).
                 The exhibits in the docket, including public comments, supporting
                materials, meeting transcripts, and other documents, are listed on
                http://www.regulations.gov. All exhibits are listed in the docket index
                on http://www.regulations.gov, but some exhibits (e.g., copyrighted
                material) are not available to read or download from that website. All
                materials in the docket are available for inspection at the OSHA Docket
                Office, Room N-3508, U.S. Department of Labor, 200 Constitution Avenue
                NW, Washington, DC 20210; telephone (202) 693-2350.
                I. Background
                A. Introduction
                 OSHA's regulation at 29 CFR part 1904 requires employers with more
                than 10 employees in most industries to keep records of occupational
                injuries and illnesses at their establishments. Employers covered by
                these rules must record each recordable employee injury and illness on
                an OSHA Form 300, which is the ``Log of Work-Related Injuries and
                Illnesses,'' or equivalent. Employers must also prepare a supplementary
                OSHA Form 301 ``Injury and Illness Incident Report'' or equivalent that
                provides additional details about each case recorded on the OSHA Form
                300. At the end of each year, employers are required to prepare a
                summary report of all injuries and illnesses on the OSHA Form 300A,
                which is the ``Summary of Work-Related Injuries and Illnesses,'' and
                post the form in a visible location in the workplace.
                 The recordkeeping regulation also requires establishments with 250
                or more employees that are currently
                [[Page 381]]
                required to keep OSHA injury and illness records to electronically
                submit information from the OSHA Forms 300, 300A, and 301 to OSHA
                annually.\1\ Establishments with 20-249 employees in certain designated
                industries are required to electronically submit information only from
                the OSHA Form 300A--the summary form. To protect worker privacy, this
                final rule eliminates the requirement that establishments with 250 or
                more employees that are currently required to keep OSHA injury and
                illness records submit information electronically from their OSHA Forms
                300 and 301. These establishments, as well as establishments with 20 or
                more employees, but fewer than 250 employees, in certain designated
                industries, must continue to submit information electronically from
                their part 1904 annual summary (Form 300A) to OSHA or OSHA's designee
                on an annual basis. The final rule also requires all establishments
                that must submit information electronically from their part 1904 annual
                summary (Form 300A) to submit their Employer Identification Number
                (EIN).
                ---------------------------------------------------------------------------
                 \1\ Although the initial deadline for electronic submission of
                information from OSHA Forms 300 and 301 by covered establishments
                with 250 or more employees was July 1, 2018, OSHA indicated in the
                proposed rule that it would not enforce that deadline without
                further notice while this rulemaking was underway. (83 FR at 36496).
                Furthermore, no secure Web portal for collecting data from Forms 300
                and 301 was built while the 2016 rule was being developed or after
                it was finalized. As a result, while OSHA already has extensive 300A
                data from 214,574 establishments that have proven useful and which
                it is seeking to fully utilize, OSHA has never received the data
                submissions from Forms 300 and 301 that the 2016 rule anticipated.
                ---------------------------------------------------------------------------
                 Elimination of the requirement that establishments with 250 or more
                employees submit information electronically from their OSHA Forms 300
                and 301--a requirement that has not yet been enforced--does not change
                any employer's obligation to complete and retain injury and illness
                records under OSHA's regulations for recording and reporting
                occupational injuries and illnesses. The final rule also does not add
                to or change the recording criteria or definitions for these records.
                 OSHA's collection and use of the summary data from form 300A, and
                information concerning severe injuries it also receives, give OSHA the
                information it needs to identify and target for potential enforcement
                actions those establishments with high rates of work-related injuries
                and illnesses. For example, OSHA has collected summary 300A data for
                2016 from 214,574 establishments, and expects to collect a greater
                volume of 2017 summary data. With the data, OSHA has already designed a
                targeted enforcement mechanism for industries experiencing higher rates
                of injuries and illnesses. OSHA plans to further refine its approach as
                it seeks to fully utilize these data from form 300A, and it will
                likewise continue to use information received from severe injury
                reports.
                 In light of this backdrop, OSHA has determined that the rule will
                benefit worker privacy by preventing routine government collection of
                information that may be quite sensitive, including descriptions of
                workers' injuries and the body parts affected, and thereby avoiding the
                risk that such information might be publicly disclosed under the
                Freedom of Information Act (FOIA) or through the Injury Tracking
                Application. OSHA has also concluded that the extent of any incremental
                benefits of collecting the data from Forms 300 and 301 for OSHA
                enforcement and compliance assistance activities is uncertain. OSHA has
                determined that avoiding this risk to worker privacy outweighs the
                data's uncertain incremental benefits to enforcement. The rule will
                allow OSHA to focus agency resources on the collection and use of 300A
                data described above, and severe injury reports, as well as data from
                other initiatives that its past experience has proven useful--instead
                of diverting those resources toward developing a Web portal for, and
                then collecting, manually reviewing, and analyzing data from Forms 300
                and 301.
                 This rule is a deregulatory action under Executive Order 13771 (82
                FR 9339 (January 30, 2017)). It has annualized net cost savings
                estimated at $16 million. The savings from elimination of the
                requirement that establishments with 250 or more employees submit
                information electronically from their OSHA Forms 300 and 301 will be
                $8.9 million per year. New costs not included in the 2016 final rule
                are estimates of cost savings to the government from avoiding a manual
                review of all data from Forms 300 and 301 to identify and remove PII
                and other information that could be re-identified with individuals.
                This cost will be $7.5 million per year. The total cost of providing
                EINs will be $2.2 million the first year these data are submitted, and
                will be $223,000 per year every year after that. A detailed discussion
                of OSHA's estimates of the rule's benefits, costs, and cost savings is
                included in section IV, Final Economic Analysis and Regulatory
                Flexibility Certification.
                B. Regulatory History
                 OSHA's regulations on recording and reporting occupational injuries
                and illnesses (29 CFR part 1904) were first issued in 1971 (36 FR 12612
                (July 2, 1971)). These regulations require the recording of work-
                related injuries and illnesses that involve death, loss of
                consciousness, days away from work, restriction of work, transfer to
                another job, medical treatment other than first aid, or diagnosis of a
                significant injury or illness by a physician or other licensed health
                care professional. (29 CFR 1904.7).
                 On July 29, 1977, OSHA amended these regulations to partially
                exempt businesses having ten or fewer employees during the previous
                calendar year from the requirement to record occupational injuries and
                illnesses. (42 FR 38568). Then, on December 28, 1982, OSHA amended the
                regulations again to partially exempt establishments in certain lower-
                hazard industries from the requirement to record occupational injuries
                and illnesses. (47 FR 57699). OSHA also amended the recordkeeping
                regulations in 1994 (Reporting of Fatality or Multiple Hospitalization
                Incidents, 59 FR 15594) and 1997 (Reporting Occupational Injury and
                Illness Data to OSHA, 62 FR 6434). Under the version of Sec. 1904.41
                added by the 1997 final rule, OSHA began requiring certain employers to
                submit their 300A data to OSHA annually through the OSHA Data
                Initiative (ODI). Through the ODI, OSHA collected data on injuries and
                acute illnesses attributable to work-related activities in the private
                sector from approximately 80,000 establishments in selected high-hazard
                industries. The agency used these data to calculate establishment-
                specific injury and illness rates, and in combination with other data
                sources, to target enforcement and compliance assistance activities.
                 On January 19, 2001, OSHA issued a final rule amending its
                requirements for the recording and reporting of occupational injuries
                and illnesses (29 CFR parts 1904 and 1952), along with the forms
                employers use to record those injuries and illnesses. (66 FR 5916). The
                final rule also updated the list of industries that are partially
                exempt from recording occupational injuries and illnesses.
                 On September 18, 2014, OSHA again amended the regulations to
                require employers to report work-related fatalities and severe
                injuries--in-patient hospitalizations, amputations, and losses of an
                eye--to OSHA and to allow electronic reporting of these events. (79 FR
                56130). The final rule also revised
                [[Page 382]]
                the list of industries that are partially exempt from recording
                occupational injuries and illnesses.
                 On May 12, 2016, OSHA amended the regulations on recording and
                reporting occupational injuries and illnesses to require employers, on
                an annual basis, to submit electronically to OSHA injury and illness
                information that employers are already required to keep under part
                1904. (81 FR 29624). Under the 2016 revisions, establishments with 250
                or more employees that are routinely required to keep records are also
                required to electronically submit information from their OSHA Forms
                300, 300A, and 301 to OSHA or OSHA's designee once a year, and
                establishments with 20 to 249 employees in certain designated
                industries are required to electronically submit information from their
                OSHA annual summary (Form 300A) to OSHA or OSHA's designee once a year.
                In addition, that final rule required employers, upon notification, to
                electronically submit information from part 1904 recordkeeping forms to
                OSHA or OSHA's designee. These provisions became effective on January
                1, 2017, with an initial submission deadline of July 1, 2017, for 2016
                Form 300A data described in 29 CFR 1904.41(c)(1). That submission
                deadline was subsequently extended to December 15, 2017. (82 FR 55761).
                The deadline for electronic submission of information from OSHA Forms
                300 and 301 was July 1, 2018. OSHA announced that it would not enforce
                this requirement without notice during this rulemaking, (83 FR at
                36496), and OSHA has never received the data submissions from Forms 300
                and 301 that the 2016 rule anticipated.
                 On July 30, 2018, OSHA issued a notice of proposed rulemaking (NPRM
                or proposed rule) proposing to amend its recordkeeping regulations to
                remove the requirement for establishments with 250 or more employees
                that are routinely required to keep records to electronically submit
                information from their OSHA Forms 300 and 301 to OSHA or OSHA's
                designee once a year and to add a requirement for electronic submission
                of the EIN. (83 FR 36494). OSHA received 1,880 comments on the proposed
                rule. The issues raised in those comments are addressed herein.
                II. Legal Authority
                 OSHA is issuing this final rule pursuant to authority expressly
                granted by sections 8 and 24 of the Occupational Safety and Health Act
                (the ``OSH Act'' or ``Act''). (29 U.S.C. 657, 673). Section 8(c)(1) of
                the Act requires each employer to ``make, keep and preserve, and make
                available to the Secretary [of Labor] or the Secretary of Health and
                Human Services, such records regarding his activities relating to this
                chapter as the Secretary [of Labor] . . . may prescribe by regulation
                as necessary or appropriate for the enforcement of this chapter or for
                developing information regarding the causes and prevention of
                occupational accidents and illnesses.'' (29 U.S.C. 657(c)(1)). Section
                8(c)(2) directs the Secretary to prescribe regulations ``requiring
                employers to maintain accurate records of, and to make periodic reports
                on, work-related deaths, injuries and illnesses other than minor
                injuries requiring only first aid treatment and which do not involve
                medical treatment, loss of consciousness, restriction of work or
                motion, or transfer to another job.'' (29 U.S.C. 657(c)(2)). Finally,
                section 8(g)(2) of the OSH Act broadly empowers the Secretary to
                ``prescribe such rules and regulations as he may deem necessary to
                carry out [his] responsibilities under this chapter.'' (29 U.S.C.
                657(g)(2)).
                 Section 24 of the OSH Act (29 U.S.C. 673) contains a similar grant
                of authority. This section requires the Secretary to ``develop and
                maintain an effective program of collection, compilation, and analysis
                of occupational safety and health statistics'' and ``compile accurate
                statistics on work injuries and illnesses which shall include all
                disabling, serious, or significant injuries and illnesses.'' (29 U.S.C.
                673(a)). Section 24 also requires employers to ``file such reports with
                the Secretary as he shall prescribe by regulation.'' (29 U.S.C.
                673(e)). These reports are to be based on ``the records made and kept
                pursuant to'' section 8(c) of the OSH Act. (29 U.S.C. 673(e)).
                 The OSH Act requires cooperation with the Secretary of Health and
                Human Services concerning regulations that address reporting and
                recordkeeping, and consultation concerning the development and
                maintenance of a program for occupational safety and health statistics.
                OSHA has a lengthy history of cooperation and consultation with the
                Department of Health and Human Services in this regard, particularly
                with its sub-agency, the National Institute for Occupational Safety and
                Health. With respect to this rule, OSHA informally received feedback
                from NIOSH on its proposal, including reviewing a draft of NIOSH's
                comment, and provided NIOSH, and HHS more generally, with opportunities
                to provide comment on both the proposed and this final rule before
                publication.
                 Further support for the Secretary's authority to require employers
                to keep and submit records of work-related illnesses and injuries is in
                the Congressional Findings and Purpose at the beginning of the OSH Act.
                (See 29 U.S.C. 651). In that section, Congress declares the overarching
                purpose of the Act is ``to assure so far as possible every working man
                and woman in the Nation safe and healthful working conditions.'' (29
                U.S.C. 651(b)). One of the ways in which the Act is meant to achieve
                this goal is ``by providing for appropriate reporting procedures . . .
                [that] will help achieve the objectives of this chapter and accurately
                describe the nature of the occupational safety and health problem.''
                (29 U.S.C. 651(b)(12)). Notably, the statute does not require this
                information to be transmitted to OSHA. And, section 8(d) of the Act
                provides that any information the Secretary collects under the Act
                ``shall be obtained with a minimum burden upon employers.'' (29 U.S.C.
                657(d)).
                 The OSH Act authorizes the Secretary of Labor to issue two types of
                occupational safety and health rules: Standards and regulations.
                Standards aim to correct particular identified workplace hazards, while
                regulations further the general enforcement and detection purposes of
                the OSH Act. (See Workplace Health & Safety Council v. Reich, 56 F.3d
                1465, 1468 (D.C. Cir. 1995) (citing La. Chem. Ass'n v. Bingham, 657
                F.2d 777, 781-82 (5th Cir. 1981)); United Steelworkers of Am. v.
                Auchter, 763 F.2d 728, 735 (3d Cir. 1985)). Recordkeeping requirements
                promulgated under the Act are characterized as regulations. (See 29
                U.S.C. 657 (using the term ``regulations'' to describe recordkeeping
                requirements)). An agency may revise a prior rule if it provides a
                reasoned explanation for the change. (See Motor Vehicle Mfrs. Ass'n v.
                State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 42 (1983)).\2\
                ---------------------------------------------------------------------------
                 \2\ In the NPRM and in the final rule, OSHA has offered reasoned
                analysis for its preliminary and now final determination to rescind
                the requirement for covered employees to submit their 300 and 301
                data to OSHA electronically. OSHA has likewise considered and
                discussed the comments raised by those who also argue that OSHA's
                decision runs afoul of the APA, (e.g., Document ID 2012-A1, pp. 9,
                15; 2028-A1, pp. 1-3, 6, 8), as well as other comments in the
                record. In short, this rule is a product of reasoned decision-
                making, has the support of substantial evidence in the record as a
                whole, and is appropriate based on policy concerns and OSHA's
                obligations under the Act.
                ---------------------------------------------------------------------------
                 When promulgating regulations pursuant to sections 8 and 24 of the
                OSH Act, OSHA must comply with the Administrative Procedure Act (APA)
                (5 U.S.C. 553), which requires the agency to publish notice of a
                proposed rule in the Federal Register and to provide an opportunity for
                interested persons to
                [[Page 383]]
                comment on the rulemaking. In the NPRM, OSHA invited comment on ``all
                aspects of the proposed rule'' (83 FR at 36505), and specifically
                encouraged comment on four questions regarding: (1) The risks and
                benefits of electronically collecting the information; (2) other
                agencies or organizations that use automated coding systems for text
                data in data collections; (3) other agencies or organizations that use
                automated de-identification systems to remove personal identifying
                information (PII) from text data before making the data available to
                the public; and (4) privacy issues regarding the submission of EINs.
                (83 FR at 36500).
                 OSHA received 1,880 comments on the proposed rule.\3\ Pursuant to
                the APA, 5 U.S.C. 553, OSHA has reviewed these comments and responded
                to the material issues commenters raised. (See Genuine Parts Co. v.
                Envtl. Prot. Agency, 890 F.3d 304, 313 (D.C. Cir. 2018) (although an
                agency ``is not required to discuss every item of fact or opinion
                included in the submissions it receives in response to a Notice of
                Proposed Rulemaking, it must respond to those comments which, if true,
                would require a change in the proposed rule.'') (quoting La. Fed. Land
                Bank Ass'n v. Farm Credit Admin., 336 F.3d 1075, 1080 (D.C. Cir.
                2003))).
                ---------------------------------------------------------------------------
                 \3\ Of these, 1,641 were nearly identical form letters.
                ---------------------------------------------------------------------------
                 Some commenters raised issues such as the requirement for certain
                employers to submit their 300A data to OSHA (e.g., Document ID 2057-A1,
                pp. 2-3; 2053, p. 3) and the employee protection provisions added by
                the 2016 final rule (e.g., Document ID 2006-A1, p. 4; 2009-A1, p. 4;
                2023-A1). These comments were beyond the scope of this rulemaking, and
                this final rule does not make any changes to the relevant provisions.
                Nevertheless, OSHA acknowledges and shares some of the concerns these
                comments suggest. First, in relation to concerns raised about possible
                publication of data submitted electronically to OSHA from Form 300A--
                and as identified in the NPRM and later in this final rule--the agency
                takes the position that these data are exempt from public disclosure
                under FOIA. It should likewise be noted that OSHA uses and will
                continue to use 300A data to prioritize its inspections and enforcement
                actions. Among other considerations, disclosure of 300A data through
                FOIA may jeopardize OSHA's enforcement efforts by enabling employers to
                identify industry trends and anticipate the inspection of their
                particular workplaces. As OSHA has explained elsewhere, OSHA is
                strongly opposed to disclosure of 300A data, has not made such data
                public, and does not intend to make any such data public for at least
                the approximately four years after its receipt that OSHA intends to use
                the data for enforcement purposes.
                 In response to concerns about the application of the 2016 final
                rule to employee drug testing and incident-based incentive programs,
                OSHA notes that the employee protection provisions promulgated by that
                final rule and codified at 29 CFR 1904.35 neither ban drug testing
                employees involved in workplace injury or illnesses, nor prohibit
                incident-based incentive programs. Rather, Sec. 1904.35(b)(1)(iv)
                merely prohibits employers from implementing these programs to penalize
                workers ``for reporting a work-related injury or illness.'' Id.
                (emphasis added). On October 11, 2018, OSHA issued a memorandum that
                explained this regulatory text and OSHA's position on workplace
                incentive programs and post-incident drug testing. See U.S. Dep't of
                Labor, Clarification of OSHA's Position on Workplace Safety Incentive
                Programs and Post-Incident Drug Testing Under 29 CFR Sec.
                1904.35(b)(1)(iv) (Oct. 11, 2018). That memorandum--which referred to
                the 2016 final rule and its preamble--reiterated the rule's limited
                scope and expressed how it ``does not prohibit workplace safety
                incentive programs or post-incident drug testing.'' Id. To the extent
                the 2016 preamble suggested otherwise, it has been superseded. While
                not the focus of this particular rulemaking, that memorandum accurately
                reflects OSHA's position and addresses the commenters' concerns.
                III. Summary and Explanation of Final Rule
                A. Rescission of Requirement for Certain Establishments To Submit Data
                From OSHA Forms 300 and 301 to OSHA Electronically
                 As discussed in detail below, OSHA has determined that collecting
                the data from Forms 300 and 301, as was recently required under the
                2016 final rule, would subject sensitive worker information to a
                meaningful risk of public disclosure. OSHA has also concluded that the
                extent of the incremental benefits of collecting the data for OSHA's
                enforcement targeting and compliance assistance activities remains
                uncertain. Finally, OSHA has found that collecting the data and
                analyzing them for use would require OSHA to divert significant
                resources from agency priorities such as fully utilizing the 300A data
                and severe injury reports OSHA already collects electronically and that
                have proven useful in its experience for targeting areas of concern.
                 After considering all of the comments in the record and balancing
                the risk to worker privacy against the uncertain extent of the benefits
                of collecting the data and OSHA's resource priorities, OSHA has
                determined that the final rule is necessary to preserve sensitive
                worker information and conserve agency resources for initiatives with
                more concrete benefits to OSHA's mission of assuring safe and healthful
                workplaces.
                Concerns About the Potential Release of Sensitive Worker Information
                 A central reason OSHA proposed rescinding the requirement for
                certain employers to electronically submit information from Forms 300
                and 301 to OSHA was ``to protect sensitive worker information from
                potential disclosure under the Freedom of Information Act (FOIA).'' (83
                FR at 36494). As explained in greater detail below, although OSHA
                believes data from Forms 300 and 301 would be exempt from disclosure
                under FOIA exemptions, OSHA is concerned that it still could be
                required by a court to release the data. Many commenters echoed this
                concern.
                 OSHA's position in this final rule is consistent with the
                principles articulated in the Privacy Act, OMB Circular A-130, and the
                Department's position on the sensitive nature of worker injury and
                illness records before 2016. (See Document ID 1930-A1, pp. 2-3; 66 FR
                5916, 6055-57 (Jan. 19, 2001)). In 2001, for example, OSHA noted that
                it ``historically has recognized that the Log and Incident Report
                (Forms 300 and 301, respectively) may contain information of a
                sufficiently intimate and personal nature that a reasonable person
                would wish it to remain confidential.'' (66 FR at 6055). OSHA further
                explained that access to Forms 300 and 301 should be limited to workers
                and their representatives--in other words, those with a ``need to
                know.'' (66 FR at 6057). OSHA explained in 2001:
                 OSHA agrees that confidentiality of injury and illness records
                should be maintained except for those persons with a legitimate need
                to know the information. This is a logical extension of the agency's
                position that a balancing test is appropriate in determining the
                scope of access to be granted employees and their representatives.
                Under this test, ``the fact that protected information must be
                disclosed to a party who has [a particular] need for it . . . does
                not strip the information of its protection against disclosure to
                those who have no similar need.''
                (66 FR at 6057 (quoting Fraternal Order of Police Lodge No. 5. v. City
                of
                [[Page 384]]
                Philadelphia, 812 F.2d 105, 118 (10th Cir. 1987))). Commenters agreed
                with OSHA that access to 300 and 301 data should be limited to those
                with a ``need to know'' (i.e., workers, their representatives, and OSHA
                upon request) (Document ID 2070-A1, p. 8; 2084-A2). Thus, OSHA has
                always applied a balancing test to weigh the value of worker privacy
                against the usefulness of releasing the data. The 2016 final rule
                represented a departure from the balance OSHA has historically struck
                in favor of achieving uncertain incremental benefits for OSHA
                enforcement and outreach. This final rule restores OSHA's historical
                emphasis on protecting the privacy of workers and its longstanding
                practice of releasing sensitive data on a case-by-case basis only to
                those with a ``need to know.''
                 Multiple commenters commented that the proposed rule is consistent
                with the privacy protections in the Privacy Act of 1974 (Pub. L. 93-
                579) and Section 4(g) of OMB Circular A-130. (E.g., Document ID 1930-
                A1, p. 2; 1981-A1, p. 3; 2041-A1, p. 2; see also Document ID 2036-A1,
                p. 4) (``[C]ompelled disclosure of the incredibly private, personally
                identifiable information required by OSHA Forms 300 and 301 is contrary
                to the well-established principle that an individual's right to privacy
                regarding medical conditions and treatment is of paramount
                importance.''). Although the Privacy Act does not apply to Forms 300
                and 301, the statute's articulation that privacy is ``a personal and
                fundamental right'' highlights the importance of this issue. (Document
                ID 1981-A1, p. 3 (quoting Pub. L. 93-579, Section 2(a)(4))).
                Furthermore, Section 4(g) of OMB Circular A-130 stresses that
                ``[p]rotecting an individual's privacy is of utmost importance.''
                (Document ID 1981-A1, p. 3 (quoting OMB Circular A-130 (2016),
                available at: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf)). To that end, Section 4(g) also
                states that ``[t]he Federal Government shall consider and protect an
                individual's privacy throughout the information life cycle.'' (OMB
                Circular A-130). This final rule complies with this instruction by
                limiting the potential disclosure of PII and other sensitive worker
                information.
                 Many commenters agreed with OSHA's privacy concerns, pointing to
                the Department's ``special responsibility to protect PII from loss and
                misuse,'' and arguing that OSHA should not collect the data from Forms
                300 and 301 because it cannot guarantee the protection of PII that may
                be submitted with the data. (Document ID 2045-A1, p. 3) (quoting
                Department of Labor, Guidance on the Protection of Personal
                Identifiable Information, available at: https://www.dol.gov/general/ppii). Commenters agreed with OSHA that the information reported on
                Forms 300 and 301 is sensitive, and that the risk of disclosing this
                sensitive worker information is not worth the uncertain incremental
                benefits of collecting the data. (E.g., Document ID 1985-A1, pp. 1-2;
                2045-A1, pp. 2-3). Other comments agreed with OSHA that collecting Form
                300A provides concrete enforcement benefits without putting private
                worker information at risk of disclosure. (E.g., Document ID 2008, pp.
                2-3).
                 Some commenters cautioned that the 300 and 301 data could include
                PII, which the Department defines as ``any representation of
                information that permits the identity of an individual to whom the
                information applies to be reasonably inferred by either direct or
                indirect means[,]'' such as ``name, address, social security number or
                other identifying number or code, telephone number, email address,
                etc.'' (E.g., Document ID 2045, pp. 2-3) (quoting Department of Labor,
                Guidance on the Protection of Personal Identifiable Information,
                available at: https://www.dol.gov/general/ppii)). Although some of
                these commenters are under the mistaken impression that employers would
                be required to submit PII such as name, address, or the name of the
                treating physician under the prior final rule (compare e.g., Document
                ID 2041-A1, pp. 1-2 with 81 FR at 29660-61), OSHA shares these
                commenters' concern that collection of data from Forms 300 and 301
                poses a risk of the release of PII.
                 It is foreseeable that, despite instructions not to include such
                information, some employers would submit PII inadvertently in Forms 300
                and 301, for example in the narrative description of the incident in
                Column F of the 300 Log. (See 81 FR at 29662; Document ID 2019-A1, pp.
                2-3). Although one commenter's experience demonstrated employers'
                capability of fully redacting PII from a small dataset (Document ID
                2077-A1, pp. 1, 2), ``[i]t has been OSHA's experience that information
                entered in Column F of the 300 Log may contain personally-identifiable
                information. For example, when describing an injury or illness,
                employers sometimes include names of employees.'' (81 FR at 29662).
                 Whereas in the past, OSHA has manually screened smaller datasets
                for PII, the dataset at issue in this rulemaking would be far too large
                to screen manually for employer compliance with an instruction not to
                include PII, and OSHA is concerned that alternative approaches would
                not sufficiently alleviate the risk of disclosure. For example, OSHA
                stated in the 2016 final rule that it would ``review'' the data for PII
                using software--and some commenters urged a similar review (e.g.,
                Document ID 1989-A1, p. 1; 2004-A1, p. 1)--but this software is
                imperfect. As discussed in the NPRM, ``it is not possible to guarantee
                the non-release of PII.'' (83 FR at 36498 (citing ``De-Identification
                of Personal Information,'' p. 5, Simson L. Garfinkel, NISTIR 8053,
                October 2015, Document ID 2060)). No commenters provided evidence to
                the contrary. Therefore, OSHA finds that it would not be able to
                guarantee that all PII inadvertently submitted to OSHA would be
                protected from disclosure. (83 FR at 36498).
                 Moreover, even if PII could be completely removed from the data,
                concerns about re-identification would remain. As many commenters
                noted, several data points on Forms 300 and 301 could be combined to
                reveal the identity of workers who reported work-related injuries or
                illnesses, particularly in a small town. (E.g., Document ID 2032-A1;
                2044-A1, p. 5 (quoting prior comment); 2045-A1, pp. 2-3, 5; 2070-A1,
                pp. 3, 11, 15-16). As the Phylmar Regulatory Roundtable (PRR)
                explained:
                 For example, even with the employee's name removed, PRR members
                believe it would be easy to determine a worker's identity when
                reviewing the information in the remaining fields on Form 300: Job
                title (field C), where the event occurred (E), and details on the
                injury and body parts affected (F). On the 301 Report, combining
                multiple data points, for example, the date of the injury or illness
                (11), what time the employee began work (12), time of event (13),
                what was the employee doing just before the incident occurred (14),
                what happened (15), and what was the injury or illness (16), could
                also result in identifying the worker. While individual fields,
                standing alone, would not be considered traditional ``PII,'' (e.g.,
                name, address), once linked, there is a substantial risk that
                employees may be identified, thus violating their privacy.
                (Document ID 2070-A1, p. 3). Thus, even with PII removed from the data,
                in many circumstances it may be possible to combine data points to
                identify specific workers who reported injuries or illnesses along with
                personal details about their conditions.
                 These privacy concerns are real and important. As OSHA stated in
                the NPRM, some of the information collected on Forms 300 and 301 may be
                sensitive for workers. (E.g., 83 FR at 36495). For example, many of the
                questions on Form 301 seek answers
                [[Page 385]]
                that could contain sensitive information about workers, including:
                 Was the employee treated in an emergency room?
                 Was the employee hospitalized overnight or as an in-
                patient?
                 Date of birth.
                 Date of injury.
                 What was the employee doing just before the incident
                occurred? Describe the activity, as well as the tools, equipment, or
                material the employee was using. Be specific. Examples: ``climbing a
                ladder while carrying roofing materials''; ``spraying chlorine from
                hand sprayer''; ``daily computer key-entry.''
                 What happened? Tell us how the injury occurred. Examples:
                ``When ladder slipped on wet floor, worker fell 20 feet''; ``Worker was
                sprayed with chlorine when gasket broke during replacement''; ``Worker
                developed soreness in wrist over time.''
                 What was the injury or illness? Tell us the part of the
                body that was affected and how it was affected; be more specific than
                ``hurt,'' ``pain,'' or ``sore.'' Examples: ``strained back'';
                ``chemical burn, hand''; ``carpal tunnel syndrome.''
                 What object or substance directly harmed the employee?
                Examples: ``concrete floor''; ``chlorine''; ``radial arm saw.''
                (83 FR at 36495-96). Some commenters disagreed that injury descriptions
                like those above are sensitive (e.g., Document ID 2048-A1, p. 2; 1978-
                A1, p. 2; 2048-A1, p. 2), but other commenters provided additional
                examples of sensitive information that could appear on Form 300 or 301,
                such as contracting an infectious disease from a patient, being
                assaulted in the workplace, or being diagnosed with depression or post-
                traumatic stress disorder. (E.g., Document ID 2044-A1, pp. 5-6 (quoting
                prior comment); 2070-A1, pp. 15-16). A commenter also noted that some
                records could implicate the privacy of non-employees, such as patients
                involved in the occurrence of a workplace injury or illness. (Document
                ID 1960-A1).
                 Other commenters disagreed with OSHA's preliminary determination
                that the data from Forms 300 and 301 are sensitive. (E.g., Document ID
                1961-A1, p. 2; 2081-A2, p. 1; 1984-A1, p. 2; 1978-A1, p. 2; 2017-A1, p.
                3). For example, one commenter maintained that information such as a
                description of an injury is integral to OSHA's investigation and is not
                private or privileged, like medical advice or other communication
                between a patient and doctor. (Document ID 2017-A1, p. 3). OSHA agrees
                that not all of the 300 and 301 data are always sensitive, but
                maintains that some of the data are sensitive and remain sensitive even
                if not legally privileged and even though OSHA intends to continue to
                use these data during onsite inspections.
                 Commenters asserting that OSHA's privacy concerns are disingenuous
                (e.g., Document ID 1976-A1, pp. 2-3; 1984-A1, pp. 1-2; 2022-A1, p. 3;
                2038-A1, p. 2; Document ID 1978-A1, p. 2; 2088-A1, p. 3) fail to
                appreciate the real possibility of the disclosure of sensitive worker
                information. The comment (and others like it) that ``[t]he risk to
                worker privacy is very minimal and unlikely to materialize'' (Document
                ID 2011-A1, p. 5) discounts the risk to worker privacy that OSHA's
                experience--of having to remove PII and other information that could
                re-identify the ill or injured worker during manual screening of forms
                prior to release--has shown. Although many advocacy groups submitted
                similarly-worded comments stating that the data from Forms 300 and 301
                are not sensitive (e.g., Document ID 1976-A1, p. 3; 2058-A1, p. 2;
                2059-A1, p .2; 1976-A1, p. 3), private citizens and health advocacy
                organizations expressed concern about the sensitive nature of the data
                and emphasized the importance of keeping sensitive worker information
                out of the public eye. (E.g., Document ID 1938; 1975; 1979; 2006-A1, p.
                2). OSHA agrees with the latter commenters that sensitive information
                can be included in the data on these Forms and should be protected
                against public disclosure.
                 Moreover, many of those taking the view that privacy concerns about
                the data were overstated expressed their confidence that OSHA could
                guarantee the protection of any PII contained in the data, a confidence
                that OSHA does not share. (E.g., Document ID 2031 (``The 2016
                provisions clearly stated that no information that would identify
                individual workers was to be reported. If such information was
                accidentally submitted, OSHA made it clear it would never be released
                to the public.''); 2038-A1, p. 2 (``The 2016 provisions clearly state
                that no information tied to any individual worker(s) was to be
                reported. If such information was inadvertently submitted, OSHA ensured
                [sic] us it would never be released to the public.'')).
                 It is true, as some commenters noted, that OSHA considered the
                issue of worker privacy in the 2016 final rule and included protections
                to reduce the likelihood of sensitive information being made public,
                (Document ID 2028-A1, p. 6), but OSHA no longer views such protections
                as sufficient. OSHA noted in 2016, for example, that ``consistent with
                FOIA, the agency does not intend to post personally identifiable
                information on the website.'' (81 FR at 29659 (emphasis added)). Yet
                OSHA did not--and cannot--guarantee non-release of PII. In fact, OSHA
                acknowledged in 2016 that Forms 300 and 301 could contain PII in the
                fields that employers were required to submit. (See 81 FR at 29662
                (``It has been OSHA's experience that information entered in Column F
                of the 300 Log may contain personally-identifiable information. For
                example, when describing an injury or illness, employers sometimes
                include names of employees.'')). Although OSHA previously thought to
                address this issue with software, de-identification software is not
                100% effective, and OSHA believes that some PII could be released even
                after being processed through the software. (83 FR at 36498).
                 Moreover, even if software could guarantee full scrubbing of PII,
                the possibility still remains that the data could be re-identified with
                the worker who reported the injury or illness. (83 FR at 36498). When
                discussing the agency's past experience of withholding private worker
                information from disclosure under FOIA, OSHA referred to the practice
                of manually redacting Forms 300 and 301 on a case by case basis. (81 FR
                at 29658). For example, OSHA noted that it ``would not disclose the
                information in Column C [of Form 300] (Job Title), if such information
                could be used to identify the injured or ill employee.'' (81 FR at
                29658). OSHA thus acknowledged even in the 2016 final rule that the
                worker's job title could be used to identify the injured or ill worker
                in some situations and that OSHA had protected that information in the
                past through manual review of the file and invocation of FOIA Exemption
                7(c). (81 FR at 29658). The 2016 rule's proposed use of de-
                identification software would not address this issue.
                 Commenters argued that data similar to those on Forms 300 and 301
                have been available to workers and their representatives since the
                passage of the Act (i.e., those with a ``need to know'') (E.g.,
                Document ID 1984-A1, p. 2; 2088-A3, p. 5 (comments dated March 10,
                2014)), but those data have always been screened manually for PII. Such
                screening may have been possible before the 2016 final rule for
                individual files requested on a case by case basis, but OSHA could not
                possibly review each individual form that would be submitted
                electronically under the 2016 final rule to determine whether a
                worker's job title could be used to identify the worker.
                [[Page 386]]
                 The same principle distinguishes OSHA's practice of posting
                information about severe injuries and fatalities on its website, which
                some commenters cited as proof that the information on Forms 300 and
                301 is not too sensitive to publish. (E.g., Document ID 1961-A1, p. 2;
                1976-A1, p. 3; 2038-A1, p. 2; 2054-A1, p. 4). Although OSHA has not
                identified specific worker complaints about OSHA's posting of severe
                injury data in the past, as asserted by one commenter (Document ID
                2054-A1, p. 4; see also Document ID 2015-A1, p. 1), OSHA receives only
                approximately 800 severe injury reports per month, and manually screens
                each severe injury report for PII or other sensitive worker information
                before posting. OSHA's past practice of manually redacting these data
                before releasing them has no application to the mass collection of
                Forms 300 and 301 data from 36,903 establishments--data drawn from what
                OSHA estimates would be more than 775,000 forms--which could only be
                screened using software with limitations delineated elsewhere in this
                preamble and in the 2018 NPRM.
                 Although OSHA believes the 300 and 301 data would be exempt from
                disclosure under FOIA Exemptions 6 and 7(c), OSHA still could be
                required by a court to release the data, as discussed in the NPRM and
                echoed by many commenters. (83 FR at 36498; see also Document ID 1930-
                A1, pp. 3-4; 1979; 1981-A1, pp. 2-3; 2075-A1, p. 5; 2084-A1, p. 3). The
                risk of disclosure of sensitive information is not speculative, as some
                commenters claimed (e.g., Document ID 2056-A1, pp. 1-2). One FOIA
                requester has already sued the Department in multiple lawsuits seeking
                injury and illness data: One lawsuit seeks the 300A data collected
                through the Injury Tracking Application, and one lawsuit seeks to force
                OSHA to collect the 2017 data from Forms 300 and 301 for the
                requestor's use in research. See Public Citizen v. U.S. Dep't of Labor,
                Civ. No. 18-cv-117 (D.D.C. filed Jan. 19, 2018); Public Citizen Health
                Research Group v. Acosta, Civ. No. 18-cv-1729 (D.D.C. filed July 25,
                2018). In a decision denying the government's motion to dismiss in
                Public Citizen Health Research Group v. Acosta, the court concluded
                that the plaintiffs would likely be entitled to a significant portion
                of the 300 and 301 data if collected by OSHA, despite OSHA's conclusion
                that the data would be exempt from disclosure under FOIA. Public
                Citizen Health Research Group v. Acosta, Civ. No. 18-cv-1729 (D.D.C.
                December 12, 2018) (order denying motion to dismiss and preliminary
                injunction). In addition, in New York Times Co. v. U.S. Dep't of Labor,
                340 F. Supp. 2d 394 (S.D.N.Y 2004) and Finkel v. U.S. Dep't of Labor,
                No. 05-5525, 2007 WL 1963163 (D.N.J. June 29, 2007), two separate
                courts ordered OSHA to release injury and illness data that OSHA argued
                were exempt from disclosure under FOIA Exemption 4. (See Document ID
                2019-A1, p. 7; 2070-A1, p. 4).
                 OSHA disagrees with comments arguing that OSHA mischaracterized the
                Finkel and Public Citizen lawsuits and the risk of the disclosure of
                sensitive information under FOIA. (See Document ID 2048-A1, pp. 2-3;
                2012-A1, p. 11; 2022-A1, p. 2). OSHA agrees with Mr. Finkel and other
                commenters that the Finkel lawsuit did not result in a court ordering
                disclosure of PII (see, e.g., Document ID 2048-A1, p. 1; Finkel v. U.S.
                Dep't of Labor, No. 05-5525, 2007 WL 1963163 (D.N.J. June 29, 2007)).
                The Public Citizen Health Research Group, Finkel and New York Times
                lawsuits do, however, demonstrate the power of courts to order OSHA to
                release injury and illness data that OSHA considers sensitive
                information exempt from disclosure, over OSHA's objections. In another
                case, the Sixth Circuit Court of Appeals ordered the release of data
                the Federal Aviation Administration tried to protect from disclosure,
                despite the possibility that multiple data points could be combined to
                re-identify particular individuals who had participated in a strike.
                (Norwood v. FAA, 993 F.2d 570, 574-75 (6th Cir. 1993)). OSHA is
                concerned a similar outcome could result if it collects the data from
                Forms 300 and 301 and then attempts to withhold the data in response to
                FOIA requests on the ground that the data could well contain sensitive
                information that OSHA cannot guarantee would be removed. ``[O]nce the
                information is disclosed [under FOIA], it can never be made private.''
                (See Document ID 2075-A1, p. 5).
                 Some commenters asserted that OSHA should collect the 300 and 301
                data but limit its release in various ways (Document ID 2006-A1, pp. 2-
                3), or that OSHA could never be required to disclose sensitive worker
                information under FOIA (e.g., Document ID 2006-A1, p. 3; 2012-A1, p.
                11; 2022-A1, p. 2; 2028-A1, pp. 2, 7). These comments ignore the
                reality reflected in these lawsuits that the Department would not
                retain complete control over the data once they are collected. And,
                given that OSHA cannot guarantee complete removal of PII or data that
                could be re-identified with a particular worker from such a large
                dataset, court-ordered publication of the data from Forms 300 and 301
                could well result in the disclosure of sensitive worker information.
                Other commenters presented alternatives to fully rescinding the
                requirement to collect the data from Forms 300 and 301, such as
                excluding job title and precise date of injury to reduce the likelihood
                of re-identification. (Document ID 1993-A1, p. 2; 2028-A1, p. 7). OSHA
                notes that even without the job title and precise date fields, however,
                employers could include sensitive information, such as worker and
                patient names, in the narrative description of the injury and how it
                occurred. (Document ID 1960-A1; 81 FR at 39662). OSHA has had to redact
                this kind of information during manual screening in the past prior to
                release. (81 FR at 39662).
                 The American Nurses Association (ANA) expressed concern about
                potential disclosure of sensitive worker information under FOIA but
                believes that the case-level data are important for performing root-
                cause analyses to prevent incidents of workplace injuries and
                illnesses. (Document ID 2000-A1, pp. 1-2). The ANA notes that 29 CFR
                1904.8 requires employers to record on the OSHA Form 300 all work-
                related needlestick injuries and cuts from sharp objects that are
                contaminated with another person's blood or other potentially-
                infectious material, but that employers are prohibited from recording
                an injured worker's name. (Document ID 2000-A1, pp. 2-3). Given the
                protections afforded these cases under Sec. 1904.29(b)(6) through (9),
                the ANA asks whether it would be viable for OSHA to continue to require
                electronic submission of OSHA 300 Log for needlestick and sharps
                injuries to help inform the future prevention of needlestick and sharps
                injuries. (Document ID 2000-A1, p. 3).
                 OSHA notes the importance of the OSHA 300 Log for needlestick
                injuries and cuts from sharp objects for identifying hazards in
                healthcare settings, and encourages employers to use their own data
                from Forms 300 and 301 to identify workplace hazards, as OSHA does
                during onsite inspections. Like any other OSHA 300 Log, however, the
                possibility of personal information being reported to OSHA
                inadvertently remains despite the prohibition against recording names,
                as does the risk of re-identification through job title or another
                reported field. These data might then be subject to release under FOIA.
                Therefore, OSHA declines the invitation to retain the reporting
                requirements for case-characteristic data for the OSHA
                [[Page 387]]
                300 Log for needlestick injuries and cuts from sharp objects.
                 After reviewing all of the comments on this issue, OSHA has
                determined collecting the data would expose sensitive worker
                information to a meaningful risk of disclosure. OSHA cannot justify
                that risk given its resource allocation concerns and the uncertain
                incremental benefits to OSHA of collecting the data, as discussed
                elsewhere in this preamble. OSHA has determined that the best use of
                its resources is to focus on data it already receives--including a
                large set of data from Form 300A, as well as discrete data about urgent
                issues from severe injury reports--and has found useful in its past
                experience.
                Experience of the Mine Safety and Health Administration (MSHA) and
                Other Federal and State Agencies
                 The experience of MSHA and other federal and state agencies with
                collecting and publishing similar data, as many commenters noted (e.g.,
                Document ID 2007, p. 8; 2011-A1, p. 6; 2012-A1, p. 6; 2028-A1, p. 2),
                does not mean OSHA is required to collect the data from Forms 300 and
                301. As explained below, other federal and state agencies may weigh
                worker privacy concerns differently based on their missions,
                priorities, and budgets.
                 OSHA acknowledges, for example, comments that MSHA has been
                collecting similar data--albeit from a much small number of
                establishments--for many years (e.g., Document ID 2011-A1, p. 7) and
                has posted data on the web for more than fifteen years (Document ID
                2012-A1, pp. 6, 10). MSHA maintains the data in a comprehensive
                database that it makes available to the public. (E.g., Document ID
                1965-A1, p. 52). Commenters noted that MSHA has not experienced any
                security breaches or complaints or controversy about employee privacy,
                despite the fact that MSHA's database includes small employers.\4\
                (E.g., Document ID 2012-A1, p. 10). Commenters further noted that
                ``MSHA has a robust system in place to protect [PII] from inappropriate
                disclosure.'' (E.g., Document ID 2011-A1, pp. 7-8).
                ---------------------------------------------------------------------------
                 \4\ MSHA has been subject to cyber attack in the past, however.
                See Ted Hesson, ``Morning Shift: DOL Takes Stock After Hack,''
                POLITICO (Apr. 25, 2018) (detailing successful hack), https://www.politico.com/newsletters/morning-shift/2018/04/25/travel-ban-at-scotus-182935.
                 There are security controls in place to prevent database
                contamination should nefarious acts be taken against the front-end
                website. The information has to be reviewed by at least three
                approving authorities prior to it being introduced and or uploaded
                into the appropriate database for further analysis and data
                manipulation. Data extracts are redacted of the PII prior to being
                ---------------------------------------------------------------------------
                released for public consumption.
                (Document ID 2088-A1, p. 12) (quoting MSHA, Privacy Impact Assessment
                Questionnaire, MSHA Standardized Information System (MSIS)--FY2017,
                available at: https://www.dol.gov/oasam/ocio/programs/pia/msha/MSHA-MSIS.htm).
                 Although three layers of review might make sense given MSHA's
                budget and the much smaller number of employers under the agency's
                jurisdiction, it would require OSHA to commit an unwarranted level of
                resources to provide three layers of review for the volume of records
                it would receive. Under the 2016 final rule, OSHA would collect between
                38 and 77 times more injury reports than MSHA--that is, approximately
                775,000 reports, versus MSHA's 10,000-20,000. OSHA estimates, based on
                the time it has taken OSHA staff to review and remove personal
                information from other OSHA data, that it would take two levels of
                review and 7 minutes per record, on average, to assess the record and
                remove personal information. Such review would cost OSHA approximately
                $7.5 million each year.\5\
                ---------------------------------------------------------------------------
                 \5\ See the Final Economic Analysis for details on this
                calculation.
                ---------------------------------------------------------------------------
                 Other commenters pointed out that ``[t]he Federal Railroad
                Administration (FRA) posts accident investigation reports filed by
                railroad carriers or made by the Secretary of Transportation, and the
                Federal Aviation Administration (FAA) posts National Transportation
                Safety Board reports about aviation accidents.'' (Document ID 2012-A1,
                p. 10; see also 2028-A1, p. 7). Some of these commenters noted that the
                information posted by these agencies includes personally identifiable
                information, such as age, gender, job history, medical information, or
                information about the accident. (Document ID 2028-A1, p. 7). In
                addition, some state workers' compensation systems have online search
                capacity for data including the claimant's name and the description of
                the injury. (Document ID 1993-A1, p. 2).
                 Again, OSHA acknowledges that other federal and state agencies have
                collected somewhat similar data for a number of years, but notes that
                each of these agencies has a unique mission, varying priorities, and
                different resource constraints. In this final rule, OSHA is balancing
                the issues of worker privacy and OSHA's resource priorities against the
                uncertain incremental benefits of collecting the data from Forms 300
                and 301. Because OSHA has determined that the extent of the incremental
                benefits to OSHA of collecting the data is uncertain--and because OSHA
                can still obtain the data from employers if needed for specific
                enforcement actions--the agency is choosing to protect worker privacy
                and commit the agency's resources to fully utilizing 300A and severe
                injury report data that its experience has already demonstrated are
                useful. Other federal and state agencies may weigh worker privacy
                concerns differently based on their missions, priorities, and budgets.
                The Health Information Portability and Accountability Act (HIPAA) and
                Americans With Disabilities Act (ADA)
                 One commenter indicated that PII should never be included in
                published data because such action would conflict with HIPAA and could
                require employees in healthcare settings to violate patients' privacy
                rights, subjecting those employees to legal and licensing problems.
                (Document ID 1936). Another commenter noted that--like HIPAA--the ADA
                protects medical information from unnecessary disclosure and limits who
                can access an employee's medical records (including only providing them
                to government personnel investigating compliance upon request).
                (Document ID 2036-A1, p. 5). OSHA disagrees that HIPAA and the ADA
                would apply to its electronic collection of Forms 300 and 301 for the
                reasons set forth in the 2016 final rule, (see 81 FR at 29665-66), but
                agrees that privacy-related policy concerns reflected in these laws
                buttress its determination that these data should not be collected in
                this way.
                Technological Limitations of De-Identification Software
                 In the NPRM, OSHA proposed to amend the recordkeeping regulations
                to protect worker privacy by no longer requiring employers to submit
                electronically detailed injury and accident information. (E.g., 83 FR
                at 36494). Specifically, OSHA explained the concern about potential
                disclosure of sensitive worker information under the Freedom of
                Information Act (FOIA). (E.g., 83 FR at 36494). Although software is
                available to scrub identifying information from electronic data, the
                software cannot eliminate the risk of disclosure of PII. (83 FR at
                36498). Even if all PII were removed from the data, a risk remains that
                some data could still be re-identified with a particular individual.
                (83 FR at 36498).
                 Many commenters echoed OSHA's concerns that, under the prior final
                rule,
                [[Page 388]]
                PII or data that could be re-identified with a particular individual
                could be released under FOIA. (Document ID 2070-A1, pp. 3, 4-5; 2055-
                A1, p. 2). These commenters stated that OSHA's plan to de-identify PII
                through software is insufficient to protect worker privacy. (Document
                ID 2070-A1, p. 5; 2055-A1, p. 2). For example, one commenter stated
                that in the case of a unique injury occurring in a small town, the
                sensitive details of an injury might easily be associated with a
                specific individual even without naming that individual. (Document ID
                2032-A1).
                 Although OSHA stated in the 2016 final rule that ``the [a]gency
                will use software that will search for, and de-identify, personally
                identifiable information before the submitted data are posted'' (81 FR
                at 29662), OSHA did not guarantee complete removal of PII through de-
                identification software as some commenters claimed. (See Document ID
                2031 (``OSHA made it clear [information that would identify individual
                workers] would never be released to the public.''); 2038-A1, p. 2
                (``OSHA ensured [sic] us [information tied to individual workers] would
                never be released to the public.'')). In fact, OSHA stated that it
                intended to protect sensitive information from release, (81 FR at
                29659), but that is not a guarantee. Commenters noting that OSHA has
                not cited any concrete evidence of problems or errors in de-
                identification since promulgating the 2016 final rule, nor any evidence
                that the information on Forms 300 and 301 would be particularly
                vulnerable to disclosure (Document ID 2020-A1, pp. 3-5; 2033-A1, p. 4),
                fail to give due weight to the possibility that sensitive worker
                information could be released despite OSHA's best efforts. Claims that
                the concerns about disclosure after de-identification are
                ``speculative'' and raise only a ``remote'' risk of disclosure
                (Document ID 2020-A1, p. 4) likewise ignore OSHA's past experience of
                needing to remove PII and other sensitive information from Forms 300
                and 301 on a case-by-case basis prior to release to prevent re-
                identification, as discussed above in more detail.
                 After carefully considering commenters' submissions on this issue,
                OSHA finds that there is a meaningful risk to worker privacy if OSHA
                requires employers to electronically file detailed injury and illness
                data on Forms 300 and 301 because de-identification software cannot
                fully eliminate the risk of disclosure of PII or re-identification of a
                specific individual and manual review of the data would not be
                feasible. OSHA's past experience with case-by-case release of 300 and
                301 data and severe injury reports reveals that these concerns are far
                from speculative. These risks weigh in favor of the rescinding
                requirements to submit the data from Forms 300 and 301 to OSHA
                electronically.
                Risk of Cyber Attack
                 In the NPRM, OSHA stated that electronically-stored data might
                incentivize cyber-attacks on the Department's IT system. OSHA noted
                that there was a potential compromise of user information for OSHA's
                Injury Tracking Application (ITA) in 2017, demonstrating that such a
                large data collection will inevitably encounter malware. (83 FR at
                36498, Fn. 2).
                 Several commenters agreed with OSHA that worker privacy could be
                compromised by a data breach, cyber-attack, or malware, and that
                collecting such a large amount of data electronically could incentivize
                cyber-attacks on the Department. (E.g., Document ID 2076-A1, p. 5).
                Some of these commenters noted the 2017 potential compromise of OSHA's
                ITA as a basis for these concerns. (Document ID 2034-A1, p. 2; 2076-A1,
                p. 5). Commenters also included examples of large scale breaches of
                government data systems in other agencies. (Document ID 2034-A1, pp. 1-
                2; 2042-A1, p. 2). In addition, commenters cited a 2016 report by the
                House Oversight Committee finding that the federal government was
                vulnerable to cyber-attacks (Document ID 2034-A1, p. 1), and a Federal
                Information Security Modernization Act (FISMA) Report to Congress for
                Fiscal Year 2017 finding that the Occupational Safety and Health Review
                Commission had an overall rating of ``At Risk'' (Document ID 2070-A1,
                p. 8).
                 One commenter asserted that OSHA should be just as capable as MSHA
                of safeguarding the data since the Department consolidated Information
                Technology (IT) services in 2014. (Document ID 2082-A2, p. 5; see also
                Document ID 2088-A1, p. 12 (noting that MSHA has strong information
                security controls in place)).
                 OSHA notes that the ITA data meet the security requirements for
                government data, and after reconsidering this issue, OSHA does not find
                that collecting the data from Forms 300 and 301 would increase the risk
                of a successful cyber-attack. Some risk remains, however, that a cyber-
                attack could occur and result in the release of data. Moreover, OSHA
                shares the concerns of some commenters about how having thousands of
                businesses upload a large volume of additional data could generally
                increase risk for cyber-security issues. (See, e.g., Document ID 2045-
                A1, p. 3; 2075-A1, pp. 4-5).
                Limitations on OSHA's Capacity To Collect and Use the Data From Forms
                300 and 301
                 In the NPRM, OSHA expressed doubt about the necessity for and
                ability to use the large volume of data that would be generated by
                Forms 300 and 301, given its resources and competing priorities. As
                explained below, OSHA has prior experience with using the 300A data
                successfully and believes that it is the best resource for enforcement
                targeting and compliance assistance. OSHA also receives and effectively
                uses data concerning the most severe injuries and illnesses. In
                contrast, the agency has no prior experience using the case-specific
                data collected on Forms 300 and 301 for enforcement targeting or
                compliance assistance and is unsure how much benefit such data would
                have for these purposes or the level of resources needed to attain any
                benefit. (83 FR at 36498). OSHA noted that the agency's efforts to
                realize these uncertain benefits by collecting, processing, analyzing,
                distributing, and programmatically applying the data would be costly.
                (83 FR at 36498-99).
                 Several commenters agreed that OSHA may not be able to make
                beneficial use of the large volume of data it would receive under the
                2016 Rule. (Document ID 2034-A1, p. 2; 2070-A1, p. 9). The United
                States Postal Service also expressed concern that any technical
                complications OSHA experienced due to the large volume of data being
                submitted could hinder timely reporting, leading to steep monetary
                penalties for employers. (Document ID 2034-A1, p. 2).
                 Other commenters claimed that OSHA has the capacity to collect and
                code this volume of data. (Document ID 2011-A5, p. 1 (commenting on
                2013 NPRM); 2026-A1, p. 3; 2029). The Attorneys General of NJ, MA, MD,
                NY, PA, RI, and WA jointly commented that OSHA's lack of experience
                with this volume of data is unsurprising because OSHA has not tried to
                collect the Form 300 and 301 data yet. (Document ID 2028-A1, p. 3).
                They noted that for this reason it is also unsurprising that the
                benefits are uncertain at this point. (Document ID 2028-A1, p. 3).
                Another commenter observed that OSHA does have experience evaluating
                Form 300 Logs and Form 301 Incident Reports while conducting workplace
                investigations, so OSHA should be able to make use of such information
                collected through electronic submissions. (Document ID 2063-A1, pp. 1-
                2).
                [[Page 389]]
                 Although OSHA is technically capable of collecting the 300 and 301
                data through a secure Web portal similar to the one used for 300A data
                collection, no such portal was built when the 2016 rule was being
                developed or after it was finalized. Diverting resources now to build
                such a portal would take away from OSHA's enforcement efforts.
                Likewise, the cost of collecting the additional 300 and 301 data in
                that manner would be substantial (see Section IV, Final Economic
                Analysis and Regulatory Flexibility Certification). OSHA has
                accordingly concluded that worker privacy concerns and OSHA's resource
                priorities--including fully utilizing the 300A data that it already has
                collected from 214,574 establishments--outweigh the uncertain benefits
                of seeking to collect and process the data from Forms 300 and 301.
                 Several commenters observed that other agencies, as well as other
                divisions within the Department of Labor, collect, track, and utilize
                similar data. (E.g., Document ID 2026, pp. 2-3). Some of these
                commenters encouraged consultation with other agencies who collect this
                type of data, including NIOSH, MSHA, Bureau of Labor Statistics (BLS),
                FRA, and FAA, to learn about database design and best practices for
                collecting this kind of data. (Document ID 1965-A1, pp. 179-80; 2012-
                A1, p. 9; 2085-A1, p. 16 (quoting comments on 2013 NPRM)). Given OSHA's
                successful use of summary data from Form 300A and severe injury reports
                to target its enforcement and outreach efforts, and given its privacy
                concerns and its current resources and priorities, OSHA has determined
                to continue to invest its time and money in an approach that is known
                to be effective, while continuing its use of 300 and 301 data in onsite
                inspections.
                 OSHA also received a comment from NIOSH, offering to help with data
                analysis. Specifically, NIOSH commented that it is well-positioned to
                play a leading role in helping OSHA use data collected in Forms 300 and
                301 to prevent occupational injuries and illnesses. (Document ID 2003-
                A2, p. 3). NIOSH explained that it has the experience and capacity to
                analyze the data, as well as interest in using the data to provide
                guidance to employers for the prevention of occupational injury and
                illness, and to provide data analysis results and analytical tools that
                should enhance OSHA's targeting. (Document ID 2003-A2, p. 3). NIOSH
                noted that it has already developed auto-coding methods for
                categorizing occupation and industry based on free text data and has
                successfully utilized similar free text data collected from workers'
                compensation claims. (Document ID 2003-A2, p. 5). While NIOSH
                acknowledged that the data collected from Forms 300 and 301 would pose
                a greater analysis challenge because of the amount of data, NIOSH
                stated that the large data set would be useful to identify patterns and
                prevent workplace injuries. (Document ID 2003-A2, p. 6).
                 OSHA appreciates the value of inter-agency efforts to achieve
                shared goals of preventing occupational injuries and illnesses and
                looks forward to continued coordination with NIOSH and other agencies
                where appropriate. However, OSHA has determined that NIOSH's ability to
                analyze data collected from Forms 300 and 301 does not reduce the
                burden on OSHA to collect the data. Even if NIOSH could make the data
                useful for OSHA's enforcement targeting and outreach efforts, which
                NIOSH itself has suggested would present analytical challenges due to
                the volume of the data, OSHA and employers would be left covering the
                expense of collection, not to mention additional expense associated
                with the need to process and otherwise manually review data from the
                forms--costs that would detract from OSHA's priorities of enforcement
                and compliance assistance to reduce workforce hazards.
                 After reviewing commenters' submissions related to OSHA's capacity
                to use the large volume of data that would be generated by the
                submission of Forms 300 and 301, the agency remains concerned about the
                costs of collecting and processing this large volume of data. OSHA has
                considered the comments about the benefits of electronically collecting
                the data and, as explained more fully below, has determined that the
                incremental benefits of electronic collection of these data to OSHA's
                enforcement targeting and compliance assistance activities remain
                uncertain. In OSHA's judgment, those uncertain benefits are outweighed
                by the cost of developing a system to manage that volume of data,
                particularly when making use of the data would divert resources away
                from OSHA's current priority of fully utilizing Form 300A and severe
                injury data for targeting and outreach.
                Uncertain Extent of Benefits From Collecting the Data From Forms 300
                and 301
                 In the proposed rule, OSHA preliminarily determined that the extent
                of the incremental benefits of electronically collecting data from
                Forms 300 and 301 is uncertain. (E.g., 83 FR at 36498-99). OSHA
                explained that the collection of data from the summary Form 300A
                provides the agency with the information it needs to identify and
                target establishments with high rates of work-related injuries and
                illnesses. (83 FR at 36498). For example, OSHA noted that it had
                collected summary 300A data for 2016 from 214,574 establishments. (83
                FR at 36498). OSHA further explained that it was able to use those data
                to design a targeted enforcement mechanism for establishments
                experiencing higher rates of injuries and illnesses. (E.g., 83 FR at
                36498). OSHA noted its plans to further refine this approach by using
                the greater volume of 2017 summary data. (83 FR at 36498).
                 The proposed rule also discussed OSHA's long-time use of summary
                data in enforcement. (83 FR at 36498). Before the 2016 rule, OSHA had
                collected these data for 17 years under its OSHA Data Initiative (ODI)
                and used those data to identify and target high-rate establishments
                through the Site-Specific Targeting (SST) Program. (83 FR at 36498).
                OSHA stopped the ODI in 2013 and the SST in 2014 while it developed the
                2016 final rule, but the agency noted that those prior programs have
                still given it considerable experience with using 300A data for
                targeting. (83 FR at 36498).
                 Conversely, OSHA explained that it has no prior experience with
                using the case-specific data from Forms 300 and 301 to identify and
                target establishments for enforcement or outreach purposes. (83 FR at
                36498). For example, OSHA is unsure how much benefit such data would
                have for these purposes, but has determined that considerable effort
                and resources would be required to realize those uncertain benefits.
                (83 FR at 36498-99). The agency estimated that establishments with 250
                employees or more would report data from approximately 775,210 Form
                301s annually, a total volume three times the number of Form 300As from
                which data were uploaded for 2016, while also presenting more
                complicated information than that captured by Form 300A. (83 FR at
                36498). To gain enforcement value from the case-specific 300 and 301
                data, OSHA explained that it would need to divert resources from other
                priorities, such as the utilization of Form 300A data, which OSHA's
                long experience has shown to be useful. (83 FR at 36498-99).
                 OSHA asked stakeholders to submit comments on the benefits and
                disadvantages of the proposed removal of the requirement for employers
                with 250 or more employees to submit the data from OSHA Forms 300 and
                301 to OSHA electronically on an annual basis, including the usefulness
                of the data for
                [[Page 390]]
                enforcement targeting (83 FR at 36499), and received a number of
                comments in response. Many of the commenters agreed that the
                enforcement benefits stemming from electronically collecting the Form
                300 and 301 data are uncertain. (E.g., Document ID 2034-A1, pp. 2-3;
                2036-A1, pp. 7-8). One commenter also suggested that OSHA has not shown
                that it is fully and effectively using currently-available data
                (Document ID 2019-A1, p. 3), and another indicated that OSHA has not
                demonstrated that there are significant gaps in the current data that
                compromise OSHA's execution of its mission, that electronically
                collecting the Form 300 and 301 data will address those gaps, or that
                the protocols described by the 2016 final rule will efficiently and
                effectively compile necessary information to lead to significant
                improvements in achieving OSHA's goals (Document ID 2003-A2, p. 3).
                Commenters further noted that OSHA did not explain in 2016 how it would
                effectively use the Form 300 and 301 data to the benefit of its
                enforcement and compliance assistance programs. (E.g., Document ID
                2019-A1, p. 3; 2044-A1, p. 6). Other commenters concluded that
                collecting Form 300A data is sufficient for OSHA's targeting and
                enforcement purposes and electronically collecting the Form 300 and 301
                data has no clear benefit. (E.g., Document ID 1970-A1; 2034-A1, pp. 2-
                3).
                 Commenters also asserted that Form 300 and 301 data do not predict
                current hazards or take into account any corrective actions by the
                employer, nor do they show if OSHA should have issued a citation in
                response to a recorded occurrence. (E.g., Document ID 2057-A1, p. 3;
                2075-A1, p. 3). Put another way, the fact that an employer records an
                incident does not necessarily correlate to workplace hazards or
                compliance inadequacy or otherwise indicate that the reporting employer
                is responsible for the incident. (E.g., Document ID 2075-A1, p. 3). For
                example, the E-Recordkeeping Coalition stated that, ``[b]ased on a
                qualitative analysis of [its] members' 300 and 301 data, only a small
                percentage of that data would indicate any regulatory compliance
                insufficiency.'' (Document ID 2076-A1, p. 3). Relatedly, one commenter
                posited that collecting the Forms 300 and 301 data does not serve the
                purpose of a ``no-fault'' recordkeeping system. (Document ID 2057-A1,
                p. 3).
                 According to some commenters, maintaining Form 300 and 301 data
                electronically would not aid OSHA in identifying, and engaging in
                enforcement, at high-risk workplaces, (e.g., Document ID 2042-A1, p.
                2), or otherwise provide any real value to the agency's enforcement
                targeting strategies or decisions (e.g., Document ID 2075-A1, p. 3;
                2076-A1, p. 3). A comment in the record concerning OSHA's 2013 NPRM,
                from a commenter that generally supported OSHA's collection of Form 300
                and 301 data, noted that use of the Form 301 narratives can be
                cumbersome. (Document ID 2085-A8, p. 31). The Phylmar Regulatory
                Roundtable pointed out that OSHA can still collect the Form 300 and 301
                data after it has determined to inspect an establishment, using the
                data to target specific areas of the workplace during the inspection,
                and stated that doing so results in a fair, objective process, rather
                than injecting unfairness and subjectivity into OSHA's targeting
                decisions. (Document ID 2070-A1, p. 8). OSHA agrees that the best use
                of the Form 300 and 301 data is for identifying hazards during onsite
                inspections, and OSHA will continue using the data in this manner.
                 OSHA disagrees with commenters asserting that OSHA now ignores many
                key benefits it previously asserted would be derived from
                electronically collecting and publishing the Form 300 and 301 data.
                (E.g., Document ID 2028-A1, p. 3; 2054-A1, p. 6). Rather, OSHA is now
                re-assessing the uncertain incremental benefits to OSHA enforcement and
                compliance assistance activities and re-balancing those benefits
                against worker privacy concerns and OSHA's current resource priorities.
                That balancing takes into account, as is appropriate, how OSHA can and
                will continue to collect and use data from Forms 300 and 301 as needed,
                as well as data from severe injury reports, for on-site inspections and
                specific enforcement.
                 OSHA's position in this final rule on the uncertain benefits of
                collecting data from Forms 300 and 301 outside the context of an onsite
                inspection is not inconsistent with its position in the Mar-Jac Poultry
                case (see U.S. v. Mar-Jac Poultry, Inc., 153 Fed. Appx. 562 (11th Cir.
                Oct. 9, 2018) (unpublished)), as some commenters suggested. (E.g.,
                Document ID 2015-A1, pp. 8-11; 2054-A1, pp. 8-9). In that case, OSHA
                took the position that the 300 logs had value for identifying potential
                violations during an onsite inspection, and OSHA maintains that belief.
                Indeed, OSHA intends to continue using the data from Forms 300 and 301
                for that purpose. OSHA notes that case involved the use of 300A data
                from an establishment OSHA is inspecting to expand the scope of the
                inspection; it did not address the usefulness, for enforcement
                purposes, of collecting a high volume of Form 300 and 301 data.
                 One commenter disagreed with rescinding the requirement to submit
                data from Forms 300 and 301 to OSHA without taking certain steps
                identified in the 2016 final rule--including ``looking at examples of
                electronic data collection efforts by other federal agencies'' and
                ``form[ing] a working group with BLS to assess data quality,
                timeliness, accuracy, and public use of the collected data.'' (Document
                ID 2012-A1, p. 15). OSHA did not, however, bind itself to take such
                actions in order to reconsider the decision whether to collect the data
                was justified in light of the risk to worker privacy and the agency's
                best use of its resources. Furthermore, other agencies' experiences are
                not directly relevant to OSHA's resource priorities and unique mission.
                OSHA routinely consults with other agencies as part of its rulemaking
                process and did so for this rule. Because OSHA issues this final rule
                as a result of its re-balancing of the risk to worker privacy with the
                rule's uncertain benefits and the agency's resource priorities, OSHA
                has determined that further consultation with other agencies is neither
                necessary nor appropriate.
                 OSHA agrees, as some commenters noted, that public health
                principles dictate data-based approaches. (E.g., Document ID 2006-A1,
                p. 2; 2014-A1, p. 2). OSHA disagrees, however, that collecting the data
                from Forms 300 and 301 is therefore necessary; OSHA is already
                collecting the 300A data and using those data to inform its enforcement
                targeting. OSHA is uncertain how much additional value the data from
                Forms 300 and 301 would provide for enforcement and compliance
                assistance at this time and has therefore determined that fully
                utilizing the 300A data and severe injury report data is the best use
                of OSHA's resources. OSHA will continue to obtain the data from Forms
                300 and 301 from employers, as needed, for on-site inspections and
                specific enforcement actions, and OSHA will likewise continue to assess
                and utilize data from the severe injury reports it receives and that
                have proven useful in identifying and addressing areas of need.
                 According to some commenters, having a comprehensive batch of data
                from Forms 300 and 301 would allow OSHA to understand employer
                misconduct more broadly, and this dataset could make up for OSHA's
                inability to visit all of the worksites within its jurisdiction. (E.g.,
                Document ID 2015-A1, p. 7; 2056-A1, p. 2; 2082-
                [[Page 391]]
                A2, p. 5). Others asserted that the data can serve as a guide for
                agency inspections, providing compliance officers with the number,
                type, severity, and distribution of injuries at a particular workplace.
                (Document ID 2012-A1, p. 2; 1965-A1, p. 179 (NAS Report)).\6\ OSHA has
                determined that the 300A data are sufficient for enforcement targeting
                and compliance assistance, and notes again that it can still use Forms
                300 and 301 to guide inspections by collecting the data onsite, without
                the need to divert resources to creating a Web portal never built
                during or after the 2016 rule's development.
                ---------------------------------------------------------------------------
                 \6\ The National Academies of Science, Engineering, and Medicine
                (NAS) report, titled A Smarter National Surveillance System for
                Occupational Safety and Health in the 21st Century (Document ID
                1965-A1) was the result of a joint request from NIOSH, BLS, and OSHA
                to NAS, asking NAS to conduct a study in response to the need for a
                more coordinated, cost-effective set of approaches for occupational
                safety and health surveillance in the United States. (See Document
                ID 1965-A1, p. x). Commenters submitted copies of the report to the
                record. (See Document ID 1965-A1; 2085-A10). Where those commenters
                and others have specifically referenced findings, recommendations,
                or other statements contained in the report in their comments, OSHA
                has responded to them in this preamble. However, because the report
                is not, and was not intended to be, commentary on this rulemaking,
                the agency does not find it is appropriate or necessary to respond
                to statements contained therein where those statements were not
                referenced by commenters in their submissions to the record.
                ---------------------------------------------------------------------------
                 Some commenters indicated that having electronic access to the data
                would facilitate OSHA's effective use of the data (e.g., Document ID
                2056-A1, p. 2) by, for example, providing timely, searchable, sortable
                information with which OSHA could identify and understand trends, and
                that reducing the amount of information available to the agency would
                make it less effective. (E.g., Document ID 1974; 1994; 2020-A1, p. 11;
                2082-A2, p. 5; 2085-A1, pp. 5-7). Others, assuming the data would be
                published, suggested that employees would use publicly available
                information to analyze whether their employers are underreporting, to
                identify hazards and prevent injuries, and to determine where they may
                want to work (e.g., Document ID 2012-A1, pp. 5, 13; 2022-A1, pp. 1, 2;
                2047-A1, pp. 3-4; 2050-A1, p. 1; 2083-A1, p. 2; 2085-A1, pp. 19-20
                (quoting Document ID 2085-A10, pp. 13, 178 (NAS report)), and that
                employers would use the data to benchmark effectively, and to identify
                injury trends in the industry to prevent incidents before they occur
                (e.g, Document ID 2007-A1, p. 5; 2011-A3, p. 8; 2012-A1, p. 6; 2022-A1,
                p. 2). One commenter suggested that employers could use the data to
                assess the safety record of contractors before hiring them. (Document
                ID 2085-A1, p. 18). Commenters also argued that electronic access to
                the data would eliminate delays and obstacles to accessing the data for
                employees and their representatives. (E.g., Document ID 2020-A1, p. 11;
                2086-A1, p. 3). Other commenters opined that requiring employers to
                report their Forms 300 and 301 electronically could improve the
                consistency and quality of what employers report, providing employers
                and employees with an opportunity to decrease injuries and illnesses
                both at particular establishments and company-wide. (E.g., Document ID
                2010-A2, p. 1; 2082-A2, pp. 2-3; 2085-A1, p. 11).
                 OSHA begins by noting that many of the benefits discussed by
                commenters would not materialize. Because OSHA has determined
                publishing the data would do more harm than good for reasons described
                more fully below and in the privacy discussion above, OSHA would not
                make the data public even if collected. In addition, as noted above,
                OSHA has already taken the position that data from Form 300A is exempt
                from disclosure under FOIA and that OSHA will not make such data public
                for at least the approximately four years after its receipt that OSHA
                intends to use the data for enforcement purposes. Therefore, the
                benefits some commenters ascribed to publication of the data would not
                be realized. Without publication, the research benefits claimed by many
                commenters (e.g., Document ID 1965-A1, p. 1; 2004-A1, p. 1; 2011-A1,
                pp. 2-3 (quoting the NAS report), 6-11; 2012-A1, pp. 3-4, 6-7; 2015-A1,
                pp. 2-6; 2082-A2, pp. 2-3; 2088-A1, pp. 2, 7-8) also fall away. To the
                extent case-specific data are crucial in conducting root-cause
                analyses, which can reduce and prevent workplace illnesses and injuries
                (Document ID 2000-A1, p. 1), employers can still use their own data, or
                share it with researchers voluntarily, for this purpose. OSHA
                acknowledges that the 300 and 301 data would have benefits for
                occupational safety and health research, but notes that researchers
                already have access to BLS data and severe injury data. OSHA has
                determined that the best use of the agency's resources at this time is
                full utilization of 300A and severe injury data, not providing 300 and
                301 data to researchers despite the uncertain incremental benefits of
                the data to OSHA and especially when OSHA itself will continue to
                protect workers by accessing Forms 300 and 301 through on-site
                inspections and for specific enforcement actions as needed.
                 With respect to the remaining potential benefits for enforcement
                identified by the commenters, OSHA simply notes that those benefits are
                uncertain, and collecting and utilizing these data would be costly.
                OSHA cannot justify diverting resources from fully utilizing 300A data
                and severe injury data, which OSHA's experience has shown to be useful
                for enforcement and compliance assistance, to collect data with
                uncertain benefits to OSHA's core mission.
                 NIOSH and other commenters stated that the data from Forms 300 and
                301 could be used for future research to identify patterns and trends
                across workplaces that could be masked by aggregated, summary data from
                Form 300A. (Document ID 2003-A2, pp. 6-7; 2007-A1, p. 4). In addition,
                the NAS report echoed a number of the benefits of collection identified
                by some commenters, including research for surveillance and prevention
                purposes, employer benchmarking, employee assessment of safety and
                health conditions at various workplaces, and intervention and education
                by public health agencies. (Document ID 1965-A1, pp. 177-179). The NAS
                report suggests that electronic collection of Form 300 and 301 data
                would supplement BLS Survey of Occupational Injuries and Illnesses
                (SOII) data, letting OSHA focus its interventions and prevention
                efforts on hazardous industries, workplaces, exposures, and high-risk
                groups. (Document ID 1965-A1, p. 179). According to the report,
                collecting the Form 300 and 301 data would allow for expanding and
                targeting outreach to employers, particularly smaller employers, to
                improve hazard identification and prevention efforts, and would give
                OSHA the opportunity to advise employers on how their rates of injury
                and illness compare with the rest of their industry. (Document ID 1965-
                A1, p. 178).
                 OSHA will continue to work with NIOSH, other government agencies,
                and interested stakeholders to share information and leverage
                efficiencies to reduce workplace injuries and illnesses as appropriate.
                And while OSHA appreciates the findings and recommendations of the NAS
                Report that commenters identified, the approaches suggested by NAS
                would require substantial investment of time and money to develop. OSHA
                has determined that at this juncture, the protection of worker safety
                and health will best be furthered by allocating its resources in more
                concrete ways in which OSHA can more fully draw on its existing
                experience, such as utilizing the 300A and severe injury data it is
                [[Page 392]]
                already collecting and analyzing for enforcement and compliance
                assistance activities.
                 Several commenters pointed out ways in which OSHA has used Forms
                300 and 301 and similar data in the past to further its mission of
                ensuring safe and healthy workplaces. (E.g., Document ID 2003-A2, pp.
                6-7; 2012-A1, pp. 3-4). For example, commenters asserted that OSHA has
                previously analyzed Form 300 and 301 data from multiple workplaces to
                identify frequently-recurring injuries and to better protect workers'
                safety and health, and used information from severe injury reports to
                understand injury causation and to inform the agency's compliance
                assistance and outreach efforts. (Document ID 2012-A1, pp. 3-4; 2003-
                A2, pp. 6-7). Employers have had to submit severe injury reports,
                containing information similar to what is included on Form 301, to OSHA
                since 2015. (Document ID 2003-A2, p. 6). To the extent OSHA has
                evaluated small batches of similar data in the past to further its
                mission of protecting worker safety and health, commenters suggest that
                a broader collection could be similarly useful.
                 OSHA agrees that data from Forms 300 and 301 and similar data can
                be helpful, but disagrees that its past experience justifies the broad
                collection envisioned in 2016. As NIOSH acknowledged in its comment,
                the volume of Form 300 and 301 data employers were required to submit
                under the 2016 final rule would far exceed the number of severe injury
                reports OSHA receives. (Document ID 2003-A2, p. 6). Collecting and
                using a high volume of data--without the relevancy filters imposed by
                severe injury reports or on-site inspections--would require substantial
                resources to process and analyze. OSHA has determined that, at the
                current time, the resources OSHA would need to devote to developing
                that capacity and determining best how use the data would better
                achieve the mission of the agency by being allocated to full
                utilization of the 300A and severe injury data. OSHA will thus continue
                to obtain and use data from Forms 300 and 301 from employers as needed
                for on-site inspections and specific enforcement actions, as has proven
                helpful in the past.
                 Moreover, as OSHA notes elsewhere in this preamble, before making
                300 and 301 records requested on an ad hoc basis or severe injury
                reports public, the agency manually screens all of those records for
                PII and data that could re-identify workers. But the sheer volume of
                the data, which is expected to come from over 775,000 reports, would
                make the costs to manually screen all of the 300 and 301 data enormous;
                OSHA believes those resources are better allocated to activities closer
                to OSHA's core enforcement mission. One commenter suggested that
                collecting the data from Forms 300 and 301 electronically would benefit
                workers by allowing them access to these records without fear of
                retaliation for requesting the records from their employers. (Document
                ID 2083-A1, p. 2). But OSHA notes that workers have a right under 29
                CFR 1904.35 to access their own employers' 300 and 301 data, and
                Section 11(c) of the OSH Act, 29 U.S.C. 660(c), prohibits employers
                from retaliating against workers for exercising that right. Another
                commenter asserted that a worker's medical provider could benefit from
                OSHA's electronic collection and publication of 300 and 301 data and
                using the data to assess conditions at the relevant workplace.
                (Document ID 2010-A2, p. 4) (commenting on the 2013 NPRM). But OSHA
                again notes that workers retain the right to access 300 and 301 data
                from their own employers and share it with their medical providers.
                 After considering these comments, OSHA has determined that because
                it already has systems in place to use the 300A data for enforcement
                targeting and compliance assistance without impacting worker privacy,
                and because the Form 300 and 301 data would provide uncertain
                additional value, the Form 300A data are sufficient for enforcement
                targeting and compliance assistance at this time. OSHA will continue to
                request copies of Forms 300 and 301 during its inspections, and make
                use of data from severe injury reports, as appropriate.
                Collecting and Processing the 300 and 301 Data Would Divert Agency
                Resources From Higher Priority Initiatives
                 As OSHA stated in the NPRM, electronically collecting and taking
                steps necessary to try to use Form 300 and 301 data would require the
                agency to divert resources from other priorities, including the
                analysis of Form 300A data. As explained above, OSHA has already
                collected summary 300A data from 214,574 establishments, and expects
                that volume to increase. OSHA is seeking to fully utilize these data,
                and has designed and implemented a targeted enforcement mechanism for
                industries experiencing higher rates of injuries and illnesses. OSHA
                likewise evaluates severe injury reports, which it receives shortly
                after accidents, to target its enforcement and compliance-assistance
                efforts.
                 Many commenters agreed that OSHA would need to significantly
                increase or divert its resources from other priorities to collect,
                process and analyze the electronically submitted Form 300 and 301 data.
                (E.g., Document ID 2008-A1, p. 2; 2019-A1, pp. 2, 6-7, 9-10; 2044-A1,
                p. 6 (citing 83 FR at 36496)). Some noted that, without diverting
                resources from other priorities, OSHA might not be able to analyze and
                use the data as it intended when it finalized the 2016 final rule
                (Document ID 2070-A1, p. 9), and that OSHA already has access to other
                data sources it can analyze and more potential violators than it can
                investigate with its resource constraints (Document ID 2055-A1, p. 2).
                By rescinding the requirement to collect electronically Form 300 and
                301 data, OSHA will better focus on pre-existing, successful
                enforcement efforts. (E.g., Document ID 2044-A1, p. 6; 2075-A1, p. 4).
                Commenters also agreed with OSHA that the uncertain benefits of
                requiring employers to electronically submit Forms 300 and 301 do not
                outweigh the costs and burdens to OSHA and employers and the risk to
                worker privacy. (E.g., Document ID 1985-A1, p. 1; 2008-A1, p. 2; 2024-
                A1, p. 1).
                 Other commenters suggested that requiring electronic submission of
                the Form 300 and 301 data would help OSHA allocate its resources and
                identify injury trends, their causes, and emerging hazards to improve
                its enforcement and outreach efforts beyond what OSHA can accomplish
                with the 300A data. (E.g., Document ID 1929; 1961-A1, pp. 1-2; 2007-A1,
                pp. 1-5; 2011-A1, p. 6; 2054-A1, pp. 1, 6-7, 8-9). One commenter
                theorized that having access to the detailed information contained in
                Forms 300 and 301, rather than simply the summary data from Form 300A,
                can improve OSHA's use of its enforcement resources to target the
                highest priority issues. (Document ID 2007-A1, p. 5). But these
                commenters provide no evidence to support their claims, and OSHA finds
                none in the record. OSHA's own experience with using Form 300 and 301
                data is insufficient to support these theories. These commenters'
                speculation therefore does not alter OSHA's view that diverting OSHA's
                focus from longstanding and successful agency priorities is not
                justified to achieve the uncertain benefits of electronically
                collecting data from Forms 300 and 301.
                 Commenters pointed to OSHA's statements in the 2016 final rule that
                collecting data from Forms 300 and 301
                [[Page 393]]
                would allow the agency to leverage its resources to execute its mission
                by helping its compliance assistance programs, encouraging employers
                and workers to identify and address workplace hazards to avoid the
                perception of being an unsafe place to work, and providing data to
                employers, workers, unions and academics that would assist them in
                researching and innovating to improve workplace safety and health.
                (Document ID 2007-A1, p. 3; 2017-A1, p. 2). Although OSHA identified
                these potential benefits, OSHA never quantified them. This final rule
                does not ignore those prior statements or the possibility that benefits
                could result from collecting the data, but concludes that the scope of
                any such benefits is uncertain. OSHA does not believe that these
                uncertain benefits justify the diversion of OSHA's resources from other
                agency initiatives with a proven record of effectiveness.
                 Some commenters asserted that a recent Office of the Inspector
                General (OIG) report auditing OSHA's fatality and severe injury
                reporting program (OIG, Dep't of Labor, OSHA Needs to Improve the
                Guidance for Its Fatality and Severe Injury Reporting Program to Better
                Protect Workers, 02-18-203-10-105 (OIG report), available at: https://www.oig.dol.gov/public/reports/oa/viewpdf.php?r=02-18-203-10-105&y=2018) demonstrates a need for improved reporting, noting that the
                OIG report concluded employers underreport fatalities and severe
                injuries by as much as 50 percent. (E.g., Document ID 2017-A1, p. 2;
                2051-A1, p. 3). Commenters noted that the OIG report found that OSHA
                cannot effectively target compliance and enforcement efforts without
                complete information on work-related fatalities and severe injuries.
                (E.g., Document ID 2051-A1, p. 3; 2089-A1, p. 2). Another commenter
                suggested that the collection and publication of data from Forms 300
                and 301 would create ``publicly available checks'' and increased
                accountability for employers. (Document ID 2062-A1, p. 2).
                 OSHA disagrees that the OIG report indicated a need to collect more
                injury and illness data. Rather, the report recommends that OSHA take
                steps to better enforce and implement the severe injury reporting
                requirements. (OIG report, p. 1). Specifically, the OIG recommended
                that OSHA (1) develop and provide guidance to staff to detect and
                prevent underreporting; (2) consistently issue citations for
                underreporting; (3) clarify guidance for documentation of OSHA's
                essential decisions, evidence required to demonstrate abatement by the
                employer, and requirements for monitoring employer-conducted
                investigations; and (4) emphasize the importance of conducting
                inspections for incidents that resulted in a fatality, two or more in-
                patient hospitalizations, emphasis programs, or imminent danger. (OIG
                report, p. 15). OSHA is committed to implementing these recommendations
                as indicated in OSHA's formal response to the report, (OIG report, pp.
                21-23), and OSHA has determined such implementation is more likely to
                address OIG concerns than electronically collecting Forms 300 and 301.
                 OSHA will use the OIG report's findings to shape and improve its
                severe injury reporting objectives. Indeed, this rulemaking seeks to
                improve OSHA's capacity to direct its resources to current initiatives
                such as implementing the severe injury reporting requirements, rather
                than collecting new data with uncertain benefits. OSHA's current
                priorities include fully utilizing the data from the Form 300As and
                severe injury reports it is already collecting to improve its
                enforcement and outreach objectives to ensure compliance with the OSH
                Act. Again, investing in a program to collect, process, and analyze
                data from hundreds of thousands of Forms 300 and 301 would constrain
                OSHA's ability to achieve these and other priority enforcement goals.
                 Regarding the suggestion that collection and publication of data
                from Forms 300 and 301 might increase compliance with electronic
                reporting requirements (Document ID 2062-A1, p. 2), OSHA finds it can
                better hold employers accountable through the appropriate allocation of
                resources to enforcement efforts and compliance assistance, rather than
                collecting data with uncertain benefits. This commenter provides no
                evidence for the speculative suggestion that publication of the data
                would create an incentive for employers to report fatalities and severe
                injuries. (Document ID 2062-A1, p. 2).
                Collecting 300/301 Data Could Lead to Less Accurate Records
                 Commenters expressed concern that requiring employers to report
                electronically the data from Forms 300 and 301 could have a negative
                impact on accurate recordkeeping. For example, some employers may not
                prepare Forms 300 and 301 accurately for fear that the information
                would become public and cause reputational harm or subject them to
                targeted OSHA inspections. (Document ID 2019-A1, p. 7; 2044-A1, p. 34
                (commenting on 2013 NPRM); 2055-A1, p. 2). Commenters also indicated
                that employers fear that publishing Form 300 and 301 data will expose
                confidential and proprietary information to their competitors and
                adversaries. (Document ID 2070-A1, pp. 9-10; 2076-A1, pp. 6-7). For
                example, public disclosure of location information may allow
                competitors to determine confidential business locations or
                acquisitions that have not been publicized, or publication of the
                substances or chemicals that were involved in injuries and illnesses
                may identify products, inventions, or proprietary technologies that are
                in research and development. (Document ID 2070-A1, pp. 9-10). The
                collection's focus on lagging indicators, which measure past safety
                performance, also may not be representative of a company's current
                safety efforts. (Document ID 2044-A1, p. 30) (commenting on 2013 NPRM).
                One commenter explained that Forms 300 and 301 are most useful to the
                employer when they contain robust information about the details of
                workplace injuries and illnesses, but that employers will have
                incentives to sanitize their reports if they believe they will become
                public, and be mischaracterized, as a result of electronic submission
                to OSHA. (Document ID 2019-A1, p. 7).
                 Commenters also noted that workers may be reluctant to report
                accurately their data for Forms 300 and 301 for fear that the details
                of their reports will become public and reveal their private
                information. (Document ID 2030; 2085-A8, p. 8 (commenting on 2013
                NPRM)). One commenter noted that the Confidential Information
                Protection and Statistical Efficiency Act of 2002 requires BLS to keep
                this kind of data confidential. (Document ID 2053-A1, p. 2). In
                enacting the CIPSEA, Congress found that ensuring the confidentiality
                of sensitive information submitted to the government ``is essential in
                continuing public cooperation in statistical programs.'' (Pub. L. 107-
                347 sec. 511(a)(5)). While the CIPSEA applies to BLS, not OSHA, OSHA
                shares Congress's concern that fear of sensitive information becoming
                public could undermine accurate reporting.
                 Other commenters expressed concern that employers will hide
                workplace injuries if they are not required to file Forms 300 and 301
                electronically. (Document ID 1976-A1, p. 1; 1996-A1, p. 1; 1999-A1, p.
                1; 2002-A1, p. 1). OSHA finds these comments to be speculative and
                unsupported by its experience reviewing Forms 300 and 301 through on-
                site inspections. OSHA also does not find that requiring employers to
                submit their 300 and 301 data electronically would motivate them
                [[Page 394]]
                to report injuries and illnesses they otherwise would not have
                recorded. One commenter noted that the cost to large employers of
                submitting their 300 and 301 data was not burdensome because compliance
                would have cost approximately $258.34 per establishment per year, which
                would be an average of less than one dollar per employee per year.
                (Document ID 2012-A1, p. 12). Although OSHA acknowledges that the
                requirement to submit data from Forms 300 and 301 to OSHA would have
                been economically feasible for large employers, OSHA's central
                rationale for rescinding these requirements is not to reduce employer
                costs but rather to protect worker privacy and to direct agency
                resources towards fully utilizing the data it is already collecting to
                advance improvements to health and safety for workers.
                 OSHA has determined that publishing the data could also cause more
                harm than good. Workers would know in advance that some details of
                their injuries would be public and on the internet. Deterring worker
                reporting through fear of publication could make the records less
                accurate. And, because employers are required to report workplace
                injuries and illnesses regardless of fault, OSHA no longer considers
                collection of employers' injury and illness records likely to ``nudge''
                them to make their workplaces safer, which OSHA identified in 2016 as a
                benefit of publishing the 300 and 301 data. (See 81 FR 29629; Document
                ID 2007-A1, pp. 4-5). OSHA finds that the final rule may ensure more
                accurate records on Forms 300 and 301 by alleviating employers' and
                workers' fears about the consequences of the records becoming public,
                and will allow employers to devote more of their resources towards
                compliance with safety and health standards.
                State Plan Issues
                 In the NPRM, OSHA noted that, pursuant to section 18 of the OSH Act
                (29 U.S.C. 667) and the requirements of 29 CFR 1904.37 and 1902.7,
                within 6 months after publication of the final OSHA rule, state-plan
                states must promulgate occupational injury and illness recording and
                reporting requirements substantially identical to those in 29 CFR part
                1904. (83 FR at 36505). All other injury and illness recording and
                reporting requirements (for example, industry exemptions, reporting of
                fatalities and hospitalizations, record retention, or employee
                involvement) that are promulgated by state-plan states may be more
                stringent than, or supplemental to, the federal requirements, but,
                because of the unique nature of the national recordkeeping program,
                states must consult with OSHA and obtain approval of such additional or
                more stringent reporting and recording requirements to ensure that they
                will not interfere with uniform reporting objectives under 29 CFR
                1904.37 and 1902.7. (See 83 FR at 36505).
                 Some commenters responded to this section of the NPRM with concerns
                that centralized, federal collection is the most efficient and cost-
                effective way to compile detailed data for enforcement and prevention,
                and that the analysis of small, discrete quantities of data from
                multiple state databases will make important trends less apparent.
                (Document ID 2062-A1. p. 1; 2028-A1, pp. 5-6; 1965-A1, pp. 6-7).
                Commenters theorized that the detailed reporting requirements of the
                prior final rule would have enabled both federal OSHA and state plans
                to target their prevention and enforcement measures at particular
                employers and industries. (Document ID 2028-A1, p. 3; 2046-A1, p. 2).
                 Commenters also asserted that, as a result of this final rule, some
                states would have to set up separate reporting systems at significant
                cost to maintain reporting requirements consistent with the prior final
                rule. (Document ID 2028-A1, p. 5; 2088-A1, p. 13). The California
                Department of Industrial Relations is in favor of the reporting
                requirements of the prior final rule because national collection would
                be more efficient than state-by-state collection, among other reasons.
                (Document ID 2062-A1, p. 3). Commenters also pointed out that some
                state-level agencies, such as the Washington State Department of Labor
                and Industries (``WA L&I''), have gathered detailed data through their
                workers' compensation system and collaborated with NIOSH in analyzing
                the data to inform targeted enforcement strategies. (Document ID 1993-
                A1, p. 1; 1965-A1, pp. 57-59). One commenter pointed to the NAS Report,
                which noted that ``only 20 percent of states reported having
                substantial epidemiologic and surveillance capacity in occupational
                health'' and concluded that this lack of surveillance capacity
                ``results . . . in . . . missed opportunities for collaboration across
                public health domains to address convergent public health concerns that
                affect workers as well as the general public.'' (Document ID 1965-A1,
                p. 122 (NAS Report)). One group of commenters expressed concern that
                OSHA's consultation requirement would make it harder for states to
                implement such systems and noted that states without state plans or
                with state plans limited to public sector workers will not have the
                opportunity to have access to detailed data like that required by the
                prior rule. (Document ID 2028-A1, pp. 5-6).
                 As OSHA noted in the NPRM, the effectiveness of the Form 300 and
                301 data as an enforcement and prevention tool in advancing worker
                safety is unclear. The suggestion that the data would be useful to
                states without state plans (Document ID 2028-A1, pp. 5-6), is
                speculative, as OSHA has determined that the benefits of collecting
                such data on a national scale are uncertain and do not outweigh the
                collection's burdens and costs. (83 FR at 36498). OSHA finds that the
                Form 300A collection adequately serves its enforcement purposes at this
                time without jeopardizing worker privacy, and OSHA is committed to
                sharing these data with state-plan states, including those covering
                only public sector workers. OSHA cannot justify collecting Form 300 and
                301 data where the data's usefulness is unclear. (83 FR at 36498).
                 OSHA disagrees that this final rule would necessarily hinder states
                in implementing their own requirements for collection of Form 300 and
                301 data. As OSHA explained in the NPRM, the rule does not preempt
                state law. (83 FR at 36505). The consultation requirement is not
                intended to limit state plans to strict conformity with the rule but
                rather to aid states in avoiding interference with OSHA's unique
                recordkeeping program. There is no evidence in the record that
                individual state collection of Form 300 and 301 data would cause such
                interference. To the extent some state agencies, such as WA L&I, have
                already collected similar data, this shows that some states have
                mechanisms to collect the data they need without OSHA's collecting
                electronically the Form 300 and 301 data. If state agencies determine
                that a detailed data collection system is best for their states, then
                they may pursue such a system in consultation with OSHA.
                 OSHA acknowledges that systems to collect this volume of data would
                be costly for states to implement. Centralized collection might be more
                efficient and cost-effective than state-by-state collection, but OSHA
                has doubts about the usefulness of the data and concerns about the
                costs of collection as noted elsewhere in this preamble. States are
                empowered to do as OSHA has and weigh the substantial costs of
                collection against the likely utility of the data. OSHA also notes, in
                response to a comment that some states have more limited surveillance
                capacity than others (Document ID 1965-A1, p. 57),
                [[Page 395]]
                that those states will have access to the summary data collected by
                OSHA, and that OSHA itself must appropriately allocate its resources
                for surveillance to best serve OSHA's mission of protecting all
                workers. States are empowered to share the data gathered at the state
                level at their discretion and consistent with any applicable laws. In
                promulgating this rule, OSHA erects no barrier to communication among
                state agencies.
                B. New Requirement To Include Employer Identification Number With
                Injury and Illness Data Submitted to OSHA Electronically Under 29 CFR
                1904.41
                 The NPRM included a provision that would require covered employers
                to submit their Employer Identification Number (EIN) electronically
                along with their injury and illness data submission in the proposed
                rule. (83 FR at 36494). OSHA explained that it had limited the proposed
                data collection in its 2013 NPRM (78 FR 67254) to Improve Tracking of
                Workplace Injuries and Illnesses to records that employers were already
                required to collect under part 1904. Accordingly, the May 2016 final
                rule only required the electronic submission of such records. These
                records do not include the employer's EIN.
                 After collecting and analyzing the first year of data (i.e.,
                Calendar Year 2016 Form 300A data), however, OSHA and BLS realized that
                collecting EINs could help the agencies make full use of the data
                collected. The proposed EIN submission requirement grew out of that
                realization. As the agency explained in the proposal, this change could
                have a number of benefits. (83 FR at 36499-500). For example, OSHA
                posited that collecting EINs would increase the likelihood that BLS
                would be able to match data collected by OSHA under the electronic
                reporting requirements in 29 CFR part 1904 to data collected by BLS for
                the Survey of Occupational Injury and Illnesses (SOII). The ability to
                accurately match the data is critical for evaluating how BLS might use
                OSHA-collected data to supplement the SOII, which in turn would enhance
                the ability of OSHA and other users of the SOII data to identify
                occupational injury and illness trends and emerging issues.
                Furthermore, the ability of BLS to match the OSHA-collected data also
                has the potential to reduce the burden on employers who are required to
                report injury and illness data both to OSHA (for the electronic
                recordkeeping requirements in part 1904) and to BLS (for the SOII).\7\
                ---------------------------------------------------------------------------
                 \7\ As OSHA explained in the NPRM, the SOII is an establishment
                survey and is a comprehensive source of national estimates of
                nonfatal injuries and illnesses that occur in the workplace. (83 FR
                at 36499). The survey collects data on non-fatal injuries and
                illnesses for each calendar year from a sample of employers based on
                recordable injuries and illnesses as defined by OSHA in 29 CFR part
                1904. (83 FR at 36499). Using data from the survey, BLS estimates
                annual counts and rates by industry and state for workers in private
                industry and state and local government. (83 FR at 36499-500). In
                addition, the SOII provides details about the most severe injuries
                and illnesses (those involving days away from work), including
                characteristics of the workers involved and details of the
                circumstances surrounding the incident, using data collected on
                Forms 300A and 301 from the sampled establishments. (83 FR at 36500
                (citing BLS Handbook of Methods: https://www.bls.gov/opub/hom/soii/home.htm)).
                ---------------------------------------------------------------------------
                 OSHA also noted in the proposal that without the EIN, there is no
                methodological approach to match completely the establishments that
                submit data through both OSHA's collection of injury and illness data
                under Sec. 1904.41 and the BLS data collection for the SOII. BLS
                cannot provide its collected data to OSHA because the Confidential
                Information Protection and Statistical Efficiency Act of 2002 (Pub. L.
                107-347, 116 Stat. 2899 (2002)) prohibits BLS from releasing
                establishment-specific data to either OSHA or the general public. (83
                FR at 36500). Although OSHA can provide the data it collects to BLS,
                without the EIN it is very difficult to match the establishments in
                OSHA's data collection to the establishments in BLS's data collection.
                Not having the EIN increases the resources necessary to match the data
                and reduces the accuracy of the match.
                 OSHA further explained its preliminary determination that including
                the EIN in the electronic reporting to OSHA would improve BLS's ability
                to match accurately the OSHA-collected data with the SOII data. (83 FR
                at 36500). OSHA suggested that, after evaluation of the accuracy of the
                data matching, it might be possible for BLS to use the OSHA-collected
                data to generate occupational injuries and illnesses estimates,
                reducing burden on employers by decreasing duplicative reporting. If
                the EIN is not collected and the data from the two sources cannot be
                accurately matched, reducing this burden becomes nearly impossible.
                 Finally, OSHA suggested that including the EIN as part of
                electronic reporting could improve the quality and utility of the
                collected data. (83 FR at 36500). For example, OSHA noted that it could
                use the EIN to identify errors such as multiple submissions of data
                from the same establishment and to link multiple years of data
                submissions from the same establishment. (83 FR at 36500). The agency
                also observed that the EIN could be used to match against other
                databases that contain this identifier to add additional
                characteristics to the data. (83 FR at 36500). For example, OSHA
                routinely collects the employer's EIN during an inspection and enters
                the EIN into the OSHA Information System (OIS). OSHA noted in the
                proposal that Form 300A submissions with an EIN could be linked to the
                OIS to identify the previous enforcement history of the establishment
                when the inspection records contain the EIN. (83 FR at 36500).
                 In the proposal, OSHA also noted that EINs do not have the same
                level of protection as Social Security numbers. (83 FR at 36500). In
                fact, many employers' EINs are available in a variety of public
                sources, including filings with the U.S. Securities and Exchange
                Commission, the Federal Communications Commission's Commission
                Registration System, and the DOL's Employee Benefits Security
                Administration. (83 FR at 36500). Businesses also have to share EINs
                with contractors and clients for tax reporting, such as filing an IRS
                Form 1099. (83 FR at 36500). As a result, OSHA explained, the
                Department has not generally withheld EINs from disclosure. (83 FR at
                36500).
                 OSHA asked stakeholders to comment on its proposal to add the EIN
                submission requirement generally. (83 FR at 36499). The agency also
                specifically invited public comment on the advantages and disadvantages
                of requiring employer submission of EINs and on whether employers
                required to electronically report information to OSHA under part 1904
                would consider the EIN to be exempt from disclosure, either as
                confidential business information or for another reason. (83 FR at
                36500). In addition, OSHA asked if there were any circumstances where
                the EIN would be considered PII and whether there were privacy concerns
                that might arise from employers submitting their EIN. (83 FR at 36500).
                 Commenters submitted a number of comments in response to OSHA's
                request. These comments generally fall into three categories: (1)
                Comments related to the benefits of collecting EINs, (2) comments
                focusing on whether an employer's EIN is commercially confidential or
                sensitive, and (3) comments suggesting alternatives to the agency's
                proposal that might achieve the agency's goal of reducing respondent
                burden and increasing the utility of the data collected, without the
                submission
                [[Page 396]]
                of EINs. Each of these issues, commenters' submissions, and the
                agency's final determinations are laid out in more detail below.
                Benefits of Collecting the EIN
                 As discussed above, OSHA preliminarily determined that collecting
                EINs would have a number of benefits, including streamlining reporting
                for employers who are required to report injury and illness data both
                to OSHA and BLS, improving the agencies' ability to match their data,
                and improving the quality and utility of the collected data. (83 FR at
                36499-500). OSHA received many comments on the benefits of collecting
                the EIN.
                 Many commenters agreed with OSHA that collection of the EIN would
                enhance the utility of the data and therefore improve worker safety and
                health. (E.g., Document ID 2012-A1, p. 15). Several commenters provided
                specific examples of how the EIN can be used by OSHA for research
                purposes, such as identifying employers with patterns of injuries
                (E.g., Document ID 2015-A1, p. 7) and matching against other databases
                that contain the EIN to add characteristics to the data. (E.g.,
                Document ID 2003-A2, p. 7). Several commenters also noted that using
                the EIN to enhance research is consistent with recommendations from the
                NAS Report. (E.g., Document ID 2003-A2, p. 7). Still other commenters
                observed that collecting EINs would allow OSHA to improve the quality
                and utility of the data collected, and provided many examples of the
                benefits associated with having this data element. (E.g., Document ID
                2088-A1, p. 14; 2012-A1, p. 15; 2003-A2, p. 7). For example, some
                commenters noted that adding the EIN would enhance the value of the
                data for enforcement and compliance assistance by allowing OSHA to
                identify the relationship between establishments rather than having to
                rely on company names that can be similar across different businesses.
                (E.g., Document ID 2007-A1, pp. 8-9; 2012-A1, p. 15; 2074-A1, p. 5).
                 Many commenters also agreed with OSHA that collecting the EIN along
                with data submissions under part 1904 could potentially reduce
                duplicative reporting for employers that are also required to submit
                data both to BLS under the SOII. (E.g., Document ID 2088-A1, p. 14;
                2036-A1, p. 8). Several commenters noted that using the EIN to reduce
                duplication of burden is consistent with the NAS report. (E.g.,
                Document ID 2085-A1, p. 20).
                 Other commenters, however, disagreed, observing that there
                ``appears to be little value to OSHA gained in collecting the EIN.''
                (Document ID 2084-A2, p. 5).
                 After carefully reviewing all the comments submitted on this
                subject, OSHA finds that collection of the EIN will result in the
                benefits detailed by commenters. Having this common identifier will
                help OSHA understand exactly which establishment the Form 300A data
                represents, link establishments between databases, and track data over
                time. The difficulties involved in matching and tracking establishments
                by name and address introduce uncertainty which in turn reduces the
                utility of the data collected. A numerical identifier that is common
                over time and between databases eliminates these uncertainties.
                Collecting the EIN is also an essential first step towards eliminating
                duplicative reporting to OSHA and BLS in the future. In short,
                collection and use of the EIN presents the most practical and efficient
                solution for matching and linking the BLS and OSHA data sets and at the
                same time increases the utility and accuracy of the data within OSHA's
                data set.
                Sensitivity of the EIN
                 Although nearly all of the commenters who opined on the potential
                benefits of collecting the EIN agreed with OSHA that the collection
                would be beneficial, a number of commenters argued that any benefits to
                OSHA in collecting the EIN were outweighed by the risks if the EIN is
                publicly disclosed. (Document ID 2064-A1, p. 2). For example, some
                commenters expressed concern about the commercial sensitivity of the
                EIN and the potential for fraud. (E.g., Document ID 2057-A1, p. 5).
                Some commenters maintained that the EIN was confidential business
                information comparable to a Social Security number. (E.g., Document ID
                2041-A1, p. 2; 2066-A1, p. 2). One commenter stated that it did not
                object to OSHA's proposal to include EINs with Form 300A filings,
                provided that OSHA maintains this information as confidential.
                (Document ID 2049-A1, p. 2).
                 Others, though not claiming that the EIN was confidential
                commercial information, nonetheless asserted that collecting the EIN
                could harm businesses and that such harm outweighed any benefits of
                collection. (E.g., Document ID 2084-A2, p. 5; 2039-A1, p. 3). For
                example, one commenter asserted that employers are concerned about
                making EINs more widely available through FOIA requests ``given the
                high potential for fraud. For example, a 2013 audit by the U.S.
                Department of the Treasury identified 767,071 corporate tax returns
                with potentially fraudulent refunds totaling almost $2.3 billion due to
                stolen and falsely obtained EINs.'' (Document ID 2057-A1, p. 5).
                Commenters also stated that the risk of bad actors causing
                ``irreparable harm'' through malicious use of the EIN ``far outweighs
                the issues involved in duplicative reporting.'' (Document ID 2039-A1,
                p. 3; see also Document ID 2084-A2, p. 5; 2064-A1, p. 2).
                 Other commenters conceded that the EIN was not commercially
                confidential and did not oppose OSHA's proposal to collect the EIN with
                injury and illness data. (E.g., Document ID 2036-A1, p. 8; 2070-A1, p.
                17). For example, Mark Dreux of the Corn Refiners Association (CRA)
                stated: ``Because employers are required to disclose their EINs in many
                different contexts . . . CRA's members do not consider it to be
                confidential or proprietary business information.'' (Document ID 2036-
                A1, p. 8). Consequently, CRA indicated that its members did not have
                any concerns with the proposed requirement to submit EINs in
                conjunction with injury and illness data to facilitate the exchange of
                data between OSHA and BLS. (Document ID 2036-A1, p. 8). In fact, CRA's
                members agreed with OSHA that ``the submission of employers' EINs will
                simplify and avoid duplicative reporting of information between the two
                agencies.'' (Document ID 2036-A1, p. 8; see also Document ID 2070-A1,
                p. 17). Other employers simply noted that they did not object to
                collection of EINs. (E.g., Document ID 1930-A1, p. 5). There were no
                comments that claimed the EIN is Personally Identifiable Information
                (PII). Several commenters specifically stated that it is not PII.
                (E.g., Document ID 1969; 2070-A1, p. 17).
                 After reviewing these comments, OSHA concludes that the EIN is not
                confidential commercial information, nor is it too sensitive to collect
                with injury and illness data. The EIN is a government-issued number
                (thus, not commercial), and as discussed above, many commenters
                conceded that EINs are routinely made public (thus, not confidential).
                Many companies must include their EINs on public filings or in filings
                that are later disclosed in response to FOIA requests. (See 83 FR at
                36500). For these reasons, OSHA has determined the EIN is not too
                sensitive to collect given the possibility of release to the public
                under FOIA.
                 OSHA also reviewed the Treasury Inspector General for Tax
                Administration's 2013 report, Stolen and Falsely Obtained Employer
                Identification Numbers Are Used to Report False Income and Withholding,
                [[Page 397]]
                referenced in a comment (see Document ID 2057-A1, p. 5). The report
                does not indicate any harm done to the legitimate business owners of
                the stolen EINs. While the report shows that tax fraud involving
                misused EINs exists, it does not provide any indication that collection
                of the EIN by OSHA would put employers at increased risk or exacerbate
                the problem of false tax returns. OSHA does not agree that the findings
                of this report are relevant to the agency's collection of the EIN with
                injury and illness data.
                Alternative Proposals and Miscellaneous Issues
                 Several commenters encouraged OSHA to seek and use alternative
                methods to achieve the goal of reducing respondent burden and
                increasing the utility of the data collected without collecting the
                EIN, such as exploring technological approaches to resolve the
                duplication issue (Document ID 2039-A1, p. 3), and others suggested
                that OSHA should not need the EIN ``to determine whether it has correct
                information when comparing it with [BLS].'' (Document ID 2073-A1, p.
                2). One commenters suggested that OSHA should delay collection of the
                EIN ``unless there is relative certainty that the data can and will be
                used for its intended purpose.'' (Document ID 2019-A1, p. 8).
                 OSHA agrees that further collaboration with BLS to identify methods
                for reducing respondent burden is vital. Collection and use of the EIN
                presents the most practical and efficient solution for matching and
                linking the two agencies' separate data sets at this time. OSHA does
                not agree that a delay in the collection is warranted. The benefits of
                having these data are clear, as discussed above. Any delay in the
                collection of the EIN would delay the reduction in respondent burden
                and increased utility of the Form 300A data collected.
                 The final rule requires employers to provide the EIN of their
                establishments when submitting their injury and illness data. As
                discussed above, evidence in the docket shows the EIN is a widely
                available public record. Employers routinely made their EIN available
                to both government and private entities, and OSHA already collects and
                stores EINs in its inspection records. OSHA concludes the collection
                and storage of the EINs through the ITA will pose minimal adverse
                effects to establishments that provide these data. At the same time,
                OSHA concludes the benefits of collecting these data are substantial.
                Having the EIN will increase the utility of the data by both BLS and
                OSHA and may reduce the burden on employers that are required to
                respond to both the BLS and OSHA data collections. OSHA will continue
                to collaborate with BLS to identify technological approaches to reduce
                respondent burden, including exploring changes to both data collection
                systems and real-time sharing of OSHA data with BLS.
                Compliance Dates
                 The requirement to include the EIN for each establishment
                submitting injury and illness data under 29 CFR 1904.41 will become
                effective on February 25, 2019. The compliance date for this provision
                is March 2, 2020. The EIN will therefore be required for covered
                establishments submitting their 300A data from 2019, but not for
                covered establishments submitting their 300A data from 2018, which have
                to be submitted by March 2, 2019.
                IV. Final Economic Analysis and Regulatory Flexibility Certification
                A. Introduction
                 Executive Orders 12866 and 13563 require that OSHA estimate the
                benefits, costs, and net benefits of proposed and final regulations.
                Executive Orders 12866 and 13563, the Regulatory Flexibility Act (5
                U.S.C. 601-612) and the Unfunded Mandates Reform Act (UMRA) (2 U.S.C.
                1501-1571) also require OSHA to estimate the costs, assess the
                benefits, and analyze the impacts of certain rules that the agency
                promulgates. Executive Orders 12866 and 13563 direct agencies to assess
                all costs and benefits of available regulatory alternatives and, if
                regulation is necessary, to select regulatory approaches that maximize
                net benefits (including potential economic, environmental, public
                health and safety, and other effects; distributive impacts; and
                equity). Executive Order 13563 emphasizes the importance of quantifying
                both costs and benefits, reducing costs, harmonizing rules, and
                promoting flexibility.
                 In its preliminary economic analysis (PEA) in the proposal, OSHA
                estimated that this rule would have net cost savings of $8.28 million
                per year at a 3 percent discount rate, including $8.23 million per year
                for the private sector and $52,754 per year for the government.
                Annualized at a 7 percent discount rate, OSHA estimated that the
                proposed rule would have net cost savings of $8.25 million per year,
                including $8.18 million per year for the private sector and $64,070 per
                year for the government. Annualized at a perpetual 7 percent discount
                rate, the estimate rose to net cost savings of $8.35 million per year.
                The agency stated its belief that the electronic collection of
                information in the Forms 300 and 301 poses risks to worker privacy and
                additional cost to employers and OSHA that outweigh the uncertain
                enforcement benefits of collecting that information. (83 FR at 36501).
                 In this final economic analysis, OSHA estimates that the rule would
                have net cost savings of $15.9 million per year at a 3 percent discount
                rate, including $8.4 million per year for the private sector and $7.5
                million per year for the government. Annualized at a 7 percent discount
                rate, the rule would have net cost savings of $15.86 million per year,
                including $8.37 million per year for the private sector and $7.5
                million per year for the government. Annualized at a perpetual 7
                percent discount rate, the rule would have net cost savings of
                $16million per year. The agency has determined that the rescission of
                the requirement to submit electronically the Forms 300 and 301 data
                will benefit worker privacy by preventing routine government collection
                of information that may be quite sensitive, including descriptions of
                workers' injuries and the body parts affected. OSHA has determined
                that, at this time, avoiding this risk to worker privacy outweighs the
                uncertain incremental benefits to enforcement gained from
                electronically collecting the data. In addition, the rule will allow
                OSHA to focus its resources on the collection of 300A data and the data
                provided through the new serious injury and illness reporting system.
                 OSHA finds that the new requirement for establishments to submit
                their EIN will help both OSHA and BLS make full use of the data the
                agencies collect. Collecting the EIN is helpful to understanding
                exactly which establishment the Form 300A data represents, linking
                establishments between databases, and tracking data over time. The
                difficulties involved in matching and tracking establishments by name
                and address introduce uncertainty, which in turn reduces the utility of
                the data collected. A numerical identifier that is common over time and
                between databases eliminates these uncertainties. Collecting the EIN is
                also a positive first step towards eliminating duplicative reporting to
                OSHA and BLS in the future. In short, OSHA concludes that collection of
                the EIN presents the most practical and efficient solution for matching
                and linking the BLS and OSHA data sets and at the same time increases
                the quality and utility of the collected data.
                 The final rule is not an ``economically significant regulatory
                action'' under E.O.
                [[Page 398]]
                12866 or UMRA (2 U.S.C. 1532(a)), and it is not a ``major rule'' under
                the Congressional Review Act (CRA) (5 U.S.C. 801 et seq.). The agency
                estimates that the rulemaking imposes far less than $100 million in
                annual economic costs. In addition, it does not meet any of the other
                criteria specified by UMRA or CRA for a significant regulatory action
                or major rule. The final rule is a deregulatory action under Executive
                Order 13771 (82 FR 9339 (January 30, 2017)).
                 The final rule will make two changes to the existing recording and
                reporting requirements in part 1904. First, OSHA will eliminate the
                requirement for establishments that are required to keep injury and
                illness records under part 1904, and that had 250 or more employees in
                the previous year, to electronically submit information from OSHA
                recordkeeping Forms 300 and 301 to OSHA or OSHA's designee, on an
                annual basis. Second, OSHA will require covered employers to submit
                their EIN electronically along with other injury and illness data they
                are required to submit to OSHA. These changes in existing requirements
                are identical to those included in the proposal. The final rule does
                not make any other changes to an employer's obligations regarding
                injury and illness records.
                 In the subsections below, OSHA will first examine the cost savings,
                costs, net cost savings, and benefits of the activities outlined above,
                including a discussion of the comments submitted on these topics. The
                agency will then turn to its economic feasibility finding and its
                certification under the Regulatory Flexibility Act.
                B. Cost Savings
                 As discussed in more detail below, OSHA preliminarily estimated
                that the proposed elimination of the requirement that establishments
                with 250 or more employees submit information electronically from their
                OSHA Forms 300 and 301 would result in cost savings to employers and to
                the government. (See 83 FR at 36501-02). Numerous commenters responded
                that businesses are already required to keep these data and that
                reporting the data to OSHA was not a costly additional requirement.
                (E.g., Document ID 1943; 1945; 1947; 2077-A1, p. 2). One commenter
                stated that making the data from Forms 300 and 301 available ``is a
                reasonable cost of doing business.'' (Document ID 1942). None of these
                comments challenged OSHA's specific cost estimates; rather, they simply
                asserted that the costs were not substantial. OSHA's estimate of the
                cost savings to employers from eliminating the requirement to submit
                the data from Forms 300 and 301 is consistent with OSHA's finding in
                2016 regarding the incremental cost of submitting these data. And, as
                detailed earlier in this preamble, even though any related costs may be
                minor for larger employers, OSHA has decided to rescind the requirement
                to submit the data from Forms 300 and 301 primarily to protect
                sensitive worker information from the risk of public disclosure, and to
                focus its resources on fully utilizing the 300A data and severe injury
                reports OSHA already collects rather than diverting resources from
                those efforts given the uncertain extent of any incremental benefits
                the 300 and 301 data would have for OSHA's enforcement and outreach
                activities.
                 For the PEA, OSHA relied on the Final Economic Analysis (FEA) in
                the May 2016 final rule (see 81 FR at 29674-87), updated to include
                more recent data and some modifications in OSHA's methodology. OSHA
                obtained the estimated cost of electronic data submission by
                multiplying the compensation per hour of the person expected to perform
                the task of electronic data submission by the time required to submit
                the data. (83 FR at 36501).
                 In the PEA, as in the 2016 FEA, OSHA selected an employee in the
                occupation of Industrial Health and Safety Specialist as being at the
                appropriate salary level. The agency stated that the mean hourly wage
                for Standard Occupational Classification (SOC) code 29-9011, Industrial
                Health and Safety Specialists, in the May 2016 data from the BLS
                Occupational Employment Survey (OES), was $34.85. However, OSHA
                recognized that not all firms assign the responsibility for
                recordkeeping to an Industrial Health and Safety Specialist. For
                example, a smaller firm may use a bookkeeper or a plant manager, while
                a larger firm may use a higher-level specialist. Therefore, OSHA asked
                for comment on whether Industrial Health and Safety Specialist is the
                appropriate salary level for the employee performing this task. (83 FR
                at 36501).
                 OSHA did not receive any comments on this question; nor did
                commenters object to the mean hourly rate used in the PEA. Therefore,
                OSHA finds that Industrial Health and Safety Specialist is the
                appropriate salary level. The updated mean hourly rate for this
                position, per the May 2017 OES data, is $35.38.\8\ OSHA notes that this
                is the raw wage and does not include the other fringe benefits that
                make up full hourly compensation or overhead costs calculated in this
                analysis.
                ---------------------------------------------------------------------------
                 \8\ See https://www.bls.gov/oes/current/oes299011.htm.
                ---------------------------------------------------------------------------
                 In the PEA, OSHA multiplied the mean hourly wage for Industrial
                Health and Safety Specialist ($34.85) by the applicable mean fringe
                benefit factor for workers in private industry as reported in the June
                2017 data from the BLS National Compensation Survey (1.44) to obtain
                the estimated total compensation (wages and benefits) of $50.18 per
                hour. (83 FR at 36501).
                 OSHA did not receive any comments on this point. Therefore, OSHA is
                retaining the estimate, with updates based on the June 2018 data from
                the BLS National Compensation Survey.\9\ The Survey again reported a
                mean fringe benefit factor of 1.44 for workers in private industry.
                Multiplying the mean fringe benefit factor by the updated hourly wage
                of $35.38 produces an estimated total compensation of $50.95 (an
                increase of 1.5 percent from the PEA, due to the increase in the mean
                hourly wage). OSHA believes that the calculated cost of $50.95 per hour
                is a reasonable estimated total hourly compensation for a typical
                record keeper.
                ---------------------------------------------------------------------------
                 \9\ See https://www.bls.gov/news.release/ecec.nr0.htm.
                ---------------------------------------------------------------------------
                 As noted in the PEA, overhead costs are indirect expenses that
                cannot be tied to producing a specific product or service. Common
                examples include rent, utilities, and office equipment. Unfortunately,
                there is no general consensus on the cost elements that fit this
                definition. The lack of a common definition has led to a wide range of
                overhead estimates. Consequently, the treatment of overhead costs needs
                to be case-specific. For the PEA, OSHA adopted an overhead rate of 17
                percent of base wages. OSHA explained that the 17 percent rate was
                consistent with the overhead rate used for sensitivity analyses in the
                FEA in support of the 2017 final rule delaying the deadline for
                submission of 300A data (82 FR 55761) and the FEA in support of OSHA's
                2016 final standard on Occupational Exposure to Respirable Crystalline
                Silica.\10\ (83 FR at 36501).
                ---------------------------------------------------------------------------
                 \10\ See the sensitivity analyses in the Improved Tracking FEA
                (https://www.gpo.gov/fdsys/pkg/FR-2017-11-24/pdf/2017-25392.pdf,
                page 55765) and the FEA in support of OSHA's 2016 final standard on
                Occupational Exposure to Respirable Crystalline Silica (81 FR 16285)
                (https://www.gpo.gov/fdsys/pkg/FR-2016-03-25/pdf/2016-04800.pdf
                pp.16488-16492.). The methodology was modeled after an approach used
                by the Environmental Protection Agency. More information on this
                approach can be found at: U.S. Environmental Protection Agency,
                ``Wage Rates for Economic Analyses of the Toxics Release Inventory
                Program,'' June 10, 2002 (Ex. 2066). This analysis itself was based
                on a survey of several large chemical manufacturing plants: Heiden
                Associates, Final Report: A Study of Industry Compliance Costs Under
                the Final Comprehensive Assessment Information Rule, Prepared for
                the Chemical Manufacturers Association, December 14, 1989, Ex. 2065.
                ---------------------------------------------------------------------------
                [[Page 399]]
                 To calculate the total labor cost for an Industrial Health and
                Safety Specialist, Standard Occupational Classification (SOC) code 29-
                9011 for the PEA, OSHA added three components together: Base wage
                ($34.85) + fringe benefits ($15.33, derived as 44% of $34.85) +
                applicable overhead costs ($5.92, derived as 17% of $34.85). This
                increased the labor cost of the fully-loaded hourly wage for an
                Industrial Health and Safety Specialist to $56.10. (83 FR at 36501).
                 OSHA did not receive any comments concerning its use of overhead or
                the calculations to add an overhead charge to the loaded wage rate.
                Therefore, for the FEA, OSHA has calculated the total labor cost for an
                Industrial Health and Safety Specialist, Standard Occupational
                Classification (SOC) code 29-9011, using the same method. The three
                components are added together: Base wage ($35.38) + fringe benefits
                ($15.57, derived as 44% of $35.38) + applicable overhead costs ($6.01,
                derived as 17% of $35.38). This increases the labor cost of the fully-
                loaded hourly wage for an Industrial Health and Safety Specialist to
                $56.96. OSHA considers this to be a reasonable estimate of total labor
                costs.
                 To estimate the time required for the data submission in the PEA,
                OSHA used the same estimated unit time requirements as reported by BLS
                in its paperwork burden analysis for the Survey of Occupational
                Injuries and Illnesses (SOII) (OMB Control Number 1220-0045). BLS
                estimated 10 minutes per recordable injury/illness case for electronic
                submission of the information on Form 300 (Log of Work-Related Injuries
                and Illnesses) and Form 301 (Injury and Illness Incident Report). OSHA
                also noted that, in the 2016 FEA, the agency estimated 2 minutes more
                time than the BLS paperwork burden, for a total of 12 minutes per
                recordable case (10 minutes per case for Form 301 entries plus 2
                minutes per case for entry of Form 300 log entries), to account for the
                differences between BLS and OSHA submission requirements. (83 FR at
                36501-02).
                 OSHA received two comments about its preliminary time and burden
                hour calculations. (Document ID 2012-A1, p. 12). The first commenter
                argued that OSHA's estimated establishment-specific costs of the
                electronic submission of data to OSHA are likely to be far higher than
                the actual costs to employers, since the PEA assumed that all the data
                will be entered manually for electronic submission. (Document ID 2012-
                A1, p. 12). The commenter wrote that OSHA noted in the 2016 rule that
                establishments that already keep their records electronically may have
                lower submission times if they can export or transmit the required
                information rather than entering it into the web form. (Document ID
                2012-A1, p. 12) (quoting 81 FR 29690). The commenter asserted that OSHA
                ignored this potential decrease in burden hours in the PEA. (Document
                ID 2012-A1, p. 12).
                 OSHA recognizes that many large establishments will already be
                keeping their records electronically and would likely have submitted
                their data electronically through a batch upload or other bulk
                electronic transmission, thus reducing the time that would have been
                needed to comply with the electronic reporting requirement and the
                corresponding cost estimate. The agency does not have precise
                information regarding the percentage of employers that fall into that
                category. Even if the percentage of those large employers is
                substantial, OSHA does not have, and commenters did not provide, data
                on the ease with which those employers could package this information
                and transmit it in the format required.\11\ Therefore, as in the 2016
                final rule, OSHA is retaining the time estimate that assumed manual
                data entry for electronic submission.
                ---------------------------------------------------------------------------
                 \11\ To the extent some establishments may not have an internet
                connection on site, that could also increase the time burden and
                thus raise the cost estimate.
                ---------------------------------------------------------------------------
                 In addition, to the extent that the commenter is arguing that the
                agency's omission of this fact from the PEA was an attempt to obscure a
                potential decrease in the proposal's estimated cost savings, OSHA notes
                that the statement regarding potential time savings was made in
                response to a comment submitted during the 2016 rulemaking--a comment
                that did not cause the agency to change its time estimate. Moreover,
                the agency was clear in the PEA that its methodology was based on the
                numbers in the 2016 rule. (See 83 FR 36501).
                 The second commenter on this issue similarly argued that OSHA's
                cost estimate of 12 minutes per recordable case is based on the wrong
                data point. The commenter maintained that OSHA's preliminary cost
                analysis failed to disaggregate the time spent preparing Forms 300,
                300A, and 301 (which an employer must incur regardless of whether the
                form must be submitted to OSHA electronically) from the time spent
                electronically submitting Forms 300 and 301 to OSHA. The commenter
                argues that OSHA's cost estimate should be based only on the marginal
                time of electronic reporting itself. (Document ID 2033-A1, p. 6).
                 OSHA agrees that the time estimate (and, thus, the cost savings
                estimate) should account only for the incremental time spent on each
                data submission--that is precisely why the agency calculated cost
                savings in that manner in the PEA and continues to do so in this FEA.
                (See 83 FR at 36501-02; see also 81 FR at 29676 (discussing the time
                needed to submit the Forms 300 and 301 data electronically). The cost
                of keeping records, including Forms 301, 301 and 300A were accounted
                for in previous OSHA final rules and ICRs. The 2016 rule imposed
                additional costs for electronic submission, and those were reported in
                that FEA. (See 81 FR at 29676). This current final rule removes only
                those newly imposed costs.
                 Therefore, having considered all the comments in the record on this
                issue, OSHA continues to rely the time estimates from the PEA. OSHA
                believes that the original estimate of 12 minutes per recordable case
                is a reasonable average.
                 In the proposal, OSHA estimated the number of injuries and
                illnesses that would have been reported by covered establishments with
                250 or more employees under the 2016 final rule (and, thus, the number
                that would no longer be required to be reported under the proposal). To
                do so, OSHA assumed that the total number of recordable cases in
                establishments with 250 or more employees was proportional to the
                establishments' share of employment within each industry.\12\ OSHA then
                used the most recent SOII data to estimate that, without the final
                rule, covered establishments with 250 or more employees would report
                775,210 injury and illness cases per year. The PEA thus estimated that
                cost per case at $11.22 (12/60 x $56.10), and the total cost at
                $8,699,173 ($11.22 per case x 775,210 cases).\13\ (83 FR at 36502).
                ---------------------------------------------------------------------------
                 \12\ OSHA solicited comment on this assumption in the PEA but
                received none and so has retained this method for estimating total
                recordable cases for this FEA.
                 \13\ Note that totals summarized in the text may not precisely
                sum from underlying elements due to rounding. The precise
                calculation of the numbers in the FEA appears in the spreadsheet in
                the rulemaking docket titled ``FEA calculations.''
                ---------------------------------------------------------------------------
                 OSHA did not receive any comments on these estimates. OSHA
                continues to find the above methodology and estimates to be reasonable
                and has used them in the final rule, with updates based on the new wage
                rate and
                [[Page 400]]
                establishment totals.\14\ The final cost per case to report the
                information from Forms 300 and 301 is estimated at $11.39 (12/60 x
                $56.96), and the total cost is $8,829,642 ($11.39 per case x 775,210
                cases).\15\ Therefore, removing the requirement to submit the
                information from OSHA Forms 300 and 301 to OSHA electronically would
                result in a total cost savings to the private sector of $8,829,642.\16\
                ---------------------------------------------------------------------------
                 \14\ This cost estimate was developed prior to the NPRM, and is
                subject to change based on subsequent developments to OSHA's ITA.
                 \15\ In addition, note that the totals in Table 1 of this
                section of the preamble and the totals summarized in the text may
                not precisely sum from underlying elements due to rounding. The
                precise calculation of the numbers in the FEA appears in the
                spreadsheet in the rulemaking docket titled ``FEA calculations.''
                 \16\ Overall, the estimated cost savings to private industry of
                removing the requirement for electronic reporting of case data is 25
                percent greater than the 2016 estimated cost of promulgating the
                provision ($6,948,487). There are three reasons for this 25 percent
                increase: The number of establishments with more than 250 employees
                has grown, the mean hourly wage has increased, and OSHA is now
                including a 17 percent overhead estimate in the cost estimates.
                ---------------------------------------------------------------------------
                 As noted in the PEA, the 2016 FEA included government costs for the
                rule because creating a reporting and data collection system was a
                significant fraction of the total costs of the regulation. OSHA
                estimated that not collecting the case-specific data from OSHA Forms
                300 and 301 would generate a small additional cost savings for the
                government because that portion of the reporting and data collection
                system has not yet been created and would not have to be created under
                this final rule. OSHA estimated a lump sum savings from not creating
                the software to collect the data from Forms 300 and 301 to be $450,000.
                OSHA did not receive any comments about the cost to the government of
                creating software to collect the data from Forms 300 and 301 and finds
                that the original estimates are reasonable in light of overall costs
                expected, so in the FEA OSHA will retain the estimate of $450,000.
                Annualized at 3 percent over 10 years, this would represent a savings
                to the government of $52,754 per year; annualized at 7 percent over 10
                years, the cost savings would be slightly higher: $64,070. This
                estimate underestimates costs to the government of having a system for
                collection of this data. It includes the costs of software development,
                but it does not include other administrative costs, or the analysis
                that would be needed in order to use the data received by the system
                for enforcement purposes.
                 A significant source of costs that was identified during the
                preparation of this economic analysis is the anticipated costs of
                attempting to remove PII and information that enables re-identification
                of individuals from data that would have been collected under the 2016
                final rule. This cost was not considered in the rulemaking preceding
                the 2016 final rule because OSHA anticipated using software for this
                purpose. As explained above, a court could require OSHA to release the
                data as a result of a FOIA request. This risk is not insignificant--in
                a recent decision, subsequent to publication of the NPRM for this rule,
                in a lawsuit seeking to order OSHA to enforce the requirement for
                covered employers to submit their Form 300 and 301 data from 2017 to
                OSHA electronically, the court concluded that OSHA would likely be
                required to release a significant portion of the data to the plaintiffs
                under FOIA despite OSHA's concerns about employee privacy. See Public
                Citizen Health Research Group v. Acosta, No. 18-1729, slip op. at 9
                (D.D.C. Dec. 12, 2018). The court reasoned that, if some records
                present a meaningful possibility of re-identification, OSHA could
                redact any sensitive information ``on a case by case basis.'' Id. If
                the Form 300 and 301 data were to be released, OSHA would need to
                manually review the data to be released--from approximately 775,000
                cases annually--to remove PII and other information that could allow
                re-identification of ill or injured workers. This review would be
                necessary because, as noted above, software cannot guarantee full
                scrubbing of PII and has no ability to judge re-identifiable
                information. OSHA has therefore added annual costs for case-by-case
                review.
                 As noted above, OSHA estimates, based on the time it has taken OSHA
                staff to review and remove personal information from other OSHA data,
                that case-by-case review would require two levels of review. OSHA
                anticipates that the first level review would be done by a GS-12, Step
                5 Analyst (on the Washington, DC locality GS pay scale) and that
                analyst's work would be reviewed by a GS-14, Step 5 Supervisor (also on
                the Washington, DC locality pay scale).
                 The government hourly labor costs for the work of these employees
                were calculated in the following manner. Federal GS-12, Step 5 Analysts
                would conduct most of the review work. The fully-loaded hourly wage of
                a GS-12, Step 5 Analyst is calculated by taking the annual salary,
                dividing by the requisite 2087 hours worked per year, adding a fringe
                benefit factor of 1.6, and finally adding a 17 percent overhead charge.
                Using that formula, the fully-loaded hourly wage rate of a GS-12, Step
                5 Analyst is $78.38 (annual salary of $92,421/2087 hours = base wage of
                $44.28 x 1.6 + $44.28 x .17 = $78.38). A GS-14, Step 5 Supervisor would
                review the review work. Using the same formula, the fully-loaded hourly
                wage rate of the supervisor is $110.14 (annual salary of $129,869/2087
                hours = base wage of $62.23 x 1.6 + $62.23 x .17 = $110.14).
                 The cost calculation for manually reviewing Form 300 and 301 data,
                and removing any PII and other information that could allow re-
                identification of ill or injured workers, is as follows. OSHA is
                estimating that the first level review by the GS-12, Step 5 Analyst
                would take, on average, six minutes per record to review the record and
                redact any PII and other information that could allow re-identification
                of ill or injured workers. The agency is also estimating that all
                records would need to be reviewed. The first level review would have an
                estimated total annual cost of $6,076,323 (775,210 records x 6 minutes
                per record x 1 hour per 60 minutes x $78.38 per hour). The second level
                review completed by the GS-14, Step 5 Supervisor is estimated to take,
                on average, one minute per record and, again, all records would need to
                undergo this second level review. The supervisor review of the first-
                level review has an estimated total annual cost of $1,423,064 (775,210
                records x 1 minute per record x 1 hour per 60 minutes x $110.14). The
                total labor cost to review and remove PII by examination of each record
                is estimated to be $7,499,387 ($6,076,323 + $1,423,064) annually.
                 OSHA notes that these numbers are broadly consistent with the
                annual costs of MSHA's data collection and publication program (from
                the MSHA ICR Supporting Statement, https://www.reginfo.gov/public/do/DownloadDocument?objectID=76285301).
                C. New Costs (From the EIN Collection)
                 In the PEA, OSHA also estimated the potential new costs of amending
                the recordkeeping regulation to require covered employers to submit
                their EINs electronically along with their injury and illness data
                submission. The agency anticipated that some employees given this task
                would already know their employer's EIN from their other duties, but
                others would need to spend some time finding out this information. OSHA
                estimated an average of 5 minutes for an employee to find out his or
                her employer's EIN and to enter it on the submission form. Therefore,
                OSHA
                [[Page 401]]
                estimated that the unit cost for a submission would be the loaded wage
                of the employee who submitted the information multiplied by his or her
                time plus overhead, or $4.68 [(5/60) x $56.10]. (83 FR at 36502).
                 OSHA did not receive any comments on this estimate, and the agency
                has determined that the preliminary estimate was reasonable. Therefore,
                OSHA has retained the 5 minute estimate in this FEA. The updated unit
                cost for a submission would be the wage of the employee who submitted
                the information multiplied by his or her time plus overhead, or $4.75
                [(5/60) x $56.96].
                 In the PEA, OSHA explained that the currently-implemented
                electronic reporting system is already designed to retain information
                about each establishment based on the login information, including the
                EIN. Therefore, employers would only have to provide OSHA their EIN
                once, so this would not be a recurring cost. However, it would be an
                additional one-time cost for employers who are newly reporting data
                because, for example, the establishment is new or the employer newly
                reached the reporting threshold for employment size. OSHA estimated
                that each year there will be about 10.15 percent more establishments
                that will be required to report their EIN. OSHA derived the 10.15
                percent figure from the U.S. Census Bureau's Statistics of U.S.
                Businesses (SUSB), specifically the employment change data set,\17\
                which shows the increase in U.S. business establishments from 2014 to
                2015. In 2015, there were 689,819 new establishments, out of a total of
                6,795,201 establishments. Dividing the first figure by the second gives
                a change of about 10.15 percent. (83 FR at 36502). There were no
                comments criticizing OSHA's use of the SUSB data or the methodology to
                estimate the number of new reporting establishments each year, and OSHA
                continues to find the above methodology and estimates to be reasonable.
                Therefore, OSHA is retaining these estimates for the FEA.
                ---------------------------------------------------------------------------
                 \17\ See https://www2.census.gov/programssurveys/susb/datasets/2015/us_state_emplchange_2014-2015.txt.
                ---------------------------------------------------------------------------
                 In the PEA, OSHA estimated costs for covered establishments to
                provide their EINs, using establishment and employment data from the
                U.S. Census County Business Patterns (CBP).\18\ The three categories of
                included establishments included in the CBP data are: (1) All
                establishments with 250 or more employees in industries that are
                required to routinely keep OSHA injury and illness records, (2)
                establishments with 20-249 employees in certain high-hazard industries,
                as defined in the Appendix to the May 2016 final rule, and (3) farms
                and ranches with 20 or more employees. CBP data do not include numbers
                of farms and ranches with 20 or more employees, so in the May 2016
                final rule, OSHA used data from the 2012 Census of Agriculture. Updated
                data from the 2017 Census of Agriculture were not available for the
                PEA, so the PEA used the 2012 count of 20,623 farms with 20 or more
                employees. CBP data also showed that there were 36,903 establishments
                with 250 or more employees in industries required to routinely keep
                records and 405,666 establishments with 20-249 employees in the
                designated high-hazard industries. Combining these figures with 20,623
                farms and ranches results in a total of 463,192 establishments that
                would be required to submit an EIN under the proposed rule. With a cost
                per establishment of $4.68, the total first year cost of providing EINs
                would be $2,165,751 (463,192 x $4.68). The annualized cost over ten
                years at a 3 percent discount rate was $253,892, and at a 7 percent
                discount rate the cost was $308,354. (83 FR at 36502).
                ---------------------------------------------------------------------------
                 \18\ For the CBP, see https://www.census.gov/programs-surveys/cbp.html.
                ---------------------------------------------------------------------------
                 OSHA did not receive any comments on these estimates, and the
                agency has determined that the preliminary estimates were reasonable.
                Therefore, OSHA is retaining them (with the available updates) in the
                FEA. Because updated establishment data were not available, OSHA has
                retained the PEA estimate of 463,192 establishments that would be
                required to submit and EIN under the final rule. With a cost per
                establishment of $4.75, the updated total first year cost of providing
                EINs would be $2,200,162 (463,192 x $4.75).\19\ When this cost is
                annualized over ten years, the annualized cost at a 3 percent discount
                rate is $257,926 and at a 7 percent discount rate the cost is $313,254.
                ---------------------------------------------------------------------------
                 \19\ In addition, note that the totals in Table 1 of this
                section of the preamble, as well as totals summarized in the text,
                may not precisely sum from underlying elements due to rounding. The
                precise calculation of the numbers in the FEA appears in the
                rulemaking docket in the spreadsheet titled ``FEA calculations.''
                ---------------------------------------------------------------------------
                 As noted above, OSHA estimates that 463,192 establishments
                (including establishments with more than 250 employees, those with 20-
                249 employees in certain NAICS codes, and farms with more than 20
                employees) will be subject to reporting their EIN in the first year
                under this rule. In the PEA, the agency explained that with 10.15
                percent new establishments each year, there would be an additional
                47,012 establishments each year that would newly need to report their
                EIN, resulting in an additional cost of $4.68 x 47,012 or $219,858. (83
                FR at 36502). OSHA did not receive any comments on the estimated
                additional costs for new establishments each year, and the agency has
                determined that this is a reasonable estimate. Therefore, the agency
                has retained these estimates in the final rule. The final cost for
                those establishments, using the updated unit cost for a submission
                ($4.75), will be $4.75 x 47,012 or $223,307. As explained in the PEA,
                the cost for new establishments each year does not occur in the first
                year. (83 FR at 36502). Therefore, OSHA annualized 9 years of new
                establishment costs over ten years, which results in annualized costs
                of $216,608 at a discount rate of 3 percent and $207,676 at a 7 percent
                discount rate.
                 OSHA noted in the PEA that the EIN data field is already included
                in the reporting system design, so the agency did not anticipate any
                additional government costs associated with submittal of the EIN. (83
                FR at 36502). Commenters did not object to this determination, and the
                agency has no reason to believe that any such costs will be incurred by
                the government. Therefore, OSHA is not accounting for any additional
                government costs associated with EIN submittal in the final rule.
                D. Net Cost Savings
                 OSHA presented its estimates of the cost savings associated with
                eliminating the Forms 300 and 301 electronic data submission
                requirements, the new costs associated with collecting the EIN, and the
                net total costs in Table 1 of the proposed rule. (83 FR at 36502-03).
                Commenters on the proposal did not submit any thoughts on these
                estimates. Therefore, OSHA has retained the estimates, with updates, as
                described above. The cost savings of the final rule, the new costs
                associated with collecting the EIN, and the net total cost savings are
                shown in Table 1. Combining the cost savings to the private sector and
                to the government, the estimated total annual cost savings from the
                final rule would be $16,383,000 at a 3 percent discount rate and
                $16,395,000 at 7 percent discount rate. The additional costs to the
                private sector from collection of the EIN are estimated to be $474,000
                at a 3 percent discount rate and $521,000 at 7 percent discount rate.
                The net cost savings for this rule to the private sector are estimated
                to be $8,410,000 at a 3 percent discount rate
                [[Page 402]]
                and $8,375,000 at 7 percent discount rate.
                 Table 1--Total Cost Savings and Total Additional Costs of the Final Rule \20\
                ----------------------------------------------------------------------------------------------------------------
                 FEA annual cost
                 Cost savings element PEA annual cost savings savings \21\
                ----------------------------------------------------------------------------------------------------------------
                Cost savings for eliminating electronic $8,699,173................................. $8,831,000
                 submission of part 1904 records by
                 establishments with 250 or more employees
                 (Total Private Sector Savings).
                Total Government Software Cost Savings, 3 52,754..................................... 53,000
                 percent discount rate over ten years.
                Total Government Software Cost Savings, 7 64,070..................................... 64,000
                 percent discount rate over ten years.
                Total Annual Government PII Review Cost Savings (*)........................................ 7,499,000
                Total Cost Savings per year, 3 percent discount 8,751,927.................................. 16,383,000
                 rate over ten years.
                Total Cost Savings per year, 7 percent discount 8,763,243.................................. 16,395,000
                 rate over ten years.
                ----------------------------------------------------------------------------------------------------------------
                
                 New costs from EIN collection Cost
                ----------------------------------------------------------------------------------------------------------------
                First Year EIN Cost............................ 2,165,751.................................. 2,199,000
                Annualized First Year Costs, 3 percent discount 253,892.................................... 258,000
                 rate over ten years.
                Annualized First Year Costs, 7 percent discount 308,354.................................... 313,000
                 rate over ten years.
                Subsequent Annual EIN Costs (from new 219,858.................................... 223,000
                 establishments), starting in second year.
                Subsequent annual EIN Cost Annualized at a 3 213,262.................................... 217,000
                 percent discount rate over ten years.
                Subsequent annual EIN Cost Annualized at a 7 204,468.................................... 208,000
                 percent discount rate over ten years.
                Annualized Total EIN Cost, 3 percent discount 467,194.................................... 474,000
                 rate over ten years.
                Annualized Total EIN Cost, 7 percent discount 512,822.................................... 521,000
                 rate over ten years.
                Net Cost Savings, 3 percent discount rate over 8,284,733.................................. 15,909,000
                 ten years.
                Net Cost Savings, 7 percent discount rate over 8,250,421.................................. 15,862,000
                 ten years.
                ----------------------------------------------------------------------------------------------------------------
                * Not calculated.
                 As OSHA explained in the proposal (83 FR at 36503), there could be
                substantial cost savings from requiring covered employers to include
                the EIN in their reporting. There is roughly a 40 percent overlap
                between the BLS SOII sample and private sector establishments required
                to report to OSHA. If OSHA collected Form 300A from all covered private
                sector units and BLS were able to fully match these units and use them
                in generating SOII estimates, the reduction in duplication would
                represent approximately 15,000 hours of respondent burden. In its SOII
                paperwork burden analysis, BLS estimates the total cost of submitting
                this form for private sector establishments to be $891,000. The
                potential cost savings for avoiding duplication is 40 percent of this
                value--$356,000.
                ---------------------------------------------------------------------------
                 \20\ Source: OSHA, Office of Regulatory Analysis.
                 \21\ OSHA is reporting these estimates rounded to the nearest
                thousand in order not to suggest a spurious degree of accuracy.
                ---------------------------------------------------------------------------
                E. Benefits
                 In the PEA, OSHA preliminarily determined that the substantial
                benefits to worker privacy outweighed the uncertain forgone benefits to
                enforcement. The agency requested comment on its preliminary
                determination, including on its preliminary conclusions that neither
                worker privacy nor enforcement benefits can be meaningfully quantified.
                (83 FR at 336503).
                As discussed in detail in Section III, Summary and Explanation of
                the Final Rule, OSHA received a number of comments regarding its
                preliminary benefits determination.\22\ After carefully reviewing these
                comments, OSHA has determined that the extent of any benefits of
                collecting the data from Forms 300 and 301 for OSHA enforcement and
                compliance assistance activities is currently uncertain. OSHA has
                determined that, at this time, avoiding the risk to worker privacy of
                collecting the data from Forms 300 and 301 outweighs the uncertain
                incremental benefits to enforcement from the data. The rule will also
                allow OSHA to focus its resources on the collection and use of 300A
                data and severe injury reports, which the agency's past experience has
                proven useful.
                ---------------------------------------------------------------------------
                 \22\ The Agency discussed and responded to all public comments
                on this determination in Section III, Summary and Explanation of the
                Final Rule. (See, e.g., Concerns About the Potential Release of
                Sensitive Worker Information and Uncertain Extent of Benefits from
                Collecting the Data from Forms 300 and 301).
                ---------------------------------------------------------------------------
                F. Economic Feasibility
                 In the PEA, OSHA stated that proposed elimination of the
                requirement for establishments with 250 or more employees to submit the
                information from OSHA Forms 300 and 301 to OSHA annually would reduce
                costs and so would have no negative feasibility effects. (83 FR at
                36503). Even with the proposed EIN requirement, the proposal still
                resulted in a large overall reduction in costs. (83 FR at 36503).Thus,
                OSHA concluded that the proposed rule was economically feasible. (83 FR
                at 36503). Commenters did not submit any comments objecting to this
                determination and, due to the increase in the wage rates, the reduction
                in costs has increased since the proposal. Therefore, OSHA finds that
                the final rule is economically feasible.
                G. Regulatory Flexibility Certification
                 In the PEA, OSHA explained that the current requirement for annual
                electronic submission of information from OSHA Forms 300 and 301
                affects only a very small minority of small firms. In many industry
                sectors, there are no small firms with at least 250 employees. Even in
                those industry sectors where the definition of small firm includes some
                firms with at least 250 employees, the overwhelming majority of small
                firms have fewer than 250 employees. There will, however, be some small
                firms affected in some industries. OSHA estimated that removing this
                requirement as proposed would result in a cost savings of, on average,
                $236 per establishment for each establishment with 250 or more
                employees affected by the 2016 final rule.\23\ OSHA preliminarily
                determined that such a small amount of cost savings
                [[Page 403]]
                would not have a significant impact on a firm with 250 or more
                employees. (83 FR at 36503). Commenters did not object to these
                determinations. OSHA reaffirms its preliminary finding and also finds
                that the updated cost savings of $239 per establishment for each
                establishment with 250 or more employees affected by the 2016 final
                rule will not have a significant impact on a firm with 250 or more
                employees.\24\
                ---------------------------------------------------------------------------
                 \23\ This number was derived by dividing the total estimated
                cost savings to private industry of $8,699,173 from the proposal by
                36,903 affected establishments with 250 or more employees. (83 FR at
                36503).
                 \24\ This number is derived by dividing the total final cost
                savings to private industry of $8,831,000 by 36,903 affected
                establishments with 250 or more employees.
                ---------------------------------------------------------------------------
                 The PEA also included a certification that the proposed rule would
                not have a significant economic impact on a substantial number of small
                entities. (83 FR at 36503). OSHA did not receive any comments on this
                certification. As with the proposal, the final rule will result in an
                overall reduction of costs. Removing the requirement for establishments
                with 250 or more employees to submit the information from OSHA Forms
                300 and 301 annually to OSHA would reduce costs, and the estimated cost
                of the EIN requirement is $4.75 per establishment, a negligible amount.
                Hence, per sec. 605 of the Regulatory Flexibility Act, OSHA certifies
                that this final rule will not have a significant economic impact on a
                substantial number of small entities.
                H. Executive Order 13771: Reducing Regulation and Controlling
                Regulatory Costs
                 Consistent with Executive Order 13771 (82 FR 9339, January 30,
                2017), OSHA's preliminary economic analysis estimated the net annual
                cost savings of this rule to be $8.28 million per year at a 3 discount
                rate, and $8.25 million per year, at a discount rate of 7 percent. (83
                FR at 36501). Therefore, OSHA concluded that the proposed rule was
                expected to be a deregulatory action under the Executive Order. (83 FR
                at 36496). OSHA received several comments on this preliminary
                conclusion.
                 One commenter argued that OSHA did not demonstrate how it complied
                the Executive Order or with the Office of Management and Budget's (OMB)
                guidance to agency heads on how to comply with the Executive Order.
                (See Document ID 2033-A1, pp. 6-7 (citing OMB Memorandum M-17-21-OMB,
                Guidance Implementing Executive Order 13771, ``Reducing Regulation and
                Controlling Regulatory Costs'' (Apr. 5, 2017) (OMB Guidance on E.O.
                13771))). But that comment misunderstands the Agency's burden under the
                Executive Order and the related guidance. The guidance defines the term
                ``deregulatory action'' to mean ``an action that has been finalized and
                has total costs less than zero.'' (OMB Guidance on E.O. 13771, p. 4).
                In the proposal, OSHA estimated that this rule would have net cost
                savings of $8.28 million per year at a 3 percent discount rate,
                including $8.23 million per year for the private sector and $52,754 per
                year for the government. (See 83 FR at 36500-501, 36502-03). Annualized
                at a 7 percent discount rate, OSHA estimated that the proposed rule
                would have net cost savings of $8.25 million per year, including $8.18
                million per year for the private sector and $64,070 per year for the
                government. (See 83 FR at 36501, 36502-03). The Agency included
                detailed information about how it calculated those numbers. Because
                OSHA expected the rule to have cost savings (i.e., total costs less
                than zero), it stated that it expected the proposed rule to be
                deregulatory action under the Executive Order. (83 FR at 36596).
                Nothing more was required under the Executive Order.
                 Another commenter remarked that adding a requirement for additional
                data seemed contrary to OSHA's claim that the proposed rule is a
                deregulatory action under the Executive Order. (Document ID 2039-A1, p.
                3 (quoting 83 FR at 36496)). This comment also misinterprets the
                Executive Order's requirements. As noted above, OMB's guidance defines
                the term ``deregulatory action'' to mean ``an action that has been
                finalized and has total costs less than zero.'' (OMB Guidance on E.O.
                13771, p. 4). This definition does not consider whether part of the
                rule imposes costs, but other portions of the rule provide cost
                savings. Rather, it looks at the total costs imposed by the rule. As
                explained in the proposal, OSHA expected the total costs of the
                proposal to be well below zero. Therefore, the Agency finds that its
                preliminary expectation was correct.
                 After carefully considering the comments submitted on this issue,
                OSHA reaffirms its preliminary determination that this rule is expected
                to be a deregulatory action within the meaning of Executive Order
                13771. This finding is based on the Agency's estimate that the total
                annual cost savings from the final rule would be $8,884,000 at a 3
                percent discount rate and $8,896,000 at 7 percent discount rate.
                Further details on the estimated costs and cost savings estimates for
                this rule can be found in Section VI, Final Economic Analysis and
                Regulatory Flexibility Analysis.
                V. Unfunded Mandates
                 For purposes of the Unfunded Mandates Reform Act (2 U.S.C. 1501 et
                seq.), as well as Executive Order 13132 (64 FR 43255 (Aug. 4, 1999)),
                this final rule does not include any federal mandate that may result in
                increased expenditures by state, local, and tribal governments, or
                increased expenditures by the private sector of more than $100 million.
                Accordingly, OSHA is not required to issue a written statement
                containing a qualitative and quantitative assessment of the anticipated
                costs and benefits of the Federal mandate, as required under Section
                202(a) of the Unfunded Mandates Reform Act of 1995 (2 U.S.C. 1532(a)).
                VI. Federalism
                 The agency reviewed this rule in accordance with the Executive
                Order on Federalism 13132. (64 FR 43255). The final rule involves a
                ``regulation'' issued under sections 8 and 24 of the OSH Act (29 U.S.C.
                657, 673), and not an ``occupational safety and health standard''
                issued under section 6 of the OSH Act (29 U.S.C. 655). Therefore,
                pursuant to section 18 of the OSH Act (29 U.S.C. 667(a)), the rule does
                not preempt state law. The effect of the final rule on states is
                discussed in section VII, State-Plan States.
                VII. State-Plan States
                 Pursuant to section 18 of the OSH Act (29 U.S.C. 667) and the
                requirements of 29 CFR 1904.37 and 1902.7, within 6 months after
                publication of the final OSHA rule, state-plan states must promulgate
                occupational injury and illness recording and reporting requirements
                that are substantially identical to those in 29 CFR part 1904
                ``Recording and Reporting Occupational Injuries and Illnesses.'' All
                other injury and illness recording and reporting requirements (for
                example, industry exemptions, reporting of fatalities and
                hospitalizations, record retention, or employee involvement) that are
                promulgated by state-plan states may be more stringent than, or
                supplemental to, the federal requirements, but, because of the unique
                nature of the national recordkeeping program, states must consult with
                OSHA and obtain approval of such additional or more stringent reporting
                and recording requirements to ensure that they will not interfere with
                uniform reporting objectives (29 CFR 1904.37(b)(2); 29 CFR 1902.7(a)).
                 There are 28 state plan states and territories. The states and
                territories that cover private sector employers are Alaska, Arizona,
                California, Hawaii, Indiana, Iowa, Kentucky, Maryland,
                [[Page 404]]
                Michigan, Minnesota, Nevada, New Mexico, North Carolina, Oregon, Puerto
                Rico, South Carolina, Tennessee, Utah, Vermont, Virginia, Washington,
                and Wyoming. Connecticut, Illinois, Maine, New Jersey, New York, and
                the Virgin Islands have OSHA-approved state plans that apply to state
                and local government employees only.
                VIII. Environmental Impact Assessment
                 OSHA has reviewed the provisions of this final rule in accordance
                with the requirements of the National Environmental Policy Act (NEPA)
                of 1969 (42 U.S.C. 4321 et seq.), the Council on Environmental Quality
                (CEQ) NEPA regulations (40 CFR parts 1500-1508), and the Department of
                Labor's NEPA Procedures (29 CFR part 11). As a result of this review,
                OSHA has determined that the final rule will have no significant
                adverse effect on air, water, or soil quality, plant or animal life,
                use of land, or other aspects of the environment.
                IX. Paperwork Reduction Act
                Overview
                 This final rule revises an existing collection of information that
                is subject to review by OMB under the Paperwork Reduction Act of 1995
                (PRA) (44 U.S.C. 3501 et. seq.) and its implementing regulations (5 CFR
                part 1320). The PRA generally requires that agencies consider the
                impact of paperwork and other information collection burdens imposed on
                the public, obtain public input, and obtain approval from OMB before
                conducting any collection of information (44 U.S.C. 3507). The PRA
                defines a ``collection of information'' as ``the obtaining, causing to
                be obtained, soliciting, or requiring the disclosure to third parties
                or the public, of facts or opinions by or for an agency, regardless of
                form or format[.]'' (44 U.S.C. 3502(3)(A)). Federal agencies generally
                cannot conduct or sponsor a collection of information, and the public
                is generally not required to respond to an information collection,
                unless it is approved by OMB under the PRA and displays a currently-
                valid OMB Control Number. In addition, notwithstanding any other
                provisions of law, no person shall be subject to penalty for failing to
                comply with a collection of information if the collection of
                information does not display a valid OMB Control Number. (See 44 U.S.C.
                3512).
                Solicitation of Comments
                 OSHA published a Federal Register notice that allowed the public an
                opportunity to comment on the proposed Information Collection Request
                (ICR) containing the information collection requirements in the
                proposed rule for 60 days, as required by 44 U.S.C. 3507. Specifically,
                in the NPRM, OSHA explained how the proposed rule would affect its ICR
                estimates and asked members of the public to submit comments on the
                paperwork requirements. (83 FR at 36504-05). Concurrent with the
                proposed rule, OSHA submitted the ICR to OMB for review (ICR Reference
                Number 201807-1218-002) in accordance with 44 U.S.C. 3507(d).
                 In addition to generally soliciting comments on the paperwork
                requirements, the proposed rule indicated that OSHA and OMB were
                particularly interested in comments that:
                 Evaluate whether the proposed collection of information is
                necessary for the proper performance of the functions of the agency,
                including whether the information will have practical utility;
                 Evaluate the accuracy of the agency's estimate of the
                burden of the proposed collection of information, including the
                validity of the methodology and assumptions used;
                 Enhance the quality, utility, and clarity of the
                information to be collected; and
                 Minimize the burden of the collection of information on
                those who are to respond, including through the use of appropriate
                automated, electronic, mechanical, or other technological collection
                techniques or other forms of information technology, e.g., permitting
                electronic submission of responses.
                (83 FR at 36505).
                 OMB concluded its review by filing a comment requesting OSHA to
                resubmit the request at the Final Rule stage, after considering any
                public comments and clarifying how the information collection
                requirements in final rule were changed because of the comments. OSHA
                received a number of comments in response to the proposed rule that
                addressed information collection requirements and contained information
                relevant to the burden hour and costs analysis in the ICR. Summaries of
                these comments and OSHA's responses are found above in Sections III,
                Summary and Explanation of the Final Rule, and IV, Final Economic
                Analysis and Regulatory Flexibility Certification, and in the final
                ICR. OSHA considered these comments when it developed the revised ICR
                associated with the final rule.
                 Concurrent with publication of this final rule, the Department of
                Labor has submitted the final ICR, containing the full analysis and
                description of the burden hours and costs associated with the final
                rule, to OMB for approval. A copy of this ICR will be available on the
                internet at http://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=201811-1218-004 on the day following publication of the final rule. At the
                conclusion of OMB's review, OSHA will publish a separate notice in the
                Federal Register to announce the results. That notice will also include
                a list of OMB-approved information collection requirements and total
                burden hours and costs imposed by the new standard.
                Summary of Information Collection Requirements
                 OSHA's existing recordkeeping forms consist of the OSHA 300 Log,
                the 300A Summary, and the 301 Incident Report. These forms are
                contained in the ICR titled Recording and Reporting Occupational
                Injuries and Illnesses (29 CFR part 1904), which OMB approved under OMB
                Control Number 1218-0176 (expiration date 06/30/2021).
                 This final rule affects the ICR estimates as follows:
                 1. Establishments that are subject to the part 1904 requirements
                and have 250 or more employees will no longer be required to
                electronically submit information recorded on their OSHA Forms 300 and
                301 to OSHA once a year.
                 2. Establishments subject to the data collection must provide one
                additional data element, the EIN.
                 The burden hours for the reporting requirements under Sec. 1904.41
                are estimated to be 140,545 per year, which is a reduction of 112,694
                burden hours from what was estimated for the previous reporting
                requirements. There are no capital costs for this collection of
                information.
                 More specifically, this action amends the recordkeeping regulation
                to remove the requirement for establishments that are required to keep
                injury and illness records under part 1904, and that had 250 or more
                employees in the previous year, to electronically submit to OSHA or
                OSHA's designee case characteristic information from the OSHA Form 300
                (Log of Work-Related Injuries and Illnesses) and OSHA Form 301 (Injury
                and Illness Incident Report) once a year. Under the final rule, these
                establishments are only required to submit summary information from the
                OSHA Form 300A. There are approximately 37,000 establishments that are
                no longer subject to a requirement to submit the information on OSHA
                Forms 300 and 301 for
                [[Page 405]]
                approximately 775,000 injury and illness cases under the rule. (OSHA
                used BLS's 2015 Survey of Occupational Injuries and Illnesses (SOII)
                data (https://www.bls.gov/iif/oshwc/osh/os/ostb4734.pdf) to estimate
                that, without the final rule, covered establishments with 250 or more
                employees would report 775,210 injury and illness cases per year.)
                 In addition, under the final rule, 463,192 establishments are now
                required to provide their EINs to OSHA.
                 The OSHA recordkeeping and reporting information collection may be
                summarized as follows. (Note these estimates are for the full burden of
                the recordkeeping and reporting information collection, including
                aspects that are unchanged by this rulemaking).
                 Agency: DOL-OSHA.
                 Title of Collection: Recording and Reporting Occupational Injuries
                and Illnesses (29 CFR part 1904).
                 OMB control number: 1218-0176.
                 Number of respondents: 1,002,912.
                 Number of annual responses: 5,903,976.
                 Total estimated annual burden time: 2,140,856 hours.
                 Total estimated annual other costs burden (start-up, capital,
                operation, and maintenance): $0.
                X. Consultation and Coordination With Indian Tribal Governments
                 OSHA reviewed this final rule in accordance with Executive Order
                13175 (65 FR 67249 (Nov. 9, 2000)) and determined that it does not have
                ``tribal implications'' as defined in that order. This final rule does
                not have substantial direct effects on one or more Indian tribes, on
                the relationship between the Federal Government and Indian tribes, or
                on the distribution of power and responsibilities between the Federal
                Government and Indian tribes.
                List of Subjects in 29 CFR Part 1904
                 Health statistics, Occupational safety and health, Reporting and
                recordkeeping requirements, State plans.
                 Signed at Washington, DC, on January 17, 2019.
                Loren E. Sweatt,
                Deputy Assistant Secretary of Labor for Occupational Safety and Health.
                Final Rule
                Amendments to Regulations
                 For the reasons stated in the preamble, OSHA amends part 1904 of
                chapter XVII of title 29 as follows:
                PART 1904--[AMENDED]
                Subpart E--Reporting Fatality, Injury and Illness Information to
                the Government
                0
                1. The authority citation for subpart E of 29 CFR part 1904 continues
                to read as follows:
                 Authority: 29 U.S.C. 657, 673, 5 U.S.C. 553, and Secretary of
                Labor's Order No. 1-2012 (77 FR 3912, Jan. 25, 2012).
                0
                2. In Sec. 1904.41, revise the section heading and paragraph (a)(1),
                add paragraph (a)(4), and revise paragraph (b) to read as follows:
                Sec. 1904.41 Electronic submission of Employer Identification Number
                (EIN) and injury and illness records to OSHA.
                 (a) * * *
                 (1) Annual electronic submission of OSHA Form 300A Summary of Work-
                Related Injuries and Illnesses by establishments with 250 or more
                employees. If your establishment had 250 or more employees at any time
                during the previous calendar year, and this part requires your
                establishment to keep records, then you must electronically submit
                information from OSHA Form 300A Summary of Work-Related Injuries and
                Illnesses to OSHA or OSHA's designee. You must submit the information
                once a year, no later than the date listed in paragraph (c) of this
                section of the year after the calendar year covered by the form (for
                example, 2019 for the 2018 form).
                * * * * *
                 (4) Electronic submission of the Employer Identification Number
                (EIN). For each establishment that is subject to these reporting
                requirements, you must provide the EIN used by the establishment.
                 (b) Implementation--(1) Does every employer have to routinely
                submit this information to OSHA? No, only two categories of employers
                must routinely submit this information. First, if your establishment
                had 250 or more employees at any time during the previous calendar
                year, and this part requires your establishment to keep records, then
                you must submit the required information to OSHA once a year. Second,
                if your establishment had 20 or more employees but fewer than 250
                employees at any time during the previous calendar year, and your
                establishment is classified in an industry listed in appendix A to this
                subpart, then you must submit the required information to OSHA once a
                year. Employers in these two categories must submit the required
                information by the date listed in paragraph (c) of this section of the
                year after the calendar year covered by the form (for example, 2019 for
                the 2018 form). If you are not in either of these two categories, then
                you must submit the information to OSHA only if OSHA notifies you to do
                so for an individual data collection.
                 (2) Do part-time, seasonal, or temporary workers count as employees
                in the criteria for number of employees in paragraph (a) of this
                section? Yes, each individual employed in the establishment at any time
                during the calendar year counts as one employee, including full-time,
                part-time, seasonal, and temporary workers.
                 (3) How will OSHA notify me that I must submit information as part
                of an individual data collection under paragraph (a)(3) of this
                section? OSHA will notify you by mail if you will have to submit
                information as part of an individual data collection under paragraph
                (a)(3). OSHA will also announce individual data collections through
                publication in the Federal Register and the OSHA newsletter, and
                announcements on the OSHA website. If you are an employer who must
                routinely submit the information, then OSHA will not notify you about
                your routine submittal.
                 (4) When do I have to submit the information? If you are required
                to submit information under paragraph (a)(1) or (2) of this section,
                then you must submit the information once a year, by the date listed in
                paragraph (c) of this section of the year after the calendar year
                covered by the form (for example, 2019 for the 2018 form). If you are
                submitting information because OSHA notified you to submit information
                as part of an individual data collection under paragraph (a)(3) of this
                section, then you must submit the information as specified in the
                notification.
                 (5) How do I submit the information? You must submit the
                information electronically. OSHA will provide a secure website for the
                electronic submission of information. For individual data collections
                under paragraph (a)(3) of this section, OSHA will include the website's
                location in the notification for the data collection.
                 (6) Do I have to submit information if my establishment is
                partially exempt from keeping OSHA injury and illness records? If you
                are partially exempt from keeping injury and illness records under
                Sec. Sec. 1904.1 and/or 1904.2, then you do not have to routinely
                submit information under paragraphs (a)(1) and (2) of this section. You
                will have to submit information under paragraph (a)(3) of this section
                if OSHA informs you in writing that it will collect injury and illness
                information from you. If you
                [[Page 406]]
                receive such a notification, then you must keep the injury and illness
                records required by this part and submit information as directed.
                 (7) Do I have to submit information if I am located in a State Plan
                State? Yes, the requirements apply to employers located in State Plan
                States.
                 (8) May an enterprise or corporate office electronically submit
                information for its establishment(s)? Yes, if your enterprise or
                corporate office had ownership of or control over one or more
                establishments required to submit information under paragraph (a) of
                this section, then the enterprise or corporate office may collect and
                electronically submit the information for the establishment(s).
                * * * * *
                [FR Doc. 2019-00101 Filed 1-24-19; 8:45 am]
                 BILLING CODE 4510-26-P
                

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT