Will the public want your records?

OSHA announced in the July 3, 2001, Federal Register that its final recordkeeping rule should be implemented "in large part" as scheduled on January 1, 2002. Issues on hearing loss and musculoskeletal disorders now appear to be the only delays.

So the green light has been given for you to begin training and preparing for the final rule. And don't overlook your plans for addressing the interests of other parties, including the public, which may access your employee injury and illness records.

Are you ready?

Consider this scenario: A person (who can be anyone) walks into your human resources department and produces a written document stating that they are the "personal representative" of a former employee. This person then requests one free entire copy (including employee names) of all current and stored 300 (or 200) Logs for your establishment by the end of the next business day. Your visitor says he intends to electronically scan the records, comment on them, and place the information on an Internet site for the entire world to view.

What do you do?

For the most part, you better comply with the request. Section 1904.35 (employee involvement) of the final recordkeeping rule provides access to the entire OSHA 300 Log to any employee, former employee, or employee representative who requests a copy. You must provide one free copy of the current OSHA 300 Log, and any stored OSHA 300 (or 200) Logs, by the end of the next business day following the request. The Log must include employee names except for a limited number of "privacy cases."

Any employee, former employee or personal representative is also entitled to one free copy of the "information about the case" portion of the OSHA 301 Incident Report describing an injury or illness to that employee.

According to OSHA, you may not require an employee, former employee or employee representative to agree to limit the use of the records as a condition for viewing or obtaining copies.

Balancing act

In permitting access to injury and illness records, OSHA applied a "balancing test" that weighs an individual's interest in confidentiality against the public interest in disclosure. OSHA considered the public interest that is served when information contained in the records is used to promote safety and health balanced against the possible harm that may result from the misuse of private information.

OSHA concluded that "while the possibility exists that employees and their representatives with access to the records could disclose the information to the general public, OSHA does not believe that this risk is sufficient to justify restrictions on the use of the records ? OSHA reached this conclusion because it has "not noted any significant problems of this type in the past."

OSHA doesn't see a significant risk, but you should. About once each week I find a new Web site that uses business environmental health and safety data in various ways. And the only limitation on how the data may be used or misused is a person's imagination.

To limit misuse...

What can you do to limit public viewing or misuse of your company's employee injury and illness records?

• Alert your senior management to the risk of public involvement. Get their comments and recommendations. This should be easier now that the final rule requires a company executive to certify the 300 Log.

• Get input from your company's legal counsel. OSHA does not limit what people do with the records they access, but there may be other legal protections to help minimize misuse of the records.

Your legal counsel may feel it is appropriate for people accessing the records to sign a release form. The release form may include information such as the requester's identification numbers (social security, driver's license, etc.); address; phone number; and, intended use of the records. The release form could even include language that encourages the parties to treat the records as confidential. The language would be in addition to the confidentiality notice on the 300 Log and Incident Report forms.

• Instruct employees who will make entries on the 300 and 301 forms about which words to use and avoid. Particularly on the 301 form, avoid subjective words - such as "careless," "intentional," "reckless," "dirty," "messy," "dark," or "smelly" - when providing information about a case. Use only objective words in short sentences.

• Carefully consider what is written. Be accurate. Would the words, "An employee slipped on an oily floor," accurately describe how an injury occurred? The words give the impression that the entire floor was oily. If this is not the case, it may be better to write, "An employee slipped on oil that was on the floor near machine X."

• Focus on programs that prevent OSHA recordable injuries and illnesses. This is the best advice for limiting misuse of records. If there are few entries on your 300 Log, then there should be few concerns that the records will be accessed and misused.

We live in the Information Age. Just about anything that is recorded may become available to the public. Data on the OSHA 300 Log and 301 Incident Report are just another example of this possibility. How the information will be used or misused when it becomes available to the public remains to be seen. Given this unknown, you should exercise utmost care when generating and managing your information.