Tracking of Workplace Injuries and Illnesses

AGENCY:

Occupational Safety and Health Administration (OSHA), Labor.

ACTION:

Final rule.

SUMMARY:

To protect worker privacy, the Occupational Safety and Health Administration (OSHA) is amending the recordkeeping regulation by rescinding the requirement for establishments with 250 or more employees to electronically submit information from OSHA Forms 300 and 301. These establishments will continue to be required to maintain those records on-site, and OSHA will continue to obtain them as needed through inspections and enforcement actions. In addition to reporting required after severe injuries, establishments will continue to submit information from their Form 300A. Such submissions provide OSHA with ample data that it will continue seeking to fully utilize. In addition, OSHA is amending the recordkeeping regulation to require covered employers to submit their Employer Identification Number (EIN) electronically along with their injury and illness data submission, which will facilitate use of the data and may help reduce duplicative employer reporting. Nothing in the final rule revokes an employer's duty to maintain OSHA Forms 300 and 301 for OSHA inspection. These actions together will allow OSHA to improve enforcement targeting and compliance assistance, decrease burden on employers, and protect worker privacy and safety.

DATES:

This final rule becomes effective on February 25, 2019.

Collections of information: There are collections of information contained in this final rule. (See Section XI, Paperwork Reduction Act). Notwithstanding the general date of applicability that applies to all other requirements contained in the final rule, affected parties do not have to comply with the collections of information until the Department of Labor publishes a separate document in the Federal Register announcing that the Office of Management and Budget has approved them under the Paperwork Reduction Act.

ADDRESSES:

In accordance with 28 U.S.C. 2112(a)(2), OSHA designates Edmund Baird, Acting Associate Solicitor of Labor for Occupational Safety and Health, Office of the Solicitor, Room S-4004, U.S. Department of Labor, 200 Constitution Avenue NW, Washington, DC 20210, to receive petitions for review of the final rule.

FOR FURTHER INFORMATION CONTACT:

For press inquiries: Frank Meilinger, OSHA Office of Communications, telephone: (202) 693-1999; email: meilinger.francis2@dol.gov.

For general and technical information: Amanda Edens, Director, Directorate of Technical Support and Emergency Management, telephone: (202) 693-2300; email: edens.mandy@dol.gov.

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Background

A. Introduction

B. Regulatory History

II. Legal Authority

III. Summary and Explanation of the Final Rule

A. Rescission of Requirement for Certain Establishments To Submit Data From OSHA Forms 300 and 301 to OSHA Electronically

B. New Requirement To Include Employer Identification Number With Injury and Illness Data Submitted to OSHA Electronically Under 29 CFR 1904.41

IV. Final Economic Analysis and Regulatory Flexibility Analysis

A. Introduction

B. Cost Savings

C. New Costs (From the EIN Collection)

D. Net Cost Savings

E. Benefits

F. Economic Feasibility

G. Regulatory Flexibility Certification

H. Executive Order 13771: Reducing Regulation and Controlling Regulatory Costs

V. Unfunded Mandates

VI. Federalism

VII. State-Plan States

VIII. Environmental Impact Assessment

IX. Paperwork Reduction Act

X. Consultation and Coordination With Indian Tribal Governments

Citation Method

In the docket for this rulemaking found at http://www.regulations.gov,, every submission was assigned a document identification (ID) number that consists of the docket number (OSHA-2013-0023) followed by an additional four-digit number. For example, the document ID number for the proposed rule is OSHA-2013-0023-1922. Some document ID numbers include one or more attachments, such as one of the submissions by the National Institute for Occupational Safety and Health (NIOSH). (See Document ID OSHA-2013-0023-2003).

When citing exhibits in the docket in this preamble, OSHA includes the term “Document ID” followed by the last four digits of the document number; the attachment number or other attachment identifier, if applicable (designated as “A,” followed by the number of the attachment); page numbers, if applicable; and, in a limited number of cases, a footnote number (designated as “Fn”). In a citation that contains two or more document ID numbers, the document ID numbers are separated by semi-colons. For example, a citation referring to an attachment to the National Association of Home Builders' comments and the second attachment to the United Steelworkers' comments would be indicated as follows: (Document ID 2044-A1, pp. X-X; 2086-A2, p. X).

The exhibits in the docket, including public comments, supporting materials, meeting transcripts, and other documents, are listed on http://www.regulations.gov. All exhibits are listed in the docket index on http://www.regulations.gov,, but some exhibits (e.g., copyrighted material) are not available to read or download from that website. All materials in the docket are available for inspection at the OSHA Docket Office, Room N-3508, U.S. Department of Labor, 200 Constitution Avenue NW, Washington, DC 20210; telephone (202) 693-2350.

I. Background

A. Introduction

OSHA's regulation at 29 CFR part 1904 requires employers with more than 10 employees in most industries to keep records of occupational injuries and illnesses at their establishments. Employers covered by these rules must record each recordable employee injury and illness on an OSHA Form 300, which is the “Log of Work-Related Injuries and Illnesses,” or equivalent. Employers must also prepare a supplementary OSHA Form 301 “Injury and Illness Incident Report” or equivalent that provides additional details about each case recorded on the OSHA Form 300. At the end of each year, employers are required to prepare a summary report of all injuries and illnesses on the OSHA Form 300A, which is the “Summary of Work-Related Injuries and Illnesses,” and post the form in a visible location in the workplace.

The recordkeeping regulation also requires establishments with 250 or more employees that are currently required to keep OSHA injury and illness records to electronically submit information from the OSHA Forms 300, 300A, and 301 to OSHA annually. Establishments with 20-249 employees in certain designated industries are required to electronically submit information only from the OSHA Form 300A—the summary form. To protect worker privacy, this final rule eliminates the requirement that establishments with 250 or more employees that are currently required to keep OSHA injury and illness records submit information electronically from their OSHA Forms 300 and 301. These establishments, as well as establishments with 20 or more employees, but fewer than 250 employees, in certain designated industries, must continue to submit information electronically from their part 1904 annual summary (Form 300A) to OSHA or OSHA's designee on an annual basis. The final rule also requires all establishments that must submit information electronically from their part 1904 annual summary (Form 300A) to submit their Employer Identification Number (EIN).

Elimination of the requirement that establishments with 250 or more employees submit information electronically from their OSHA Forms 300 and 301—a requirement that has not yet been enforced—does not change any employer's obligation to complete and retain injury and illness records under OSHA's regulations for recording and reporting occupational injuries and illnesses. The final rule also does not add to or change the recording criteria or definitions for these records.

OSHA's collection and use of the summary data from form 300A, and information concerning severe injuries it also receives, give OSHA the information it needs to identify and target for potential enforcement actions those establishments with high rates of work-related injuries and illnesses. For example, OSHA has collected summary 300A data for 2016 from 214,574 establishments, and expects to collect a greater volume of 2017 summary data. With the data, OSHA has already designed a targeted enforcement mechanism for industries experiencing higher rates of injuries and illnesses. OSHA plans to further refine its approach as it seeks to fully utilize these data from form 300A, and it will likewise continue to use information received from severe injury reports.

In light of this backdrop, OSHA has determined that the rule will benefit worker privacy by preventing routine government collection of information that may be quite sensitive, including descriptions of workers' injuries and the body parts affected, and thereby avoiding the risk that such information might be publicly disclosed under the Freedom of Information Act (FOIA) or through the Injury Tracking Application. OSHA has also concluded that the extent of any incremental benefits of collecting the data from Forms 300 and 301 for OSHA enforcement and compliance assistance activities is uncertain. OSHA has determined that avoiding this risk to worker privacy outweighs the data's uncertain incremental benefits to enforcement. The rule will allow OSHA to focus agency resources on the collection and use of 300A data described above, and severe injury reports, as well as data from other initiatives that its past experience has proven useful—instead of diverting those resources toward developing a Web portal for, and then collecting, manually reviewing, and analyzing data from Forms 300 and 301.

This rule is a deregulatory action under Executive Order 13771 (82 FR 9339 (January 30, 2017)). It has annualized net cost savings estimated at $16 million. The savings from elimination of the requirement that establishments with 250 or more employees submit information electronically from their OSHA Forms 300 and 301 will be $8.9 million per year. New costs not included in the 2016 final rule are estimates of cost savings to the government from avoiding a manual review of all data from Forms 300 and 301 to identify and remove PII and other information that could be re-identified with individuals. This cost will be $7.5 million per year. The total cost of providing EINs will be $2.2 million the first year these data are submitted, and will be $223,000 per year every year after that. A detailed discussion of OSHA's estimates of the rule's benefits, costs, and cost savings is included in section IV, Final Economic Analysis and Regulatory Flexibility Certification.

B. Regulatory History

OSHA's regulations on recording and reporting occupational injuries and illnesses (29 CFR part 1904) were first issued in 1971 (36 FR 12612 (July 2, 1971)). These regulations require the recording of work-related injuries and illnesses that involve death, loss of consciousness, days away from work, restriction of work, transfer to another job, medical treatment other than first aid, or diagnosis of a significant injury or illness by a physician or other licensed health care professional. (29 CFR 1904.7).

On July 29, 1977, OSHA amended these regulations to partially exempt businesses having ten or fewer employees during the previous calendar year from the requirement to record occupational injuries and illnesses. (42 FR 38568). Then, on December 28, 1982, OSHA amended the regulations again to partially exempt establishments in certain lower-hazard industries from the requirement to record occupational injuries and illnesses. (47 FR 57699). OSHA also amended the recordkeeping regulations in 1994 (Reporting of Fatality or Multiple Hospitalization Incidents, 59 FR 15594) and 1997 (Reporting Occupational Injury and Illness Data to OSHA, 62 FR 6434). Under the version of § 1904.41 added by the 1997 final rule, OSHA began requiring certain employers to submit their 300A data to OSHA annually through the OSHA Data Initiative (ODI). Through the ODI, OSHA collected data on injuries and acute illnesses attributable to work-related activities in the private sector from approximately 80,000 establishments in selected high-hazard industries. The agency used these data to calculate establishment-specific injury and illness rates, and in combination with other data sources, to target enforcement and compliance assistance activities.

On January 19, 2001, OSHA issued a final rule amending its requirements for the recording and reporting of occupational injuries and illnesses (29 CFR parts 1904 and 1952), along with the forms employers use to record those injuries and illnesses. (66 FR 5916). The final rule also updated the list of industries that are partially exempt from recording occupational injuries and illnesses.

On September 18, 2014, OSHA again amended the regulations to require employers to report work-related fatalities and severe injuries—in-patient hospitalizations, amputations, and losses of an eye—to OSHA and to allow electronic reporting of these events. (79 FR 56130). The final rule also revised the list of industries that are partially exempt from recording occupational injuries and illnesses.

On May 12, 2016, OSHA amended the regulations on recording and reporting occupational injuries and illnesses to require employers, on an annual basis, to submit electronically to OSHA injury and illness information that employers are already required to keep under part 1904. (81 FR 29624). Under the 2016 revisions, establishments with 250 or more employees that are routinely required to keep records are also required to electronically submit information from their OSHA Forms 300, 300A, and 301 to OSHA or OSHA's designee once a year, and establishments with 20 to 249 employees in certain designated industries are required to electronically submit information from their OSHA annual summary (Form 300A) to OSHA or OSHA's designee once a year. In addition, that final rule required employers, upon notification, to electronically submit information from part 1904 recordkeeping forms to OSHA or OSHA's designee. These provisions became effective on January 1, 2017, with an initial submission deadline of July 1, 2017, for 2016 Form 300A data described in 29 CFR 1904.41(c)(1). That submission deadline was subsequently extended to December 15, 2017. (82 FR 55761). The deadline for electronic submission of information from OSHA Forms 300 and 301 was July 1, 2018. OSHA announced that it would not enforce this requirement without notice during this rulemaking, (83 FR at 36496), and OSHA has never received the data submissions from Forms 300 and 301 that the 2016 rule anticipated.

On July 30, 2018, OSHA issued a notice of proposed rulemaking (NPRM or proposed rule) proposing to amend its recordkeeping regulations to remove the requirement for establishments with 250 or more employees that are routinely required to keep records to electronically submit information from their OSHA Forms 300 and 301 to OSHA or OSHA's designee once a year and to add a requirement for electronic submission of the EIN. (83 FR 36494). OSHA received 1,880 comments on the proposed rule. The issues raised in those comments are addressed herein.

II. Legal Authority

OSHA is issuing this final rule pursuant to authority expressly granted by sections 8 and 24 of the Occupational Safety and Health Act (the “OSH Act” or “Act”). (29 U.S.C. 657, 673). Section 8(c)(1) of the Act requires each employer to “make, keep and preserve, and make available to the Secretary [of Labor] or the Secretary of Health and Human Services, such records regarding his activities relating to this chapter as the Secretary [of Labor] . . . may prescribe by regulation as necessary or appropriate for the enforcement of this chapter or for developing information regarding the causes and prevention of occupational accidents and illnesses.” (29 U.S.C. 657(c)(1)). Section 8(c)(2) directs the Secretary to prescribe regulations “requiring employers to maintain accurate records of, and to make periodic reports on, work-related deaths, injuries and illnesses other than minor injuries requiring only first aid treatment and which do not involve medical treatment, loss of consciousness, restriction of work or motion, or transfer to another job.” (29 U.S.C. 657(c)(2)). Finally, section 8(g)(2) of the OSH Act broadly empowers the Secretary to “prescribe such rules and regulations as he may deem necessary to carry out [his] responsibilities under this chapter.” (29 U.S.C. 657(g)(2)).

Section 24 of the OSH Act (29 U.S.C. 673) contains a similar grant of authority. This section requires the Secretary to “develop and maintain an effective program of collection, compilation, and analysis of occupational safety and health statistics” and “compile accurate statistics on work injuries and illnesses which shall include all disabling, serious, or significant injuries and illnesses.” (29 U.S.C. 673(a)). Section 24 also requires employers to “file such reports with the Secretary as he shall prescribe by regulation.” (29 U.S.C. 673(e)). These reports are to be based on “the records made and kept pursuant to” section 8(c) of the OSH Act. (29 U.S.C. 673(e)).

The OSH Act requires cooperation with the Secretary of Health and Human Services concerning regulations that address reporting and recordkeeping, and consultation concerning the development and maintenance of a program for occupational safety and health statistics. OSHA has a lengthy history of cooperation and consultation with the Department of Health and Human Services in this regard, particularly with its sub-agency, the National Institute for Occupational Safety and Health. With respect to this rule, OSHA informally received feedback from NIOSH on its proposal, including reviewing a draft of NIOSH's comment, and provided NIOSH, and HHS more generally, with opportunities to provide comment on both the proposed and this final rule before publication.

Further support for the Secretary's authority to require employers to keep and submit records of work-related illnesses and injuries is in the Congressional Findings and Purpose at the beginning of the OSH Act. (See 29 U.S.C. 651). In that section, Congress declares the overarching purpose of the Act is “to assure so far as possible every working man and woman in the Nation safe and healthful working conditions.” (29 U.S.C. 651(b)). One of the ways in which the Act is meant to achieve this goal is “by providing for appropriate reporting procedures . . . [that] will help achieve the objectives of this chapter and accurately describe the nature of the occupational safety and health problem.” (29 U.S.C. 651(b)(12)). Notably, the statute does not require this information to be transmitted to OSHA. And, section 8(d) of the Act provides that any information the Secretary collects under the Act “shall be obtained with a minimum burden upon employers.” (29 U.S.C. 657(d)).

The OSH Act authorizes the Secretary of Labor to issue two types of occupational safety and health rules: Standards and regulations. Standards aim to correct particular identified workplace hazards, while regulations further the general enforcement and detection purposes of the OSH Act. (See Workplace Health & Safety Council v. Reich, 56 F.3d 1465, 1468 (D.C. Cir. 1995) (citing La. Chem. Ass'n v. Bingham, 657 F.2d 777, 781-82 (5th Cir. 1981)); United Steelworkers of Am. v. Auchter, 763 F.2d 728, 735 (3d Cir. 1985)). Recordkeeping requirements promulgated under the Act are characterized as regulations. (See 29 U.S.C. 657 (using the term “regulations” to describe recordkeeping requirements)). An agency may revise a prior rule if it provides a reasoned explanation for the change. (See Motor Vehicle Mfrs. Ass'n v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 42 (1983)).

When promulgating regulations pursuant to sections 8 and 24 of the OSH Act, OSHA must comply with the Administrative Procedure Act (APA) (5 U.S.C. 553), which requires the agency to publish notice of a proposed rule in the Federal Register and to provide an opportunity for interested persons to comment on the rulemaking. In the NPRM, OSHA invited comment on “all aspects of the proposed rule” (83 FR at 36505), and specifically encouraged comment on four questions regarding: (1) The risks and benefits of electronically collecting the information; (2) other agencies or organizations that use automated coding systems for text data in data collections; (3) other agencies or organizations that use automated de-identification systems to remove personal identifying information (PII) from text data before making the data available to the public; and (4) privacy issues regarding the submission of EINs. (83 FR at 36500).

OSHA received 1,880 comments on the proposed rule. Pursuant to the APA, 5 U.S.C. 553, OSHA has reviewed these comments and responded to the material issues commenters raised. (See Genuine Parts Co. v. Envtl. Prot. Agency, 890 F.3d 304, 313 (D.C. Cir. 2018) (although an agency “is not required to discuss every item of fact or opinion included in the submissions it receives in response to a Notice of Proposed Rulemaking, it must respond to those comments which, if true, would require a change in the proposed rule.”) (quoting La. Fed. Land Bank Ass'n v. Farm Credit Admin., 336 F.3d 1075, 1080 (D.C. Cir. 2003))).

Some commenters raised issues such as the requirement for certain employers to submit their 300A data to OSHA (e.g., Document ID 2057-A1, pp. 2-3; 2053, p. 3) and the employee protection provisions added by the 2016 final rule (e.g., Document ID 2006-A1, p. 4; 2009-A1, p. 4; 2023-A1). These comments were beyond the scope of this rulemaking, and this final rule does not make any changes to the relevant provisions. Nevertheless, OSHA acknowledges and shares some of the concerns these comments suggest. First, in relation to concerns raised about possible publication of data submitted electronically to OSHA from Form 300A—and as identified in the NPRM and later in this final rule—the agency takes the position that these data are exempt from public disclosure under FOIA. It should likewise be noted that OSHA uses and will continue to use 300A data to prioritize its inspections and enforcement actions. Among other considerations, disclosure of 300A data through FOIA may jeopardize OSHA's enforcement efforts by enabling employers to identify industry trends and anticipate the inspection of their particular workplaces. As OSHA has explained elsewhere, OSHA is strongly opposed to disclosure of 300A data, has not made such data public, and does not intend to make any such data public for at least the approximately four years after its receipt that OSHA intends to use the data for enforcement purposes.

In response to concerns about the application of the 2016 final rule to employee drug testing and incident-based incentive programs, OSHA notes that the employee protection provisions promulgated by that final rule and codified at 29 CFR 1904.35 neither ban drug testing employees involved in workplace injury or illnesses, nor prohibit incident-based incentive programs. Rather, § 1904.35(b)(1)(iv) merely prohibits employers from implementing these programs to penalize workers “for reporting a work-related injury or illness.” Id. (emphasis added). On October 11, 2018, OSHA issued a memorandum that explained this regulatory text and OSHA's position on workplace incentive programs and post-incident drug testing. See U.S. Dep't of Labor, Clarification of OSHA's Position on Workplace Safety Incentive Programs and Post-Incident Drug Testing Under 29 CFR § 1904.35(b)(1)(iv) (Oct. 11, 2018). That memorandum—which referred to the 2016 final rule and its preamble—reiterated the rule's limited scope and expressed how it “does not prohibit workplace safety incentive programs or post-incident drug testing.” Id. To the extent the 2016 preamble suggested otherwise, it has been superseded. While not the focus of this particular rulemaking, that memorandum accurately reflects OSHA's position and addresses the commenters' concerns.

III. Summary and Explanation of Final Rule

A. Rescission of Requirement for Certain Establishments To Submit Data From OSHA Forms 300 and 301 to OSHA Electronically

As discussed in detail below, OSHA has determined that collecting the data from Forms 300 and 301, as was recently required under the 2016 final rule, would subject sensitive worker information to a meaningful risk of public disclosure. OSHA has also concluded that the extent of the incremental benefits of collecting the data for OSHA's enforcement targeting and compliance assistance activities remains uncertain. Finally, OSHA has found that collecting the data and analyzing them for use would require OSHA to divert significant resources from agency priorities such as fully utilizing the 300A data and severe injury reports OSHA already collects electronically and that have proven useful in its experience for targeting areas of concern.

After considering all of the comments in the record and balancing the risk to worker privacy against the uncertain extent of the benefits of collecting the data and OSHA's resource priorities, OSHA has determined that the final rule is necessary to preserve sensitive worker information and conserve agency resources for initiatives with more concrete benefits to OSHA's mission of assuring safe and healthful workplaces.

Concerns About the Potential Release of Sensitive Worker Information

A central reason OSHA proposed rescinding the requirement for certain employers to electronically submit information from Forms 300 and 301 to OSHA was “to protect sensitive worker information from potential disclosure under the Freedom of Information Act (FOIA).” (83 FR at 36494). As explained in greater detail below, although OSHA believes data from Forms 300 and 301 would be exempt from disclosure under FOIA exemptions, OSHA is concerned that it still could be required by a court to release the data. Many commenters echoed this concern.

OSHA's position in this final rule is consistent with the principles articulated in the Privacy Act, OMB Circular A-130, and the Department's position on the sensitive nature of worker injury and illness records before 2016. (See Document ID 1930-A1, pp. 2-3; 66 FR 5916, 6055-57 (Jan. 19, 2001)). In 2001, for example, OSHA noted that it “historically has recognized that the Log and Incident Report (Forms 300 and 301, respectively) may contain information of a sufficiently intimate and personal nature that a reasonable person would wish it to remain confidential.” (66 FR at 6055). OSHA further explained that access to Forms 300 and 301 should be limited to workers and their representatives—in other words, those with a “need to know.” (66 FR at 6057). OSHA explained in 2001:

OSHA agrees that confidentiality of injury and illness records should be maintained except for those persons with a legitimate need to know the information. This is a logical extension of the agency's position that a balancing test is appropriate in determining the scope of access to be granted employees and their representatives. Under this test, “the fact that protected information must be disclosed to a party who has [a particular] need for it . . . does not strip the information of its protection against disclosure to those who have no similar need.”

(66 FR at 6057 (quoting Fraternal Order of Police Lodge No. 5. v. City of Philadelphia, 812 F.2d 105, 118 (10th Cir. 1987))). Commenters agreed with OSHA that access to 300 and 301 data should be limited to those with a “need to know” (i.e., workers, their representatives, and OSHA upon request) (Document ID 2070-A1, p. 8; 2084-A2). Thus, OSHA has always applied a balancing test to weigh the value of worker privacy against the usefulness of releasing the data. The 2016 final rule represented a departure from the balance OSHA has historically struck in favor of achieving uncertain incremental benefits for OSHA enforcement and outreach. This final rule restores OSHA's historical emphasis on protecting the privacy of workers and its longstanding practice of releasing sensitive data on a case-by-case basis only to those with a “need to know.”

Multiple commenters commented that the proposed rule is consistent with the privacy protections in the Privacy Act of 1974 (Pub. L. 93-579) and Section 4(g) of OMB Circular A-130. (E.g., Document ID 1930-A1, p. 2; 1981-A1, p. 3; 2041-A1, p. 2; see also Document ID 2036-A1, p. 4) (“[C]ompelled disclosure of the incredibly private, personally identifiable information required by OSHA Forms 300 and 301 is contrary to the well-established principle that an individual's right to privacy regarding medical conditions and treatment is of paramount importance.”). Although the Privacy Act does not apply to Forms 300 and 301, the statute's articulation that privacy is “a personal and fundamental right” highlights the importance of this issue. (Document ID 1981-A1, p. 3 (quoting Pub. L. 93-579, Section 2(a)(4))). Furthermore, Section 4(g) of OMB Circular A-130 stresses that “[p]rotecting an individual's privacy is of utmost importance.” (Document ID 1981-A1, p. 3 (quoting OMB Circular A-130 (2016), available at: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf )). To that end, Section 4(g) also states that “[t]he Federal Government shall consider and protect an individual's privacy throughout the information life cycle.” (OMB Circular A-130). This final rule complies with this instruction by limiting the potential disclosure of PII and other sensitive worker information.

Many commenters agreed with OSHA's privacy concerns, pointing to the Department's “special responsibility to protect PII from loss and misuse,” and arguing that OSHA should not collect the data from Forms 300 and 301 because it cannot guarantee the protection of PII that may be submitted with the data. (Document ID 2045-A1, p. 3) (quoting Department of Labor, Guidance on the Protection of Personal Identifiable Information, available at: https://www.dol.gov/general/ppii ). Commenters agreed with OSHA that the information reported on Forms 300 and 301 is sensitive, and that the risk of disclosing this sensitive worker information is not worth the uncertain incremental benefits of collecting the data. (E.g., Document ID 1985-A1, pp. 1-2; 2045-A1, pp. 2-3). Other comments agreed with OSHA that collecting Form 300A provides concrete enforcement benefits without putting private worker information at risk of disclosure. (E.g., Document ID 2008, pp. 2-3).

Some commenters cautioned that the 300 and 301 data could include PII, which the Department defines as “any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means[,]” such as “name, address, social security number or other identifying number or code, telephone number, email address, etc.” (E.g., Document ID 2045, pp. 2-3) (quoting Department of Labor, Guidance on the Protection of Personal Identifiable Information, available at: https://www.dol.gov/general/ppii )). Although some of these commenters are under the mistaken impression that employers would be required to submit PII such as name, address, or the name of the treating physician under the prior final rule (compare e.g., Document ID 2041-A1, pp. 1-2 with 81 FR at 29660-61), OSHA shares these commenters' concern that collection of data from Forms 300 and 301 poses a risk of the release of PII.

It is foreseeable that, despite instructions not to include such information, some employers would submit PII inadvertently in Forms 300 and 301, for example in the narrative description of the incident in Column F of the 300 Log. (See 81 FR at 29662; Document ID 2019-A1, pp. 2-3). Although one commenter's experience demonstrated employers' capability of fully redacting PII from a small dataset (Document ID 2077-A1, pp. 1, 2), “[i]t has been OSHA's experience that information entered in Column F of the 300 Log may contain personally-identifiable information. For example, when describing an injury or illness, employers sometimes include names of employees.” (81 FR at 29662).

Whereas in the past, OSHA has manually screened smaller datasets for PII, the dataset at issue in this rulemaking would be far too large to screen manually for employer compliance with an instruction not to include PII, and OSHA is concerned that alternative approaches would not sufficiently alleviate the risk of disclosure. For example, OSHA stated in the 2016 final rule that it would “review” the data for PII using software—and some commenters urged a similar review (e.g., Document ID 1989-A1, p. 1; 2004-A1, p. 1)—but this software is imperfect. As discussed in the NPRM, “it is not possible to guarantee the non-release of PII.” (83 FR at 36498 (citing “De-Identification of Personal Information,” p. 5, Simson L. Garfinkel, NISTIR 8053, October 2015, Document ID 2060)). No commenters provided evidence to the contrary. Therefore, OSHA finds that it would not be able to guarantee that all PII inadvertently submitted to OSHA would be protected from disclosure. (83 FR at 36498).

Moreover, even if PII could be completely removed from the data, concerns about re-identification would remain. As many commenters noted, several data points on Forms 300 and 301 could be combined to reveal the identity of workers who reported work-related injuries or illnesses, particularly in a small town. (E.g., Document ID 2032-A1; 2044-A1, p. 5 (quoting prior comment); 2045-A1, pp. 2-3, 5; 2070-A1, pp. 3, 11, 15-16). As the Phylmar Regulatory Roundtable (PRR) explained:

For example, even with the employee's name removed, PRR members believe it would be easy to determine a worker's identity when reviewing the information in the remaining fields on Form 300: Job title (field C), where the event occurred (E), and details on the injury and body parts affected (F). On the 301 Report, combining multiple data points, for example, the date of the injury or illness (11), what time the employee began work (12), time of event (13), what was the employee doing just before the incident occurred (14), what happened (15), and what was the injury or illness (16), could also result in identifying the worker. While individual fields, standing alone, would not be considered traditional “PII,” (e.g., name, address), once linked, there is a substantial risk that employees may be identified, thus violating their privacy.

(Document ID 2070-A1, p. 3). Thus, even with PII removed from the data, in many circumstances it may be possible to combine data points to identify specific workers who reported injuries or illnesses along with personal details about their conditions.

These privacy concerns are real and important. As OSHA stated in the NPRM, some of the information collected on Forms 300 and 301 may be sensitive for workers. (E.g., 83 FR at 36495). For example, many of the questions on Form 301 seek answers that could contain sensitive information about workers, including:

• Was the employee treated in an emergency room?
• Was the employee hospitalized overnight or as an in-patient?
• Date of birth.
• Date of injury.
• What was the employee doing just before the incident occurred? Describe the activity, as well as the tools, equipment, or material the employee was using. Be specific. Examples: “climbing a ladder while carrying roofing materials”; “spraying chlorine from hand sprayer”; “daily computer key-entry.”
• What happened? Tell us how the injury occurred. Examples: “When ladder slipped on wet floor, worker fell 20 feet”; “Worker was sprayed with chlorine when gasket broke during replacement”; “Worker developed soreness in wrist over time.”
• What was the injury or illness? Tell us the part of the body that was affected and how it was affected; be more specific than “hurt,” “pain,” or “sore.” Examples: “strained back”; “chemical burn, hand”; “carpal tunnel syndrome.”
• What object or substance directly harmed the employee? Examples: “concrete floor”; “chlorine”; “radial arm saw.”

(83 FR at 36495-96). Some commenters disagreed that injury descriptions like those above are sensitive (e.g., Document ID 2048-A1, p. 2; 1978-A1, p. 2; 2048-A1, p. 2), but other commenters provided additional examples of sensitive information that could appear on Form 300 or 301, such as contracting an infectious disease from a patient, being assaulted in the workplace, or being diagnosed with depression or post-traumatic stress disorder. (E.g., Document ID 2044-A1, pp. 5-6 (quoting prior comment); 2070-A1, pp. 15-16). A commenter also noted that some records could implicate the privacy of non-employees, such as patients involved in the occurrence of a workplace injury or illness. (Document ID 1960-A1).

Other commenters disagreed with OSHA's preliminary determination that the data from Forms 300 and 301 are sensitive. (E.g., Document ID 1961-A1, p. 2; 2081-A2, p. 1; 1984-A1, p. 2; 1978-A1, p. 2; 2017-A1, p. 3). For example, one commenter maintained that information such as a description of an injury is integral to OSHA's investigation and is not private or privileged, like medical advice or other communication between a patient and doctor. (Document ID 2017-A1, p. 3). OSHA agrees that not all of the 300 and 301 data are always sensitive, but maintains that some of the data are sensitive and remain sensitive even if not legally privileged and even though OSHA intends to continue to use these data during onsite inspections.

Commenters asserting that OSHA's privacy concerns are disingenuous (e.g., Document ID 1976-A1, pp. 2-3; 1984-A1, pp. 1-2; 2022-A1, p. 3; 2038-A1, p. 2; Document ID 1978-A1, p. 2; 2088-A1, p. 3) fail to appreciate the real possibility of the disclosure of sensitive worker information. The comment (and others like it) that “[t]he risk to worker privacy is very minimal and unlikely to materialize” (Document ID 2011-A1, p. 5) discounts the risk to worker privacy that OSHA's experience—of having to remove PII and other information that could re-identify the ill or injured worker during manual screening of forms prior to release—has shown. Although many advocacy groups submitted similarly-worded comments stating that the data from Forms 300 and 301 are not sensitive (e.g., Document ID 1976-A1, p. 3; 2058-A1, p. 2; 2059-A1, p .2; 1976-A1, p. 3), private citizens and health advocacy organizations expressed concern about the sensitive nature of the data and emphasized the importance of keeping sensitive worker information out of the public eye. (E.g., Document ID 1938; 1975; 1979; 2006-A1, p. 2). OSHA agrees with the latter commenters that sensitive information can be included in the data on these Forms and should be protected against public disclosure.

Moreover, many of those taking the view that privacy concerns about the data were overstated expressed their confidence that OSHA could guarantee the protection of any PII contained in the data, a confidence that OSHA does not share. (E.g., Document ID 2031 (“The 2016 provisions clearly stated that no information that would identify individual workers was to be reported. If such information was accidentally submitted, OSHA made it clear it would never be released to the public.”); 2038-A1, p. 2 (“The 2016 provisions clearly state that no information tied to any individual worker(s) was to be reported. If such information was inadvertently submitted, OSHA ensured [sic] us it would never be released to the public.”)).

It is true, as some commenters noted, that OSHA considered the issue of worker privacy in the 2016 final rule and included protections to reduce the likelihood of sensitive information being made public, (Document ID 2028-A1, p. 6), but OSHA no longer views such protections as sufficient. OSHA noted in 2016, for example, that “consistent with FOIA, the agency does not intend to post personally identifiable information on the website.” (81 FR at 29659 (emphasis added)). Yet OSHA did not—and cannot—guarantee non-release of PII. In fact, OSHA acknowledged in 2016 that Forms 300 and 301 could contain PII in the fields that employers were required to submit. (See 81 FR at 29662 (“It has been OSHA's experience that information entered in Column F of the 300 Log may contain personally-identifiable information. For example, when describing an injury or illness, employers sometimes include names of employees.”)). Although OSHA previously thought to address this issue with software, de-identification software is not 100% effective, and OSHA believes that some PII could be released even after being processed through the software. (83 FR at 36498).

Moreover, even if software could guarantee full scrubbing of PII, the possibility still remains that the data could be re-identified with the worker who reported the injury or illness. (83 FR at 36498). When discussing the agency's past experience of withholding private worker information from disclosure under FOIA, OSHA referred to the practice of manually redacting Forms 300 and 301 on a case by case basis. (81 FR at 29658). For example, OSHA noted that it “would not disclose the information in Column C [of Form 300] (Job Title), if such information could be used to identify the injured or ill employee.” (81 FR at 29658). OSHA thus acknowledged even in the 2016 final rule that the worker's job title could be used to identify the injured or ill worker in some situations and that OSHA had protected that information in the past through manual review of the file and invocation of FOIA Exemption 7(c). (81 FR at 29658). The 2016 rule's proposed use of de-identification software would not address this issue.

Commenters argued that data similar to those on Forms 300 and 301 have been available to workers and their representatives since the passage of the Act (i.e., those with a “need to know”) (E.g., Document ID 1984-A1, p. 2; 2088-A3, p. 5 (comments dated March 10, 2014)), but those data have always been screened manually for PII. Such screening may have been possible before the 2016 final rule for individual files requested on a case by case basis, but OSHA could not possibly review each individual form that would be submitted electronically under the 2016 final rule to determine whether a worker's job title could be used to identify the worker.

The same principle distinguishes OSHA's practice of posting information about severe injuries and fatalities on its website, which some commenters cited as proof that the information on Forms 300 and 301 is not too sensitive to publish. (E.g., Document ID 1961-A1, p. 2; 1976-A1, p. 3; 2038-A1, p. 2; 2054-A1, p. 4). Although OSHA has not identified specific worker complaints about OSHA's posting of severe injury data in the past, as asserted by one commenter (Document ID 2054-A1, p. 4; see also Document ID 2015-A1, p. 1), OSHA receives only approximately 800 severe injury reports per month, and manually screens each severe injury report for PII or other sensitive worker information before posting. OSHA's past practice of manually redacting these data before releasing them has no application to the mass collection of Forms 300 and 301 data from 36,903 establishments—data drawn from what OSHA estimates would be more than 775,000 forms—which could only be screened using software with limitations delineated elsewhere in this preamble and in the 2018 NPRM.

Although OSHA believes the 300 and 301 data would be exempt from disclosure under FOIA Exemptions 6 and 7(c), OSHA still could be required by a court to release the data, as discussed in the NPRM and echoed by many commenters. (83 FR at 36498; see also Document ID 1930-A1, pp. 3-4; 1979; 1981-A1, pp. 2-3; 2075-A1, p. 5; 2084-A1, p. 3). The risk of disclosure of sensitive information is not speculative, as some commenters claimed (e.g., Document ID 2056-A1, pp. 1-2). One FOIA requester has already sued the Department in multiple lawsuits seeking injury and illness data: One lawsuit seeks the 300A data collected through the Injury Tracking Application, and one lawsuit seeks to force OSHA to collect the 2017 data from Forms 300 and 301 for the requestor's use in research. See Public Citizen v. U.S. Dep't of Labor, Civ. No. 18-cv-117 (D.D.C. filed Jan. 19, 2018); Public Citizen Health Research Group v. Acosta, Civ. No. 18-cv-1729 (D.D.C. filed July 25, 2018). In a decision denying the government's motion to dismiss in Public Citizen Health Research Group v. Acosta, the court concluded that the plaintiffs would likely be entitled to a significant portion of the 300 and 301 data if collected by OSHA, despite OSHA's conclusion that the data would be exempt from disclosure under FOIA. Public Citizen Health Research Group v. Acosta, Civ. No. 18-cv-1729 (D.D.C. December 12, 2018) (order denying motion to dismiss and preliminary injunction). In addition, in New York Times Co. v. U.S. Dep't of Labor, 340 F. Supp. 2d 394 (S.D.N.Y 2004) and Finkel v. U.S. Dep't of Labor, No. 05-5525, 2007 WL 1963163 (D.N.J. June 29, 2007), two separate courts ordered OSHA to release injury and illness data that OSHA argued were exempt from disclosure under FOIA Exemption 4. (See Document ID 2019-A1, p. 7; 2070-A1, p. 4).

OSHA disagrees with comments arguing that OSHA mischaracterized the Finkel and Public Citizen lawsuits and the risk of the disclosure of sensitive information under FOIA. (See Document ID 2048-A1, pp. 2-3; 2012-A1, p. 11; 2022-A1, p. 2). OSHA agrees with Mr. Finkel and other commenters that the Finkel lawsuit did not result in a court ordering disclosure of PII (see, e.g., Document ID 2048-A1, p. 1; Finkel v. U.S. Dep't of Labor, No. 05-5525, 2007 WL 1963163 (D.N.J. June 29, 2007)). The Public Citizen Health Research Group, Finkel and New York Times lawsuits do, however, demonstrate the power of courts to order OSHA to release injury and illness data that OSHA considers sensitive information exempt from disclosure, over OSHA's objections. In another case, the Sixth Circuit Court of Appeals ordered the release of data the Federal Aviation Administration tried to protect from disclosure, despite the possibility that multiple data points could be combined to re-identify particular individuals who had participated in a strike. (Norwood v. FAA, 993 F.2d 570, 574-75 (6th Cir. 1993)). OSHA is concerned a similar outcome could result if it collects the data from Forms 300 and 301 and then attempts to withhold the data in response to FOIA requests on the ground that the data could well contain sensitive information that OSHA cannot guarantee would be removed. “[O]nce the information is disclosed [under FOIA], it can never be made private.” (See Document ID 2075-A1, p. 5).

Some commenters asserted that OSHA should collect the 300 and 301 data but limit its release in various ways (Document ID 2006-A1, pp. 2-3), or that OSHA could never be required to disclose sensitive worker information under FOIA (e.g., Document ID 2006-A1, p. 3; 2012-A1, p. 11; 2022-A1, p. 2; 2028-A1, pp. 2, 7). These comments ignore the reality reflected in these lawsuits that the Department would not retain complete control over the data once they are collected. And, given that OSHA cannot guarantee complete removal of PII or data that could be re-identified with a particular worker from such a large dataset, court-ordered publication of the data from Forms 300 and 301 could well result in the disclosure of sensitive worker information. Other commenters presented alternatives to fully rescinding the requirement to collect the data from Forms 300 and 301, such as excluding job title and precise date of injury to reduce the likelihood of re-identification. (Document ID 1993-A1, p. 2; 2028-A1, p. 7). OSHA notes that even without the job title and precise date fields, however, employers could include sensitive information, such as worker and patient names, in the narrative description of the injury and how it occurred. (Document ID 1960-A1; 81 FR at 39662). OSHA has had to redact this kind of information during manual screening in the past prior to release. (81 FR at 39662).

The American Nurses Association (ANA) expressed concern about potential disclosure of sensitive worker information under FOIA but believes that the case-level data are important for performing root-cause analyses to prevent incidents of workplace injuries and illnesses. (Document ID 2000-A1, pp. 1-2). The ANA notes that 29 CFR 1904.8 requires employers to record on the OSHA Form 300 all work-related needlestick injuries and cuts from sharp objects that are contaminated with another person's blood or other potentially-infectious material, but that employers are prohibited from recording an injured worker's name. (Document ID 2000-A1, pp. 2-3). Given the protections afforded these cases under § 1904.29(b)(6) through (9), the ANA asks whether it would be viable for OSHA to continue to require electronic submission of OSHA 300 Log for needlestick and sharps injuries to help inform the future prevention of needlestick and sharps injuries. (Document ID 2000-A1, p. 3).

OSHA notes the importance of the OSHA 300 Log for needlestick injuries and cuts from sharp objects for identifying hazards in healthcare settings, and encourages employers to use their own data from Forms 300 and 301 to identify workplace hazards, as OSHA does during onsite inspections. Like any other OSHA 300 Log, however, the possibility of personal information being reported to OSHA inadvertently remains despite the prohibition against recording names, as does the risk of re-identification through job title or another reported field. These data might then be subject to release under FOIA. Therefore, OSHA declines the invitation to retain the reporting requirements for case-characteristic data for the OSHA 300 Log for needlestick injuries and cuts from sharp objects.

After reviewing all of the comments on this issue, OSHA has determined collecting the data would expose sensitive worker information to a meaningful risk of disclosure. OSHA cannot justify that risk given its resource allocation concerns and the uncertain incremental benefits to OSHA of collecting the data, as discussed elsewhere in this preamble. OSHA has determined that the best use of its resources is to focus on data it already receives—including a large set of data from Form 300A, as well as discrete data about urgent issues from severe injury reports—and has found useful in its past experience.

Experience of the Mine Safety and Health Administration (MSHA) and Other Federal and State Agencies

The experience of MSHA and other federal and state agencies with collecting and publishing similar data, as many commenters noted (e.g., Document ID 2007, p. 8; 2011-A1, p. 6; 2012-A1, p. 6; 2028-A1, p. 2), does not mean OSHA is required to collect the data from Forms 300 and 301. As explained below, other federal and state agencies may weigh worker privacy concerns differently based on their missions, priorities, and budgets.

OSHA acknowledges, for example, comments that MSHA has been collecting similar data—albeit from a much small number of establishments—for many years (e.g., Document ID 2011-A1, p. 7) and has posted data on the web for more than fifteen years (Document ID 2012-A1, pp. 6, 10). MSHA maintains the data in a comprehensive database that it makes available to the public. (E.g., Document ID 1965-A1, p. 52). Commenters noted that MSHA has not experienced any security breaches or complaints or controversy about employee privacy, despite the fact that MSHA's database includes small employers. (E.g., Document ID 2012-A1, p. 10). Commenters further noted that “MSHA has a robust system in place to protect [PII] from inappropriate disclosure.” (E.g., Document ID 2011-A1, pp. 7-8).

There are security controls in place to prevent database contamination should nefarious acts be taken against the front-end website. The information has to be reviewed by at least three approving authorities prior to it being introduced and or uploaded into the appropriate database for further analysis and data manipulation. Data extracts are redacted of the PII prior to being released for public consumption.

(Document ID 2088-A1, p. 12) (quoting MSHA, Privacy Impact Assessment Questionnaire, MSHA Standardized Information System (MSIS)—FY2017, available at: https://www.dol.gov/oasam/ocio/programs/pia/msha/MSHA-MSIS.htm ).

Although three layers of review might make sense given MSHA's budget and the much smaller number of employers under the agency's jurisdiction, it would require OSHA to commit an unwarranted level of resources to provide three layers of review for the volume of records it would receive. Under the 2016 final rule, OSHA would collect between 38 and 77 times more injury reports than MSHA—that is, approximately 775,000 reports, versus MSHA's 10,000-20,000. OSHA estimates, based on the time it has taken OSHA staff to review and remove personal information from other OSHA data, that it would take two levels of review and 7 minutes per record, on average, to assess the record and remove personal information. Such review would cost OSHA approximately $7.5 million each year.

Other commenters pointed out that “[t]he Federal Railroad Administration (FRA) posts accident investigation reports filed by railroad carriers or made by the Secretary of Transportation, and the Federal Aviation Administration (FAA) posts National Transportation Safety Board reports about aviation accidents.” (Document ID 2012-A1, p. 10; see also 2028-A1, p. 7). Some of these commenters noted that the information posted by these agencies includes personally identifiable information, such as age, gender, job history, medical information, or information about the accident. (Document ID 2028-A1, p. 7). In addition, some state workers' compensation systems have online search capacity for data including the claimant's name and the description of the injury. (Document ID 1993-A1, p. 2).

Again, OSHA acknowledges that other federal and state agencies have collected somewhat similar data for a number of years, but notes that each of these agencies has a unique mission, varying priorities, and different resource constraints. In this final rule, OSHA is balancing the issues of worker privacy and OSHA's resource priorities against the uncertain incremental benefits of collecting the data from Forms 300 and 301. Because OSHA has determined that the extent of the incremental benefits to OSHA of collecting the data is uncertain—and because OSHA can still obtain the data from employers if needed for specific enforcement actions—the agency is choosing to protect worker privacy and commit the agency's resources to fully utilizing 300A and severe injury report data that its experience has already demonstrated are useful. Other federal and state agencies may weigh worker privacy concerns differently based on their missions, priorities, and budgets.

The Health Information Portability and Accountability Act (HIPAA) and Americans With Disabilities Act (ADA)

One commenter indicated that PII should never be included in published data because such action would conflict with HIPAA and could require employees in healthcare settings to violate patients' privacy rights, subjecting those employees to legal and licensing problems. (Document ID 1936). Another commenter noted that—like HIPAA—the ADA protects medical information from unnecessary disclosure and limits who can access an employee's medical records (including only providing them to government personnel investigating compliance upon request). (Document ID 2036-A1, p. 5). OSHA disagrees that HIPAA and the ADA would apply to its electronic collection of Forms 300 and 301 for the reasons set forth in the 2016 final rule, (see 81 FR at 29665-66), but agrees that privacy-related policy concerns reflected in these laws buttress its determination that these data should not be collected in this way.

Technological Limitations of De-Identification Software

In the NPRM, OSHA proposed to amend the recordkeeping regulations to protect worker privacy by no longer requiring employers to submit electronically detailed injury and accident information. (E.g., 83 FR at 36494). Specifically, OSHA explained the concern about potential disclosure of sensitive worker information under the Freedom of Information Act (FOIA). (E.g., 83 FR at 36494). Although software is available to scrub identifying information from electronic data, the software cannot eliminate the risk of disclosure of PII. (83 FR at 36498). Even if all PII were removed from the data, a risk remains that some data could still be re-identified with a particular individual. (83 FR at 36498).

Many commenters echoed OSHA's concerns that, under the prior final rule, PII or data that could be re-identified with a particular individual could be released under FOIA. (Document ID 2070-A1, pp. 3, 4-5; 2055-A1, p. 2). These commenters stated that OSHA's plan to de-identify PII through software is insufficient to protect worker privacy. (Document ID 2070-A1, p. 5; 2055-A1, p. 2). For example, one commenter stated that in the case of a unique injury occurring in a small town, the sensitive details of an injury might easily be associated with a specific individual even without naming that individual. (Document ID 2032-A1).

Although OSHA stated in the 2016 final rule that “the [a]gency will use software that will search for, and de-identify, personally identifiable information before the submitted data are posted” (81 FR at 29662), OSHA did not guarantee complete removal of PII through de-identification software as some commenters claimed. (See Document ID 2031 (“OSHA made it clear [information that would identify individual workers] would never be released to the public.”); 2038-A1, p. 2 (“OSHA ensured [sic] us [information tied to individual workers] would never be released to the public.”)). In fact, OSHA stated that it intended to protect sensitive information from release, (81 FR at 29659), but that is not a guarantee. Commenters noting that OSHA has not cited any concrete evidence of problems or errors in de-identification since promulgating the 2016 final rule, nor any evidence that the information on Forms 300 and 301 would be particularly vulnerable to disclosure (Document ID 2020-A1, pp. 3-5; 2033-A1, p. 4), fail to give due weight to the possibility that sensitive worker information could be released despite OSHA's best efforts. Claims that the concerns about disclosure after de-identification are “speculative” and raise only a “remote” risk of disclosure (Document ID 2020-A1, p. 4) likewise ignore OSHA's past experience of needing to remove PII and other sensitive information from Forms 300 and 301 on a case-by-case basis prior to release to prevent re-identification, as discussed above in more detail.

After carefully considering commenters' submissions on this issue, OSHA finds that there is a meaningful risk to worker privacy if OSHA requires employers to electronically file detailed injury and illness data on Forms 300 and 301 because de-identification software cannot fully eliminate the risk of disclosure of PII or re-identification of a specific individual and manual review of the data would not be feasible. OSHA's past experience with case-by-case release of 300 and 301 data and severe injury reports reveals that these concerns are far from speculative. These risks weigh in favor of the rescinding requirements to submit the data from Forms 300 and 301 to OSHA electronically.

Risk of Cyber Attack

In the NPRM, OSHA stated that electronically-stored data might incentivize cyber-attacks on the Department's IT system. OSHA noted that there was a potential compromise of user information for OSHA's Injury Tracking Application (ITA) in 2017, demonstrating that such a large data collection will inevitably encounter malware. (83 FR at 36498, Fn. 2).

Several commenters agreed with OSHA that worker privacy could be compromised by a data breach, cyber-attack, or malware, and that collecting such a large amount of data electronically could incentivize cyber-attacks on the Department. (E.g., Document ID 2076-A1, p. 5). Some of these commenters noted the 2017 potential compromise of OSHA's ITA as a basis for these concerns. (Document ID 2034-A1, p. 2; 2076-A1, p. 5). Commenters also included examples of large scale breaches of government data systems in other agencies. (Document ID 2034-A1, pp. 1-2; 2042-A1, p. 2). In addition, commenters cited a 2016 report by the House Oversight Committee finding that the federal government was vulnerable to cyber-attacks (Document ID 2034-A1, p. 1), and a Federal Information Security Modernization Act (FISMA) Report to Congress for Fiscal Year 2017 finding that the Occupational Safety and Health Review Commission had an overall rating of “At Risk” (Document ID 2070-A1, p. 8).

One commenter asserted that OSHA should be just as capable as MSHA of safeguarding the data since the Department consolidated Information Technology (IT) services in 2014. (Document ID 2082-A2, p. 5; see also Document ID 2088-A1, p. 12 (noting that MSHA has strong information security controls in place)).

OSHA notes that the ITA data meet the security requirements for government data, and after reconsidering this issue, OSHA does not find that collecting the data from Forms 300 and 301 would increase the risk of a successful cyber-attack. Some risk remains, however, that a cyber-attack could occur and result in the release of data. Moreover, OSHA shares the concerns of some commenters about how having thousands of businesses upload a large volume of additional data could generally increase risk for cyber-security issues. (See, e.g., Document ID 2045-A1, p. 3; 2075-A1, pp. 4-5).

Limitations on OSHA's Capacity To Collect and Use the Data From Forms 300 and 301

In the NPRM, OSHA expressed doubt about the necessity for and ability to use the large volume of data that would be generated by Forms 300 and 301, given its resources and competing priorities. As explained below, OSHA has prior experience with using the 300A data successfully and believes that it is the best resource for enforcement targeting and compliance assistance. OSHA also receives and effectively uses data concerning the most severe injuries and illnesses. In contrast, the agency has no prior experience using the case-specific data collected on Forms 300 and 301 for enforcement targeting or compliance assistance and is unsure how much benefit such data would have for these purposes or the level of resources needed to attain any benefit. (83 FR at 36498). OSHA noted that the agency's efforts to realize these uncertain benefits by collecting, processing, analyzing, distributing, and programmatically applying the data would be costly. (83 FR at 36498-99).

Several commenters agreed that OSHA may not be able to make beneficial use of the large volume of data it would receive under the 2016 Rule. (Document ID 2034-A1, p. 2; 2070-A1, p. 9). The United States Postal Service also expressed concern that any technical complications OSHA experienced due to the large volume of data being submitted could hinder timely reporting, leading to steep monetary penalties for employers. (Document ID 2034-A1, p. 2).

Other commenters claimed that OSHA has the capacity to collect and code this volume of data. (Document ID 2011-A5, p. 1 (commenting on 2013 NPRM); 2026-A1, p. 3; 2029). The Attorneys General of NJ, MA, MD, NY, PA, RI, and WA jointly commented that OSHA's lack of experience with this volume of data is unsurprising because OSHA has not tried to collect the Form 300 and 301 data yet. (Document ID 2028-A1, p. 3). They noted that for this reason it is also unsurprising that the benefits are uncertain at this point. (Document ID 2028-A1, p. 3). Another commenter observed that OSHA does have experience evaluating Form 300 Logs and Form 301 Incident Reports while conducting workplace investigations, so OSHA should be able to make use of such information collected through electronic submissions. (Document ID 2063-A1, pp. 1-2).

Although OSHA is technically capable of collecting the 300 and 301 data through a secure Web portal similar to the one used for 300A data collection, no such portal was built when the 2016 rule was being developed or after it was finalized. Diverting resources now to build such a portal would take away from OSHA's enforcement efforts. Likewise, the cost of collecting the additional 300 and 301 data in that manner would be substantial (see Section IV, Final Economic Analysis and Regulatory Flexibility Certification). OSHA has accordingly concluded that worker privacy concerns and OSHA's resource priorities—including fully utilizing the 300A data that it already has collected from 214,574 establishments—outweigh the uncertain benefits of seeking to collect and process the data from Forms 300 and 301.

Several commenters observed that other agencies, as well as other divisions within the Department of Labor, collect, track, and utilize similar data. (E.g., Document ID 2026, pp. 2-3). Some of these commenters encouraged consultation with other agencies who collect this type of data, including NIOSH, MSHA, Bureau of Labor Statistics (BLS), FRA, and FAA, to learn about database design and best practices for collecting this kind of data. (Document ID 1965-A1, pp. 179-80; 2012-A1, p. 9; 2085-A1, p. 16 (quoting comments on 2013 NPRM)). Given OSHA's successful use of summary data from Form 300A and severe injury reports to target its enforcement and outreach efforts, and given its privacy concerns and its current resources and priorities, OSHA has determined to continue to invest its time and money in an approach that is known to be effective, while continuing its use of 300 and 301 data in onsite inspections.

OSHA also received a comment from NIOSH, offering to help with data analysis. Specifically, NIOSH commented that it is well-positioned to play a leading role in helping OSHA use data collected in Forms 300 and 301 to prevent occupational injuries and illnesses. (Document ID 2003-A2, p. 3). NIOSH explained that it has the experience and capacity to analyze the data, as well as interest in using the data to provide guidance to employers for the prevention of occupational injury and illness, and to provide data analysis results and analytical tools that should enhance OSHA's targeting. (Document ID 2003-A2, p. 3). NIOSH noted that it has already developed auto-coding methods for categorizing occupation and industry based on free text data and has successfully utilized similar free text data collected from workers' compensation claims. (Document ID 2003-A2, p. 5). While NIOSH acknowledged that the data collected from Forms 300 and 301 would pose a greater analysis challenge because of the amount of data, NIOSH stated that the large data set would be useful to identify patterns and prevent workplace injuries. (Document ID 2003-A2, p. 6).

OSHA appreciates the value of inter-agency efforts to achieve shared goals of preventing occupational injuries and illnesses and looks forward to continued coordination with NIOSH and other agencies where appropriate. However, OSHA has determined that NIOSH's ability to analyze data collected from Forms 300 and 301 does not reduce the burden on OSHA to collect the data. Even if NIOSH could make the data useful for OSHA's enforcement targeting and outreach efforts, which NIOSH itself has suggested would present analytical challenges due to the volume of the data, OSHA and employers would be left covering the expense of collection, not to mention additional expense associated with the need to process and otherwise manually review data from the forms—costs that would detract from OSHA's priorities of enforcement and compliance assistance to reduce workforce hazards.

After reviewing commenters' submissions related to OSHA's capacity to use the large volume of data that would be generated by the submission of Forms 300 and 301, the agency remains concerned about the costs of collecting and processing this large volume of data. OSHA has considered the comments about the benefits of electronically collecting the data and, as explained more fully below, has determined that the incremental benefits of electronic collection of these data to OSHA's enforcement targeting and compliance assistance activities remain uncertain. In OSHA's judgment, those uncertain benefits are outweighed by the cost of developing a system to manage that volume of data, particularly when making use of the data would divert resources away from OSHA's current priority of fully utilizing Form 300A and severe injury data for targeting and outreach.

Uncertain Extent of Benefits From Collecting the Data From Forms 300 and 301

In the proposed rule, OSHA preliminarily determined that the extent of the incremental benefits of electronically collecting data from Forms 300 and 301 is uncertain. (E.g., 83 FR at 36498-99). OSHA explained that the collection of data from the summary Form 300A provides the agency with the information it needs to identify and target establishments with high rates of work-related injuries and illnesses. (83 FR at 36498). For example, OSHA noted that it had collected summary 300A data for 2016 from 214,574 establishments. (83 FR at 36498). OSHA further explained that it was able to use those data to design a targeted enforcement mechanism for establishments experiencing higher rates of injuries and illnesses. (E.g., 83 FR at 36498). OSHA noted its plans to further refine this approach by using the greater volume of 2017 summary data. (83 FR at 36498).

The proposed rule also discussed OSHA's long-time use of summary data in enforcement. (83 FR at 36498). Before the 2016 rule, OSHA had collected these data for 17 years under its OSHA Data Initiative (ODI) and used those data to identify and target high-rate establishments through the Site-Specific Targeting (SST) Program. (83 FR at 36498). OSHA stopped the ODI in 2013 and the SST in 2014 while it developed the 2016 final rule, but the agency noted that those prior programs have still given it considerable experience with using 300A data for targeting. (83 FR at 36498).

Conversely, OSHA explained that it has no prior experience with using the case-specific data from Forms 300 and 301 to identify and target establishments for enforcement or outreach purposes. (83 FR at 36498). For example, OSHA is unsure how much benefit such data would have for these purposes, but has determined that considerable effort and resources would be required to realize those uncertain benefits. (83 FR at 36498-99). The agency estimated that establishments with 250 employees or more would report data from approximately 775,210 Form 301s annually, a total volume three times the number of Form 300As from which data were uploaded for 2016, while also presenting more complicated information than that captured by Form 300A. (83 FR at 36498). To gain enforcement value from the case-specific 300 and 301 data, OSHA explained that it would need to divert resources from other priorities, such as the utilization of Form 300A data, which OSHA's long experience has shown to be useful. (83 FR at 36498-99).

OSHA asked stakeholders to submit comments on the benefits and disadvantages of the proposed removal of the requirement for employers with 250 or more employees to submit the data from OSHA Forms 300 and 301 to OSHA electronically on an annual basis, including the usefulness of the data for enforcement targeting (83 FR at 36499), and received a number of comments in response. Many of the commenters agreed that the enforcement benefits stemming from electronically collecting the Form 300 and 301 data are uncertain. (E.g., Document ID 2034-A1, pp. 2-3; 2036-A1, pp. 7-8). One commenter also suggested that OSHA has not shown that it is fully and effectively using currently-available data (Document ID 2019-A1, p. 3), and another indicated that OSHA has not demonstrated that there are significant gaps in the current data that compromise OSHA's execution of its mission, that electronically collecting the Form 300 and 301 data will address those gaps, or that the protocols described by the 2016 final rule will efficiently and effectively compile necessary information to lead to significant improvements in achieving OSHA's goals (Document ID 2003-A2, p. 3). Commenters further noted that OSHA did not explain in 2016 how it would effectively use the Form 300 and 301 data to the benefit of its enforcement and compliance assistance programs. (E.g., Document ID 2019-A1, p. 3; 2044-A1, p. 6). Other commenters concluded that collecting Form 300A data is sufficient for OSHA's targeting and enforcement purposes and electronically collecting the Form 300 and 301 data has no clear benefit. (E.g., Document ID 1970-A1; 2034-A1, pp. 2-3).

Commenters also asserted that Form 300 and 301 data do not predict current hazards or take into account any corrective actions by the employer, nor do they show if OSHA should have issued a citation in response to a recorded occurrence. (E.g., Document ID 2057-A1, p. 3; 2075-A1, p. 3). Put another way, the fact that an employer records an incident does not necessarily correlate to workplace hazards or compliance inadequacy or otherwise indicate that the reporting employer is responsible for the incident. (E.g., Document ID 2075-A1, p. 3). For example, the E-Recordkeeping Coalition stated that, “[b]ased on a qualitative analysis of [its] members' 300 and 301 data, only a small percentage of that data would indicate any regulatory compliance insufficiency.” (Document ID 2076-A1, p. 3). Relatedly, one commenter posited that collecting the Forms 300 and 301 data does not serve the purpose of a “no-fault” recordkeeping system. (Document ID 2057-A1, p. 3).

According to some commenters, maintaining Form 300 and 301 data electronically would not aid OSHA in identifying, and engaging in enforcement, at high-risk workplaces, (e.g., Document ID 2042-A1, p. 2), or otherwise provide any real value to the agency's enforcement targeting strategies or decisions (e.g., Document ID 2075-A1, p. 3; 2076-A1, p. 3). A comment in the record concerning OSHA's 2013 NPRM, from a commenter that generally supported OSHA's collection of Form 300 and 301 data, noted that use of the Form 301 narratives can be cumbersome. (Document ID 2085-A8, p. 31). The Phylmar Regulatory Roundtable pointed out that OSHA can still collect the Form 300 and 301 data after it has determined to inspect an establishment, using the data to target specific areas of the workplace during the inspection, and stated that doing so results in a fair, objective process, rather than injecting unfairness and subjectivity into OSHA's targeting decisions. (Document ID 2070-A1, p. 8). OSHA agrees that the best use of the Form 300 and 301 data is for identifying hazards during onsite inspections, and OSHA will continue using the data in this manner.

OSHA disagrees with commenters asserting that OSHA now ignores many key benefits it previously asserted would be derived from electronically collecting and publishing the Form 300 and 301 data. (E.g., Document ID 2028-A1, p. 3; 2054-A1, p. 6). Rather, OSHA is now re-assessing the uncertain incremental benefits to OSHA enforcement and compliance assistance activities and re-balancing those benefits against worker privacy concerns and OSHA's current resource priorities. That balancing takes into account, as is appropriate, how OSHA can and will continue to collect and use data from Forms 300 and 301 as needed, as well as data from severe injury reports, for on-site inspections and specific enforcement.

OSHA's position in this final rule on the uncertain benefits of collecting data from Forms 300 and 301 outside the context of an onsite inspection is not inconsistent with its position in the Mar-Jac Poultry case (see U.S. v. Mar-Jac Poultry, Inc., 153 Fed. Appx. 562 (11th Cir. Oct. 9, 2018) (unpublished)), as some commenters suggested. (E.g., Document ID 2015-A1, pp. 8-11; 2054-A1, pp. 8-9). In that case, OSHA took the position that the 300 logs had value for identifying potential violations during an onsite inspection, and OSHA maintains that belief. Indeed, OSHA intends to continue using the data from Forms 300 and 301 for that purpose. OSHA notes that case involved the use of 300A data from an establishment OSHA is inspecting to expand the scope of the inspection; it did not address the usefulness, for enforcement purposes, of collecting a high volume of Form 300 and 301 data.

One commenter disagreed with rescinding the requirement to submit data from Forms 300 and 301 to OSHA without taking certain steps identified in the 2016 final rule—including “looking at examples of electronic data collection efforts by other federal agencies” and “form[ing] a working group with BLS to assess data quality, timeliness, accuracy, and public use of the collected data.” (Document ID 2012-A1, p. 15). OSHA did not, however, bind itself to take such actions in order to reconsider the decision whether to collect the data was justified in light of the risk to worker privacy and the agency's best use of its resources. Furthermore, other agencies' experiences are not directly relevant to OSHA's resource priorities and unique mission. OSHA routinely consults with other agencies as part of its rulemaking process and did so for this rule. Because OSHA issues this final rule as a result of its re-balancing of the risk to worker privacy with the rule's uncertain benefits and the agency's resource priorities, OSHA has determined that further consultation with other agencies is neither necessary nor appropriate.

OSHA agrees, as some commenters noted, that public health principles dictate data-based approaches. (E.g., Document ID 2006-A1, p. 2; 2014-A1, p. 2). OSHA disagrees, however, that collecting the data from Forms 300 and 301 is therefore necessary; OSHA is already collecting the 300A data and using those data to inform its enforcement targeting. OSHA is uncertain how much additional value the data from Forms 300 and 301 would provide for enforcement and compliance assistance at this time and has therefore determined that fully utilizing the 300A data and severe injury report data is the best use of OSHA's resources. OSHA will continue to obtain the data from Forms 300 and 301 from employers, as needed, for on-site inspections and specific enforcement actions, and OSHA will likewise continue to assess and utilize data from the severe injury reports it receives and that have proven useful in identifying and addressing areas of need.

According to some commenters, having a comprehensive batch of data from Forms 300 and 301 would allow OSHA to understand employer misconduct more broadly, and this dataset could make up for OSHA's inability to visit all of the worksites within its jurisdiction. (E.g., Document ID 2015-A1, p. 7; 2056-A1, p. 2; 2082-A2, p. 5). Others asserted that the data can serve as a guide for agency inspections, providing compliance officers with the number, type, severity, and distribution of injuries at a particular workplace. (Document ID 2012-A1, p. 2; 1965-A1, p. 179 (NAS Report)). OSHA has determined that the 300A data are sufficient for enforcement targeting and compliance assistance, and notes again that it can still use Forms 300 and 301 to guide inspections by collecting the data onsite, without the need to divert resources to creating a Web portal never built during or after the 2016 rule's development.

Some commenters indicated that having electronic access to the data would facilitate OSHA's effective use of the data (e.g., Document ID 2056-A1, p. 2) by, for example, providing timely, searchable, sortable information with which OSHA could identify and understand trends, and that reducing the amount of information available to the agency would make it less effective. (E.g., Document ID 1974; 1994; 2020-A1, p. 11; 2082-A2, p. 5; 2085-A1, pp. 5-7). Others, assuming the data would be published, suggested that employees would use publicly available information to analyze whether their employers are underreporting, to identify hazards and prevent injuries, and to determine where they may want to work (e.g., Document ID 2012-A1, pp. 5, 13; 2022-A1, pp. 1, 2; 2047-A1, pp. 3-4; 2050-A1, p. 1; 2083-A1, p. 2; 2085-A1, pp. 19-20 (quoting Document ID 2085-A10, pp. 13, 178 (NAS report)), and that employers would use the data to benchmark effectively, and to identify injury trends in the industry to prevent incidents before they occur (e.g, Document ID 2007-A1, p. 5; 2011-A3, p. 8; 2012-A1, p. 6; 2022-A1, p. 2). One commenter suggested that employers could use the data to assess the safety record of contractors before hiring them. (Document ID 2085-A1, p. 18). Commenters also argued that electronic access to the data would eliminate delays and obstacles to accessing the data for employees and their representatives. (E.g., Document ID 2020-A1, p. 11; 2086-A1, p. 3). Other commenters opined that requiring employers to report their Forms 300 and 301 electronically could improve the consistency and quality of what employers report, providing employers and employees with an opportunity to decrease injuries and illnesses both at particular establishments and company-wide. (E.g., Document ID 2010-A2, p. 1; 2082-A2, pp. 2-3; 2085-A1, p. 11).

OSHA begins by noting that many of the benefits discussed by commenters would not materialize. Because OSHA has determined publishing the data would do more harm than good for reasons described more fully below and in the privacy discussion above, OSHA would not make the data public even if collected. In addition, as noted above, OSHA has already taken the position that data from Form 300A is exempt from disclosure under FOIA and that OSHA will not make such data public for at least the approximately four years after its receipt that OSHA intends to use the data for enforcement purposes. Therefore, the benefits some commenters ascribed to publication of the data would not be realized. Without publication, the research benefits claimed by many commenters (e.g., Document ID 1965-A1, p. 1; 2004-A1, p. 1; 2011-A1, pp. 2-3 (quoting the NAS report), 6-11; 2012-A1, pp. 3-4, 6-7; 2015-A1, pp. 2-6; 2082-A2, pp. 2-3; 2088-A1, pp. 2, 7-8) also fall away. To the extent case-specific data are crucial in conducting root-cause analyses, which can reduce and prevent workplace illnesses and injuries (Document ID 2000-A1, p. 1), employers can still use their own data, or share it with researchers voluntarily, for this purpose. OSHA acknowledges that the 300 and 301 data would have benefits for occupational safety and health research, but notes that researchers already have access to BLS data and severe injury data. OSHA has determined that the best use of the agency's resources at this time is full utilization of 300A and severe injury data, not providing 300 and 301 data to researchers despite the uncertain incremental benefits of the data to OSHA and especially when OSHA itself will continue to protect workers by accessing Forms 300 and 301 through on-site inspections and for specific enforcement actions as needed.

With respect to the remaining potential benefits for enforcement identified by the commenters, OSHA simply notes that those benefits are uncertain, and collecting and utilizing these data would be costly. OSHA cannot justify diverting resources from fully utilizing 300A data and severe injury data, which OSHA's experience has shown to be useful for enforcement and compliance assistance, to collect data with uncertain benefits to OSHA's core mission.

NIOSH and other commenters stated that the data from Forms 300 and 301 could be used for future research to identify patterns and trends across workplaces that could be masked by aggregated, summary data from Form 300A. (Document ID 2003-A2, pp. 6-7; 2007-A1, p. 4). In addition, the NAS report echoed a number of the benefits of collection identified by some commenters, including research for surveillance and prevention purposes, employer benchmarking, employee assessment of safety and health conditions at various workplaces, and intervention and education by public health agencies. (Document ID 1965-A1, pp. 177-179). The NAS report suggests that electronic collection of Form 300 and 301 data would supplement BLS Survey of Occupational Injuries and Illnesses (SOII) data, letting OSHA focus its interventions and prevention efforts on hazardous industries, workplaces, exposures, and high-risk groups. (Document ID 1965-A1, p. 179). According to the report, collecting the Form 300 and 301 data would allow for expanding and targeting outreach to employers, particularly smaller employers, to improve hazard identification and prevention efforts, and would give OSHA the opportunity to advise employers on how their rates of injury and illness compare with the rest of their industry. (Document ID 1965-A1, p. 178).

OSHA will continue to work with NIOSH, other government agencies, and interested stakeholders to share information and leverage efficiencies to reduce workplace injuries and illnesses as appropriate. And while OSHA appreciates the findings and recommendations of the NAS Report that commenters identified, the approaches suggested by NAS would require substantial investment of time and money to develop. OSHA has determined that at this juncture, the protection of worker safety and health will best be furthered by allocating its resources in more concrete ways in which OSHA can more fully draw on its existing experience, such as utilizing the 300A and severe injury data it is already collecting and analyzing for enforcement and compliance assistance activities.

Several commenters pointed out ways in which OSHA has used Forms 300 and 301 and similar data in the past to further its mission of ensuring safe and healthy workplaces. (E.g., Document ID 2003-A2, pp. 6-7; 2012-A1, pp. 3-4). For example, commenters asserted that OSHA has previously analyzed Form 300 and 301 data from multiple workplaces to identify frequently-recurring injuries and to better protect workers' safety and health, and used information from severe injury reports to understand injury causation and to inform the agency's compliance assistance and outreach efforts. (Document ID 2012-A1, pp. 3-4; 2003-A2, pp. 6-7). Employers have had to submit severe injury reports, containing information similar to what is included on Form 301, to OSHA since 2015. (Document ID 2003-A2, p. 6). To the extent OSHA has evaluated small batches of similar data in the past to further its mission of protecting worker safety and health, commenters suggest that a broader collection could be similarly useful.

OSHA agrees that data from Forms 300 and 301 and similar data can be helpful, but disagrees that its past experience justifies the broad collection envisioned in 2016. As NIOSH acknowledged in its comment, the volume of Form 300 and 301 data employers were required to submit under the 2016 final rule would far exceed the number of severe injury reports OSHA receives. (Document ID 2003-A2, p. 6). Collecting and using a high volume of data—without the relevancy filters imposed by severe injury reports or on-site inspections—would require substantial resources to process and analyze. OSHA has determined that, at the current time, the resources OSHA would need to devote to developing that capacity and determining best how use the data would better achieve the mission of the agency by being allocated to full utilization of the 300A and severe injury data. OSHA will thus continue to obtain and use data from Forms 300 and 301 from employers as needed for on-site inspections and specific enforcement actions, as has proven helpful in the past.

Moreover, as OSHA notes elsewhere in this preamble, before making 300 and 301 records requested on an ad hoc basis or severe injury reports public, the agency manually screens all of those records for PII and data that could re-identify workers. But the sheer volume of the data, which is expected to come from over 775,000 reports, would make the costs to manually screen all of the 300 and 301 data enormous; OSHA believes those resources are better allocated to activities closer to OSHA's core enforcement mission. One commenter suggested that collecting the data from Forms 300 and 301 electronically would benefit workers by allowing them access to these records without fear of retaliation for requesting the records from their employers. (Document ID 2083-A1, p. 2). But OSHA notes that workers have a right under 29 CFR 1904.35 to access their own employers' 300 and 301 data, and Section 11(c) of the OSH Act, 29 U.S.C. 660(c), prohibits employers from retaliating against workers for exercising that right. Another commenter asserted that a worker's medical provider could benefit from OSHA's electronic collection and publication of 300 and 301 data and using the data to assess conditions at the relevant workplace. (Document ID 2010-A2, p. 4) (commenting on the 2013 NPRM). But OSHA again notes that workers retain the right to access 300 and 301 data from their own employers and share it with their medical providers.

After considering these comments, OSHA has determined that because it already has systems in place to use the 300A data for enforcement targeting and compliance assistance without impacting worker privacy, and because the Form 300 and 301 data would provide uncertain additional value, the Form 300A data are sufficient for enforcement targeting and compliance assistance at this time. OSHA will continue to request copies of Forms 300 and 301 during its inspections, and make use of data from severe injury reports, as appropriate.

Collecting and Processing the 300 and 301 Data Would Divert Agency Resources From Higher Priority Initiatives

As OSHA stated in the NPRM, electronically collecting and taking steps necessary to try to use Form 300 and 301 data would require the agency to divert resources from other priorities, including the analysis of Form 300A data. As explained above, OSHA has already collected summary 300A data from 214,574 establishments, and expects that volume to increase. OSHA is seeking to fully utilize these data, and has designed and implemented a targeted enforcement mechanism for industries experiencing higher rates of injuries and illnesses. OSHA likewise evaluates severe injury reports, which it receives shortly after accidents, to target its enforcement and compliance-assistance efforts.

Many commenters agreed that OSHA would need to significantly increase or divert its resources from other priorities to collect, process and analyze the electronically submitted Form 300 and 301 data. (E.g., Document ID 2008-A1, p. 2; 2019-A1, pp. 2, 6-7, 9-10; 2044-A1, p. 6 (citing 83 FR at 36496)). Some noted that, without diverting resources from other priorities, OSHA might not be able to analyze and use the data as it intended when it finalized the 2016 final rule (Document ID 2070-A1, p. 9), and that OSHA already has access to other data sources it can analyze and more potential violators than it can investigate with its resource constraints (Document ID 2055-A1, p. 2). By rescinding the requirement to collect electronically Form 300 and 301 data, OSHA will better focus on pre-existing, successful enforcement efforts. (E.g., Document ID 2044-A1, p. 6; 2075-A1, p. 4). Commenters also agreed with OSHA that the uncertain benefits of requiring employers to electronically submit Forms 300 and 301 do not outweigh the costs and burdens to OSHA and employers and the risk to worker privacy. (E.g., Document ID 1985-A1, p. 1; 2008-A1, p. 2; 2024-A1, p. 1).

Other commenters suggested that requiring electronic submission of the Form 300 and 301 data would help OSHA allocate its resources and identify injury trends, their causes, and emerging hazards to improve its enforcement and outreach efforts beyond what OSHA can accomplish with the 300A data. (E.g., Document ID 1929; 1961-A1, pp. 1-2; 2007-A1, pp. 1-5; 2011-A1, p. 6; 2054-A1, pp. 1,6-7, 8-9). One commenter theorized that having access to the detailed information contained in Forms 300 and 301, rather than simply the summary data from Form 300A, can improve OSHA's use of its enforcement resources to target the highest priority issues. (Document ID 2007-A1, p. 5). But these commenters provide no evidence to support their claims, and OSHA finds none in the record. OSHA's own experience with using Form 300 and 301 data is insufficient to support these theories. These commenters' speculation therefore does not alter OSHA's view that diverting OSHA's focus from longstanding and successful agency priorities is not justified to achieve the uncertain benefits of electronically collecting data from Forms 300 and 301.

Commenters pointed to OSHA's statements in the 2016 final rule that collecting data from Forms 300 and 301 would allow the agency to leverage its resources to execute its mission by helping its compliance assistance programs, encouraging employers and workers to identify and address workplace hazards to avoid the perception of being an unsafe place to work, and providing data to employers, workers, unions and academics that would assist them in researching and innovating to improve workplace safety and health. (Document ID 2007-A1, p. 3; 2017-A1, p. 2). Although OSHA identified these potential benefits, OSHA never quantified them. This final rule does not ignore those prior statements or the possibility that benefits could result from collecting the data, but concludes that the scope of any such benefits is uncertain. OSHA does not believe that these uncertain benefits justify the diversion of OSHA's resources from other agency initiatives with a proven record of effectiveness.

Some commenters asserted that a recent Office of the Inspector General (OIG) report auditing OSHA's fatality and severe injury reporting program (OIG, Dep't of Labor, OSHA Needs to Improve the Guidance for Its Fatality and Severe Injury Reporting Program to Better Protect Workers, 02-18-203-10-105 (OIG report), available at: https://www.oig.dol.gov/public/reports/oa/viewpdf.php?r=02-18-203-10-105&y=2018 ) demonstrates a need for improved reporting, noting that the OIG report concluded employers underreport fatalities and severe injuries by as much as 50 percent. (E.g., Document ID 2017-A1, p. 2; 2051-A1, p. 3). Commenters noted that the OIG report found that OSHA cannot effectively target compliance and enforcement efforts without complete information on work-related fatalities and severe injuries. (E.g., Document ID 2051-A1, p. 3; 2089-A1, p. 2). Another commenter suggested that the collection and publication of data from Forms 300 and 301 would create “publicly available checks” and increased accountability for employers. (Document ID 2062-A1, p. 2).

OSHA disagrees that the OIG report indicated a need to collect more injury and illness data. Rather, the report recommends that OSHA take steps to better enforce and implement the severe injury reporting requirements. (OIG report, p. 1). Specifically, the OIG recommended that OSHA (1) develop and provide guidance to staff to detect and prevent underreporting; (2) consistently issue citations for underreporting; (3) clarify guidance for documentation of OSHA's essential decisions, evidence required to demonstrate abatement by the employer, and requirements for monitoring employer-conducted investigations; and (4) emphasize the importance of conducting inspections for incidents that resulted in a fatality, two or more in-patient hospitalizations, emphasis programs, or imminent danger. (OIG report, p. 15). OSHA is committed to implementing these recommendations as indicated in OSHA's formal response to the report, (OIG report, pp. 21-23), and OSHA has determined such implementation is more likely to address OIG concerns than electronically collecting Forms 300 and 301.

OSHA will use the OIG report's findings to shape and improve its severe injury reporting objectives. Indeed, this rulemaking seeks to improve OSHA's capacity to direct its resources to current initiatives such as implementing the severe injury reporting requirements, rather than collecting new data with uncertain benefits. OSHA's current priorities include fully utilizing the data from the Form 300As and severe injury reports it is already collecting to improve its enforcement and outreach objectives to ensure compliance with the OSH Act. Again, investing in a program to collect, process, and analyze data from hundreds of thousands of Forms 300 and 301 would constrain OSHA's ability to achieve these and other priority enforcement goals.

Regarding the suggestion that collection and publication of data from Forms 300 and 301 might increase compliance with electronic reporting requirements (Document ID 2062-A1, p. 2), OSHA finds it can better hold employers accountable through the appropriate allocation of resources to enforcement efforts and compliance assistance, rather than collecting data with uncertain benefits. This commenter provides no evidence for the speculative suggestion that publication of the data would create an incentive for employers to report fatalities and severe injuries. (Document ID 2062-A1, p. 2).

Collecting 300/301 Data Could Lead to Less Accurate Records

Commenters expressed concern that requiring employers to report electronically the data from Forms 300 and 301 could have a negative impact on accurate recordkeeping. For example, some employers may not prepare Forms 300 and 301 accurately for fear that the information would become public and cause reputational harm or subject them to targeted OSHA inspections. (Document ID 2019-A1, p. 7; 2044-A1, p. 34 (commenting on 2013 NPRM); 2055-A1, p. 2). Commenters also indicated that employers fear that publishing Form 300 and 301 data will expose confidential and proprietary information to their competitors and adversaries. (Document ID 2070-A1, pp. 9-10; 2076-A1, pp. 6-7). For example, public disclosure of location information may allow competitors to determine confidential business locations or acquisitions that have not been publicized, or publication of the substances or chemicals that were involved in injuries and illnesses may identify products, inventions, or proprietary technologies that are in research and development. (Document ID 2070-A1, pp. 9-10). The collection's focus on lagging indicators, which measure past safety performance, also may not be representative of a company's current safety efforts. (Document ID 2044-A1, p. 30) (commenting on 2013 NPRM). One commenter explained that Forms 300 and 301 are most useful to the employer when they contain robust information about the details of workplace injuries and illnesses, but that employers will have incentives to sanitize their reports if they believe they will become public, and be mischaracterized, as a result of electronic submission to OSHA. (Document ID 2019-A1, p. 7).

Commenters also noted that workers may be reluctant to report accurately their data for Forms 300 and 301 for fear that the details of their reports will become public and reveal their private information. (Document ID 2030; 2085-A8, p. 8 (commenting on 2013 NPRM)). One commenter noted that the Confidential Information Protection and Statistical Efficiency Act of 2002 requires BLS to keep this kind of data confidential. (Document ID 2053-A1, p. 2). In enacting the CIPSEA, Congress found that ensuring the confidentiality of sensitive information submitted to the government “is essential in continuing public cooperation in statistical programs.” (Pub. L. 107-347 sec. 511(a)(5)). While the CIPSEA applies to BLS, not OSHA, OSHA shares Congress's concern that fear of sensitive information becoming public could undermine accurate reporting.

Other commenters expressed concern that employers will hide workplace injuries if they are not required to file Forms 300 and 301 electronically. (Document ID 1976-A1, p. 1; 1996-A1, p. 1; 1999-A1, p. 1; 2002-A1, p. 1). OSHA finds these comments to be speculative and unsupported by its experience reviewing Forms 300 and 301 through on-site inspections. OSHA also does not find that requiring employers to submit their 300 and 301 data electronically would motivate them to report injuries and illnesses they otherwise would not have recorded. One commenter noted that the cost to large employers of submitting their 300 and 301 data was not burdensome because compliance would have cost approximately $258.34 per establishment per year, which would be an average of less than one dollar per employee per year. (Document ID 2012-A1, p. 12). Although OSHA acknowledges that the requirement to submit data from Forms 300 and 301 to OSHA would have been economically feasible for large employers, OSHA's central rationale for rescinding these requirements is not to reduce employer costs but rather to protect worker privacy and to direct agency resources towards fully utilizing the data it is already collecting to advance improvements to health and safety for workers.

OSHA has determined that publishing the data could also cause more harm than good. Workers would know in advance that some details of their injuries would be public and on the internet. Deterring worker reporting through fear of publication could make the records less accurate. And, because employers are required to report workplace injuries and illnesses regardless of fault, OSHA no longer considers collection of employers' injury and illness records likely to “nudge” them to make their workplaces safer, which OSHA identified in 2016 as a benefit of publishing the 300 and 301 data. (See 81 FR 29629; Document ID 2007-A1, pp. 4-5). OSHA finds that the final rule may ensure more accurate records on Forms 300 and 301 by alleviating employers' and workers' fears about the consequences of the records becoming public, and will allow employers to devote more of their resources towards compliance with safety and health standards.

State Plan Issues

In the NPRM, OSHA noted that, pursuant to section 18 of the OSH Act (29 U.S.C. 667) and the requirements of 29 CFR 1904.37 and 1902.7, within 6 months after publication of the final OSHA rule, state-plan states must promulgate occupational injury and illness recording and reporting requirements substantially identical to those in 29 CFR part 1904. (83 FR at 36505). All other injury and illness recording and reporting requirements (for example, industry exemptions, reporting of fatalities and hospitalizations, record retention, or employee involvement) that are promulgated by state-plan states may be more stringent than, or supplemental to, the federal requirements, but, because of the unique nature of the national recordkeeping program, states must consult with OSHA and obtain approval of such additional or more stringent reporting and recording requirements to ensure that they will not interfere with uniform reporting objectives under 29 CFR 1904.37 and 1902.7. (See 83 FR at 36505).

Some commenters responded to this section of the NPRM with concerns that centralized, federal collection is the most efficient and cost-effective way to compile detailed data for enforcement and prevention, and that the analysis of small, discrete quantities of data from multiple state databases will make important trends less apparent. (Document ID 2062-A1. p. 1; 2028-A1, pp. 5-6; 1965-A1, pp. 6-7). Commenters theorized that the detailed reporting requirements of the prior final rule would have enabled both federal OSHA and state plans to target their prevention and enforcement measures at particular employers and industries. (Document ID 2028-A1, p. 3; 2046-A1, p. 2).

Commenters also asserted that, as a result of this final rule, some states would have to set up separate reporting systems at significant cost to maintain reporting requirements consistent with the prior final rule. (Document ID 2028-A1, p. 5; 2088-A1, p. 13). The California Department of Industrial Relations is in favor of the reporting requirements of the prior final rule because national collection would be more efficient than state-by-state collection, among other reasons. (Document ID 2062-A1, p. 3). Commenters also pointed out that some state-level agencies, such as the Washington State Department of Labor and Industries (“WA L&I”), have gathered detailed data through their workers' compensation system and collaborated with NIOSH in analyzing the data to inform targeted enforcement strategies. (Document ID 1993-A1, p. 1; 1965-A1, pp. 57-59). One commenter pointed to the NAS Report, which noted that “only 20 percent of states reported having substantial epidemiologic and surveillance capacity in occupational health” and concluded that this lack of surveillance capacity “results . . . in . . . missed opportunities for collaboration across public health domains to address convergent public health concerns that affect workers as well as the general public.” (Document ID 1965-A1, p. 122 (NAS Report)). One group of commenters expressed concern that OSHA's consultation requirement would make it harder for states to implement such systems and noted that states without state plans or with state plans limited to public sector workers will not have the opportunity to have access to detailed data like that required by the prior rule. (Document ID 2028-A1, pp. 5-6).

As OSHA noted in the NPRM, the effectiveness of the Form 300 and 301 data as an enforcement and prevention tool in advancing worker safety is unclear. The suggestion that the data would be useful to states without state plans (Document ID 2028-A1, pp. 5-6), is speculative, as OSHA has determined that the benefits of collecting such data on a national scale are uncertain and do not outweigh the collection's burdens and costs. (83 FR at 36498). OSHA finds that the Form 300A collection adequately serves its enforcement purposes at this time without jeopardizing worker privacy, and OSHA is committed to sharing these data with state-plan states, including those covering only public sector workers. OSHA cannot justify collecting Form 300 and 301 data where the data's usefulness is unclear. (83 FR at 36498).

OSHA disagrees that this final rule would necessarily hinder states in implementing their own requirements for collection of Form 300 and 301 data. As OSHA explained in the NPRM, the rule does not preempt state law. (83 FR at 36505). The consultation requirement is not intended to limit state plans to strict conformity with the rule but rather to aid states in avoiding interference with OSHA's unique recordkeeping program. There is no evidence in the record that individual state collection of Form 300 and 301 data would cause such interference. To the extent some state agencies, such as WA L&I, have already collected similar data, this shows that some states have mechanisms to collect the data they need without OSHA's collecting electronically the Form 300 and 301 data. If state agencies determine that a detailed data collection system is best for their states, then they may pursue such a system in consultation with OSHA.

OSHA acknowledges that systems to collect this volume of data would be costly for states to implement. Centralized collection might be more efficient and cost-effective than state-by-state collection, but OSHA has doubts about the usefulness of the data and concerns about the costs of collection as noted elsewhere in this preamble. States are empowered to do as OSHA has and weigh the substantial costs of collection against the likely utility of the data. OSHA also notes, in response to a comment that some states have more limited surveillance capacity than others (Document ID 1965-A1, p. 57), that those states will have access to the summary data collected by OSHA, and that OSHA itself must appropriately allocate its resources for surveillance to best serve OSHA's mission of protecting all workers. States are empowered to share the data gathered at the state level at their discretion and consistent with any applicable laws. In promulgating this rule, OSHA erects no barrier to communication among state agencies.

B. New Requirement To Include Employer Identification Number With Injury and Illness Data Submitted to OSHA Electronically Under 29 CFR 1904.41

The NPRM included a provision that would require covered employers to submit their Employer Identification Number (EIN) electronically along with their injury and illness data submission in the proposed rule. (83 FR at 36494). OSHA explained that it had limited the proposed data collection in its 2013 NPRM (78 FR 67254) to Improve Tracking of Workplace Injuries and Illnesses to records that employers were already required to collect under part 1904. Accordingly, the May 2016 final rule only required the electronic submission of such records. These records do not include the employer's EIN.

After collecting and analyzing the first year of data (i.e., Calendar Year 2016 Form 300A data), however, OSHA and BLS realized that collecting EINs could help the agencies make full use of the data collected. The proposed EIN submission requirement grew out of that realization. As the agency explained in the proposal, this change could have a number of benefits. (83 FR at 36499-500). For example, OSHA posited that collecting EINs would increase the likelihood that BLS would be able to match data collected by OSHA under the electronic reporting requirements in 29 CFR part 1904 to data collected by BLS for the Survey of Occupational Injury and Illnesses (SOII). The ability to accurately match the data is critical for evaluating how BLS might use OSHA-collected data to supplement the SOII, which in turn would enhance the ability of OSHA and other users of the SOII data to identify occupational injury and illness trends and emerging issues. Furthermore, the ability of BLS to match the OSHA-collected data also has the potential to reduce the burden on employers who are required to report injury and illness data both to OSHA (for the electronic recordkeeping requirements in part 1904) and to BLS (for the SOII).

OSHA also noted in the proposal that without the EIN, there is no methodological approach to match completely the establishments that submit data through both OSHA's collection of injury and illness data under § 1904.41 and the BLS data collection for the SOII. BLS cannot provide its collected data to OSHA because the Confidential Information Protection and Statistical Efficiency Act of 2002 (Pub. L. 107-347, 116 Stat. 2899 (2002)) prohibits BLS from releasing establishment-specific data to either OSHA or the general public. (83 FR at 36500). Although OSHA can provide the data it collects to BLS, without the EIN it is very difficult to match the establishments in OSHA's data collection to the establishments in BLS's data collection. Not having the EIN increases the resources necessary to match the data and reduces the accuracy of the match.

OSHA further explained its preliminary determination that including the EIN in the electronic reporting to OSHA would improve BLS's ability to match accurately the OSHA-collected data with the SOII data. (83 FR at 36500). OSHA suggested that, after evaluation of the accuracy of the data matching, it might be possible for BLS to use the OSHA-collected data to generate occupational injuries and illnesses estimates, reducing burden on employers by decreasing duplicative reporting. If the EIN is not collected and the data from the two sources cannot be accurately matched, reducing this burden becomes nearly impossible.

Finally, OSHA suggested that including the EIN as part of electronic reporting could improve the quality and utility of the collected data. (83 FR at 36500). For example, OSHA noted that it could use the EIN to identify errors such as multiple submissions of data from the same establishment and to link multiple years of data submissions from the same establishment. (83 FR at 36500). The agency also observed that the EIN could be used to match against other databases that contain this identifier to add additional characteristics to the data. (83 FR at 36500). For example, OSHA routinely collects the employer's EIN during an inspection and enters the EIN into the OSHA Information System (OIS). OSHA noted in the proposal that Form 300A submissions with an EIN could be linked to the OIS to identify the previous enforcement history of the establishment when the inspection records contain the EIN. (83 FR at 36500).

In the proposal, OSHA also noted that EINs do not have the same level of protection as Social Security numbers. (83 FR at 36500). In fact, many employers' EINs are available in a variety of public sources, including filings with the U.S. Securities and Exchange Commission, the Federal Communications Commission's Commission Registration System, and the DOL's Employee Benefits Security Administration. (83 FR at 36500). Businesses also have to share EINs with contractors and clients for tax reporting, such as filing an IRS Form 1099. (83 FR at 36500). As a result, OSHA explained, the Department has not generally withheld EINs from disclosure. (83 FR at 36500).

OSHA asked stakeholders to comment on its proposal to add the EIN submission requirement generally. (83 FR at 36499). The agency also specifically invited public comment on the advantages and disadvantages of requiring employer submission of EINs and on whether employers required to electronically report information to OSHA under part 1904 would consider the EIN to be exempt from disclosure, either as confidential business information or for another reason. (83 FR at 36500). In addition, OSHA asked if there were any circumstances where the EIN would be considered PII and whether there were privacy concerns that might arise from employers submitting their EIN. (83 FR at 36500).

Commenters submitted a number of comments in response to OSHA's request. These comments generally fall into three categories: (1) Comments related to the benefits of collecting EINs, (2) comments focusing on whether an employer's EIN is commercially confidential or sensitive, and (3) comments suggesting alternatives to the agency's proposal that might achieve the agency's goal of reducing respondent burden and increasing the utility of the data collected, without the submission of EINs. Each of these issues, commenters' submissions, and the agency's final determinations are laid out in more detail below.

Benefits of Collecting the EIN

As discussed above, OSHA preliminarily determined that collecting EINs would have a number of benefits, including streamlining reporting for employers who are required to report injury and illness data both to OSHA and BLS, improving the agencies' ability to match their data, and improving the quality and utility of the collected data. (83 FR at 36499-500). OSHA received many comments on the benefits of collecting the EIN.

Many commenters agreed with OSHA that collection of the EIN would enhance the utility of the data and therefore improve worker safety and health. (E.g., Document ID 2012-A1, p. 15). Several commenters provided specific examples of how the EIN can be used by OSHA for research purposes, such as identifying employers with patterns of injuries (E.g., Document ID 2015-A1, p. 7) and matching against other databases that contain the EIN to add characteristics to the data. (E.g., Document ID 2003-A2, p. 7). Several commenters also noted that using the EIN to enhance research is consistent with recommendations from the NAS Report. (E.g., Document ID 2003-A2, p. 7). Still other commenters observed that collecting EINs would allow OSHA to improve the quality and utility of the data collected, and provided many examples of the benefits associated with having this data element. (E.g., Document ID 2088-A1, p. 14; 2012-A1, p. 15; 2003-A2, p. 7). For example, some commenters noted that adding the EIN would enhance the value of the data for enforcement and compliance assistance by allowing OSHA to identify the relationship between establishments rather than having to rely on company names that can be similar across different businesses. (E.g., Document ID 2007-A1, pp. 8-9; 2012-A1, p. 15; 2074-A1, p. 5).

Many commenters also agreed with OSHA that collecting the EIN along with data submissions under part 1904 could potentially reduce duplicative reporting for employers that are also required to submit data both to BLS under the SOII. (E.g., Document ID 2088-A1, p. 14; 2036-A1, p. 8). Several commenters noted that using the EIN to reduce duplication of burden is consistent with the NAS report. (E.g., Document ID 2085-A1, p. 20).

Other commenters, however, disagreed, observing that there “appears to be little value to OSHA gained in collecting the EIN.” (Document ID 2084-A2, p. 5).

After carefully reviewing all the comments submitted on this subject, OSHA finds that collection of the EIN will result in the benefits detailed by commenters. Having this common identifier will help OSHA understand exactly which establishment the Form 300A data represents, link establishments between databases, and track data over time. The difficulties involved in matching and tracking establishments by name and address introduce uncertainty which in turn reduces the utility of the data collected. A numerical identifier that is common over time and between databases eliminates these uncertainties. Collecting the EIN is also an essential first step towards eliminating duplicative reporting to OSHA and BLS in the future. In short, collection and use of the EIN presents the most practical and efficient solution for matching and linking the BLS and OSHA data sets and at the same time increases the utility and accuracy of the data within OSHA's data set.

Sensitivity of the EIN

Although nearly all of the commenters who opined on the potential benefits of collecting the EIN agreed with OSHA that the collection would be beneficial, a number of commenters argued that any benefits to OSHA in collecting the EIN were outweighed by the risks if the EIN is publicly disclosed. (Document ID 2064-A1, p. 2). For example, some commenters expressed concern about the commercial sensitivity of the EIN and the potential for fraud. (E.g., Document ID 2057-A1, p. 5). Some commenters maintained that the EIN was confidential business information comparable to a Social Security number. (E.g., Document ID 2041-A1, p. 2; 2066-A1, p. 2). One commenter stated that it did not object to OSHA's proposal to include EINs with Form 300A filings, provided that OSHA maintains this information as confidential. (Document ID 2049-A1, p. 2).

Others, though not claiming that the EIN was confidential commercial information, nonetheless asserted that collecting the EIN could harm businesses and that such harm outweighed any benefits of collection. (E.g., Document ID 2084-A2, p. 5; 2039-A1, p. 3). For example, one commenter asserted that employers are concerned about making EINs more widely available through FOIA requests “given the high potential for fraud. For example, a 2013 audit by the U.S. Department of the Treasury identified 767,071 corporate tax returns with potentially fraudulent refunds totaling almost $2.3 billion due to stolen and falsely obtained EINs.” (Document ID 2057-A1, p. 5). Commenters also stated that the risk of bad actors causing “irreparable harm” through malicious use of the EIN “far outweighs the issues involved in duplicative reporting.” (Document ID 2039-A1, p. 3; see also Document ID 2084-A2, p. 5; 2064-A1, p. 2).

Other commenters conceded that the EIN was not commercially confidential and did not oppose OSHA's proposal to collect the EIN with injury and illness data. (E.g., Document ID 2036-A1, p. 8; 2070-A1, p. 17). For example, Mark Dreux of the Corn Refiners Association (CRA) stated: “Because employers are required to disclose their EINs in many different contexts . . . CRA's members do not consider it to be confidential or proprietary business information.” (Document ID 2036-A1, p. 8). Consequently, CRA indicated that its members did not have any concerns with the proposed requirement to submit EINs in conjunction with injury and illness data to facilitate the exchange of data between OSHA and BLS. (Document ID 2036-A1, p. 8). In fact, CRA's members agreed with OSHA that “the submission of employers' EINs will simplify and avoid duplicative reporting of information between the two agencies.” (Document ID 2036-A1, p. 8; see also Document ID 2070-A1, p. 17). Other employers simply noted that they did not object to collection of EINs. (E.g., Document ID 1930-A1, p. 5). There were no comments that claimed the EIN is Personally Identifiable Information (PII). Several commenters specifically stated that it is not PII. (E.g., Document ID 1969; 2070-A1, p. 17).

After reviewing these comments, OSHA concludes that the EIN is not confidential commercial information, nor is it too sensitive to collect with injury and illness data. The EIN is a government-issued number (thus, not commercial), and as discussed above, many commenters conceded that EINs are routinely made public (thus, not confidential). Many companies must include their EINs on public filings or in filings that are later disclosed in response to FOIA requests. (See 83 FR at 36500). For these reasons, OSHA has determined the EIN is not too sensitive to collect given the possibility of release to the public under FOIA.

OSHA also reviewed the Treasury Inspector General for Tax Administration's 2013 report, Stolen and Falsely Obtained Employer Identification Numbers Are Used to Report False Income and Withholding, referenced in a comment (see Document ID 2057-A1, p. 5). The report does not indicate any harm done to the legitimate business owners of the stolen EINs. While the report shows that tax fraud involving misused EINs exists, it does not provide any indication that collection of the EIN by OSHA would put employers at increased risk or exacerbate the problem of false tax returns. OSHA does not agree that the findings of this report are relevant to the agency's collection of the EIN with injury and illness data.

Alternative Proposals and Miscellaneous Issues

Several commenters encouraged OSHA to seek and use alternative methods to achieve the goal of reducing respondent burden and increasing the utility of the data collected without collecting the EIN, such as exploring technological approaches to resolve the duplication issue (Document ID 2039-A1, p. 3), and others suggested that OSHA should not need the EIN “to determine whether it has correct information when comparing it with [BLS].” (Document ID 2073-A1, p. 2). One commenters suggested that OSHA should delay collection of the EIN “unless there is relative certainty that the data can and will be used for its intended purpose.” (Document ID 2019-A1, p. 8).

OSHA agrees that further collaboration with BLS to identify methods for reducing respondent burden is vital. Collection and use of the EIN presents the most practical and efficient solution for matching and linking the two agencies' separate data sets at this time. OSHA does not agree that a delay in the collection is warranted. The benefits of having these data are clear, as discussed above. Any delay in the collection of the EIN would delay the reduction in respondent burden and increased utility of the Form 300A data collected.

The final rule requires employers to provide the EIN of their establishments when submitting their injury and illness data. As discussed above, evidence in the docket shows the EIN is a widely available public record. Employers routinely made their EIN available to both government and private entities, and OSHA already collects and stores EINs in its inspection records. OSHA concludes the collection and storage of the EINs through the ITA will pose minimal adverse effects to establishments that provide these data. At the same time, OSHA concludes the benefits of collecting these data are substantial. Having the EIN will increase the utility of the data by both BLS and OSHA and may reduce the burden on employers that are required to respond to both the BLS and OSHA data collections. OSHA will continue to collaborate with BLS to identify technological approaches to reduce respondent burden, including exploring changes to both data collection systems and real-time sharing of OSHA data with BLS.

Compliance Dates

The requirement to include the EIN for each establishment submitting injury and illness data under 29 CFR 1904.41 will become effective on February 25, 2019. The compliance date for this provision is March 2, 2020. The EIN will therefore be required for covered establishments submitting their 300A data from 2019, but not for covered establishments submitting their 300A data from 2018, which have to be submitted by March 2, 2019.

IV. Final Economic Analysis and Regulatory Flexibility Certification

A. Introduction

Executive Orders 12866 and 13563 require that OSHA estimate the benefits, costs, and net benefits of proposed and final regulations. Executive Orders 12866 and 13563, the Regulatory Flexibility Act (5 U.S.C. 601-612) and the Unfunded Mandates Reform Act (UMRA) (2 U.S.C. 1501-1571) also require OSHA to estimate the costs, assess the benefits, and analyze the impacts of certain rules that the agency promulgates. Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety, and other effects; distributive impacts; and equity). Executive Order 13563 emphasizes the importance of quantifying both costs and benefits, reducing costs, harmonizing rules, and promoting flexibility.

In its preliminary economic analysis (PEA) in the proposal, OSHA estimated that this rule would have net cost savings of $8.28 million per year at a 3 percent discount rate, including $8.23 million per year for the private sector and $52,754 per year for the government. Annualized at a 7 percent discount rate, OSHA estimated that the proposed rule would have net cost savings of $8.25 million per year, including $8.18 million per year for the private sector and $64,070 per year for the government. Annualized at a perpetual 7 percent discount rate, the estimate rose to net cost savings of $8.35 million per year. The agency stated its belief that the electronic collection of information in the Forms 300 and 301 poses risks to worker privacy and additional cost to employers and OSHA that outweigh the uncertain enforcement benefits of collecting that information. (83 FR at 36501).

In this final economic analysis, OSHA estimates that the rule would have net cost savings of $15.9 million per year at a 3 percent discount rate, including $8.4 million per year for the private sector and $7.5 million per year for the government. Annualized at a 7 percent discount rate, the rule would have net cost savings of $15.86 million per year, including $8.37 million per year for the private sector and $7.5 million per year for the government. Annualized at a perpetual 7 percent discount rate, the rule would have net cost savings of $16million per year. The agency has determined that the rescission of the requirement to submit electronically the Forms 300 and 301 data will benefit worker privacy by preventing routine government collection of information that may be quite sensitive, including descriptions of workers' injuries and the body parts affected. OSHA has determined that, at this time, avoiding this risk to worker privacy outweighs the uncertain incremental benefits to enforcement gained from electronically collecting the data. In addition, the rule will allow OSHA to focus its resources on the collection of 300A data and the data provided through the new serious injury and illness reporting system.

OSHA finds that the new requirement for establishments to submit their EIN will help both OSHA and BLS make full use of the data the agencies collect. Collecting the EIN is helpful to understanding exactly which establishment the Form 300A data represents, linking establishments between databases, and tracking data over time. The difficulties involved in matching and tracking establishments by name and address introduce uncertainty, which in turn reduces the utility of the data collected. A numerical identifier that is common over time and between databases eliminates these uncertainties. Collecting the EIN is also a positive first step towards eliminating duplicative reporting to OSHA and BLS in the future. In short, OSHA concludes that collection of the EIN presents the most practical and efficient solution for matching and linking the BLS and OSHA data sets and at the same time increases the quality and utility of the collected data.

The final rule is not an “economically significant regulatory action” under E.O. 12866 or UMRA (2 U.S.C. 1532(a)), and it is not a “major rule” under the Congressional Review Act (CRA) (5 U.S.C. 801 et seq.). The agency estimates that the rulemaking imposes far less than $100 million in annual economic costs. In addition, it does not meet any of the other criteria specified by UMRA or CRA for a significant regulatory action or major rule. The final rule is a deregulatory action under Executive Order 13771 (82 FR 9339 (January 30, 2017)).

The final rule will make two changes to the existing recording and reporting requirements in part 1904. First, OSHA will eliminate the requirement for establishments that are required to keep injury and illness records under part 1904, and that had 250 or more employees in the previous year, to electronically submit information from OSHA recordkeeping Forms 300 and 301 to OSHA or OSHA's designee, on an annual basis. Second, OSHA will require covered employers to submit their EIN electronically along with other injury and illness data they are required to submit to OSHA. These changes in existing requirements are identical to those included in the proposal. The final rule does not make any other changes to an employer's obligations regarding injury and illness records.

In the subsections below, OSHA will first examine the cost savings, costs, net cost savings, and benefits of the activities outlined above, including a discussion of the comments submitted on these topics. The agency will then turn to its economic feasibility finding and its certification under the Regulatory Flexibility Act.

B. Cost Savings

As discussed in more detail below, OSHA preliminarily estimated that the proposed elimination of the requirement that establishments with 250 or more employees submit information electronically from their OSHA Forms 300 and 301 would result in cost savings to employers and to the government. (See 83 FR at 36501-02). Numerous commenters responded that businesses are already required to keep these data and that reporting the data to OSHA was not a costly additional requirement. (E.g., Document ID 1943; 1945; 1947; 2077-A1, p. 2). One commenter stated that making the data from Forms 300 and 301 available “is a reasonable cost of doing business.” (Document ID 1942). None of these comments challenged OSHA's specific cost estimates; rather, they simply asserted that the costs were not substantial. OSHA's estimate of the cost savings to employers from eliminating the requirement to submit the data from Forms 300 and 301 is consistent with OSHA's finding in 2016 regarding the incremental cost of submitting these data. And, as detailed earlier in this preamble, even though any related costs may be minor for larger employers, OSHA has decided to rescind the requirement to submit the data from Forms 300 and 301 primarily to protect sensitive worker information from the risk of public disclosure, and to focus its resources on fully utilizing the 300A data and severe injury reports OSHA already collects rather than diverting resources from those efforts given the uncertain extent of any incremental benefits the 300 and 301 data would have for OSHA's enforcement and outreach activities.

For the PEA, OSHA relied on the Final Economic Analysis (FEA) in the May 2016 final rule (see 81 FR at 29674-87), updated to include more recent data and some modifications in OSHA's methodology. OSHA obtained the estimated cost of electronic data submission by multiplying the compensation per hour of the person expected to perform the task of electronic data submission by the time required to submit the data. (83 FR at 36501).

In the PEA, as in the 2016 FEA, OSHA selected an employee in the occupation of Industrial Health and Safety Specialist as being at the appropriate salary level. The agency stated that the mean hourly wage for Standard Occupational Classification (SOC) code 29-9011, Industrial Health and Safety Specialists, in the May 2016 data from the BLS Occupational Employment Survey (OES), was $34.85. However, OSHA recognized that not all firms assign the responsibility for recordkeeping to an Industrial Health and Safety Specialist. For example, a smaller firm may use a bookkeeper or a plant manager, while a larger firm may use a higher-level specialist. Therefore, OSHA asked for comment on whether Industrial Health and Safety Specialist is the appropriate salary level for the employee performing this task. (83 FR at 36501).

OSHA did not receive any comments on this question; nor did commenters object to the mean hourly rate used in the PEA. Therefore, OSHA finds that Industrial Health and Safety Specialist is the appropriate salary level. The updated mean hourly rate for this position, per the May 2017 OES data, is $35.38. OSHA notes that this is the raw wage and does not include the other fringe benefits that make up full hourly compensation or overhead costs calculated in this analysis.

In the PEA, OSHA multiplied the mean hourly wage for Industrial Health and Safety Specialist ($34.85) by the applicable mean fringe benefit factor for workers in private industry as reported in the June 2017 data from the BLS National Compensation Survey (1.44) to obtain the estimated total compensation (wages and benefits) of $50.18 per hour. (83 FR at 36501).

OSHA did not receive any comments on this point. Therefore, OSHA is retaining the estimate, with updates based on the June 2018 data from the BLS National Compensation Survey. The Survey again reported a mean fringe benefit factor of 1.44 for workers in private industry. Multiplying the mean fringe benefit factor by the updated hourly wage of $35.38 produces an estimated total compensation of $50.95 (an increase of 1.5 percent from the PEA, due to the increase in the mean hourly wage). OSHA believes that the calculated cost of $50.95 per hour is a reasonable estimated total hourly compensation for a typical record keeper.

As noted in the PEA, overhead costs are indirect expenses that cannot be tied to producing a specific product or service. Common examples include rent, utilities, and office equipment. Unfortunately, there is no general consensus on the cost elements that fit this definition. The lack of a common definition has led to a wide range of overhead estimates. Consequently, the treatment of overhead costs needs to be case-specific. For the PEA, OSHA adopted an overhead rate of 17 percent of base wages. OSHA explained that the 17 percent rate was consistent with the overhead rate used for sensitivity analyses in the FEA in support of the 2017 final rule delaying the deadline for submission of 300A data (82 FR 55761) and the FEA in support of OSHA's 2016 final standard on Occupational Exposure to Respirable Crystalline Silica. (83 FR at 36501).

To calculate the total labor cost for an Industrial Health and Safety Specialist, Standard Occupational Classification (SOC) code 29-9011 for the PEA, OSHA added three components together: Base wage ($34.85) + fringe benefits ($15.33, derived as 44% of $34.85) + applicable overhead costs ($5.92, derived as 17% of $34.85). This increased the labor cost of the fully-loaded hourly wage for an Industrial Health and Safety Specialist to $56.10. (83 FR at 36501).

OSHA did not receive any comments concerning its use of overhead or the calculations to add an overhead charge to the loaded wage rate. Therefore, for the FEA, OSHA has calculated the total labor cost for an Industrial Health and Safety Specialist, Standard Occupational Classification (SOC) code 29-9011, using the same method. The three components are added together: Base wage ($35.38) + fringe benefits ($15.57, derived as 44% of $35.38) + applicable overhead costs ($6.01, derived as 17% of $35.38). This increases the labor cost of the fully-loaded hourly wage for an Industrial Health and Safety Specialist to $56.96. OSHA considers this to be a reasonable estimate of total labor costs.

To estimate the time required for the data submission in the PEA, OSHA used the same estimated unit time requirements as reported by BLS in its paperwork burden analysis for the Survey of Occupational Injuries and Illnesses (SOII) (OMB Control Number 1220-0045). BLS estimated 10 minutes per recordable injury/illness case for electronic submission of the information on Form 300 (Log of Work-Related Injuries and Illnesses) and Form 301 (Injury and Illness Incident Report). OSHA also noted that, in the 2016 FEA, the agency estimated 2 minutes more time than the BLS paperwork burden, for a total of 12 minutes per recordable case (10 minutes per case for Form 301 entries plus 2 minutes per case for entry of Form 300 log entries), to account for the differences between BLS and OSHA submission requirements. (83 FR at 36501-02).

OSHA received two comments about its preliminary time and burden hour calculations. (Document ID 2012-A1, p. 12). The first commenter argued that OSHA's estimated establishment-specific costs of the electronic submission of data to OSHA are likely to be far higher than the actual costs to employers, since the PEA assumed that all the data will be entered manually for electronic submission. (Document ID 2012-A1, p. 12). The commenter wrote that OSHA noted in the 2016 rule that establishments that already keep their records electronically may have lower submission times if they can export or transmit the required information rather than entering it into the web form. (Document ID 2012-A1, p. 12) (quoting 81 FR 29690). The commenter asserted that OSHA ignored this potential decrease in burden hours in the PEA. (Document ID 2012-A1, p. 12).

OSHA recognizes that many large establishments will already be keeping their records electronically and would likely have submitted their data electronically through a batch upload or other bulk electronic transmission, thus reducing the time that would have been needed to comply with the electronic reporting requirement and the corresponding cost estimate. The agency does not have precise information regarding the percentage of employers that fall into that category. Even if the percentage of those large employers is substantial, OSHA does not have, and commenters did not provide, data on the ease with which those employers could package this information and transmit it in the format required. Therefore, as in the 2016 final rule, OSHA is retaining the time estimate that assumed manual data entry for electronic submission.

In addition, to the extent that the commenter is arguing that the agency's omission of this fact from the PEA was an attempt to obscure a potential decrease in the proposal's estimated cost savings, OSHA notes that the statement regarding potential time savings was made in response to a comment submitted during the 2016 rulemaking—a comment that did not cause the agency to change its time estimate. Moreover, the agency was clear in the PEA that its methodology was based on the numbers in the 2016 rule. (See 83 FR 36501).

The second commenter on this issue similarly argued that OSHA's cost estimate of 12 minutes per recordable case is based on the wrong data point. The commenter maintained that OSHA's preliminary cost analysis failed to disaggregate the time spent preparing Forms 300, 300A, and 301 (which an employer must incur regardless of whether the form must be submitted to OSHA electronically) from the time spent electronically submitting Forms 300 and 301 to OSHA. The commenter argues that OSHA's cost estimate should be based only on the marginal time of electronic reporting itself. (Document ID 2033-A1, p. 6).

OSHA agrees that the time estimate (and, thus, the cost savings estimate) should account only for the incremental time spent on each data submission—that is precisely why the agency calculated cost savings in that manner in the PEA and continues to do so in this FEA. (See 83 FR at 36501-02; see also 81 FR at 29676 (discussing the time needed to submit the Forms 300 and 301 data electronically). The cost of keeping records, including Forms 301, 301 and 300A were accounted for in previous OSHA final rules and ICRs. The 2016 rule imposed additional costs for electronic submission, and those were reported in that FEA. (See 81 FR at 29676). This current final rule removes only those newly imposed costs.

Therefore, having considered all the comments in the record on this issue, OSHA continues to rely the time estimates from the PEA. OSHA believes that the original estimate of 12 minutes per recordable case is a reasonable average.

In the proposal, OSHA estimated the number of injuries and illnesses that would have been reported by covered establishments with 250 or more employees under the 2016 final rule (and, thus, the number that would no longer be required to be reported under the proposal). To do so, OSHA assumed that the total number of recordable cases in establishments with 250 or more employees was proportional to the establishments' share of employment within each industry. OSHA then used the most recent SOII data to estimate that, without the final rule, covered establishments with 250 or more employees would report 775,210 injury and illness cases per year. The PEA thus estimated that cost per case at $11.22 (12/60 × $56.10), and the total cost at $8,699,173 ($11.22 per case × 775,210 cases). (83 FR at 36502).

OSHA did not receive any comments on these estimates. OSHA continues to find the above methodology and estimates to be reasonable and has used them in the final rule, with updates based on the new wage rate and establishment totals. The final cost per case to report the information from Forms 300 and 301 is estimated at $11.39 (12/60 × $56.96), and the total cost is $8,829,642 ($11.39 per case × 775,210 cases). Therefore, removing the requirement to submit the information from OSHA Forms 300 and 301 to OSHA electronically would result in a total cost savings to the private sector of $8,829,642.

As noted in the PEA, the 2016 FEA included government costs for the rule because creating a reporting and data collection system was a significant fraction of the total costs of the regulation. OSHA estimated that not collecting the case-specific data from OSHA Forms 300 and 301 would generate a small additional cost savings for the government because that portion of the reporting and data collection system has not yet been created and would not have to be created under this final rule. OSHA estimated a lump sum savings from not creating the software to collect the data from Forms 300 and 301 to be $450,000. OSHA did not receive any comments about the cost to the government of creating software to collect the data from Forms 300 and 301 and finds that the original estimates are reasonable in light of overall costs expected, so in the FEA OSHA will retain the estimate of $450,000. Annualized at 3 percent over 10 years, this would represent a savings to the government of $52,754 per year; annualized at 7 percent over 10 years, the cost savings would be slightly higher: $64,070. This estimate underestimates costs to the government of having a system for collection of this data. It includes the costs of software development, but it does not include other administrative costs, or the analysis that would be needed in order to use the data received by the system for enforcement purposes.

A significant source of costs that was identified during the preparation of this economic analysis is the anticipated costs of attempting to remove PII and information that enables re-identification of individuals from data that would have been collected under the 2016 final rule. This cost was not considered in the rulemaking preceding the 2016 final rule because OSHA anticipated using software for this purpose. As explained above, a court could require OSHA to release the data as a result of a FOIA request. This risk is not insignificant—in a recent decision, subsequent to publication of the NPRM for this rule, in a lawsuit seeking to order OSHA to enforce the requirement for covered employers to submit their Form 300 and 301 data from 2017 to OSHA electronically, the court concluded that OSHA would likely be required to release a significant portion of the data to the plaintiffs under FOIA despite OSHA's concerns about employee privacy. See Public Citizen Health Research Group v. Acosta, No. 18-1729, slip op. at 9 (D.D.C. Dec. 12, 2018). The court reasoned that, if some records present a meaningful possibility of re-identification, OSHA could redact any sensitive information “on a case by case basis.” Id. If the Form 300 and 301 data were to be released, OSHA would need to manually review the data to be released—from approximately 775,000 cases annually—to remove PII and other information that could allow re-identification of ill or injured workers. This review would be necessary because, as noted above, software cannot guarantee full scrubbing of PII and has no ability to judge re-identifiable information. OSHA has therefore added annual costs for case-by-case review.

As noted above, OSHA estimates, based on the time it has taken OSHA staff to review and remove personal information from other OSHA data, that case-by-case review would require two levels of review. OSHA anticipates that the first level review would be done by a GS-12, Step 5 Analyst (on the Washington, DC locality GS pay scale) and that analyst's work would be reviewed by a GS-14, Step 5 Supervisor (also on the Washington, DC locality pay scale).

The government hourly labor costs for the work of these employees were calculated in the following manner. Federal GS-12, Step 5 Analysts would conduct most of the review work. The fully-loaded hourly wage of a GS-12, Step 5 Analyst is calculated by taking the annual salary, dividing by the requisite 2087 hours worked per year, adding a fringe benefit factor of 1.6, and finally adding a 17 percent overhead charge. Using that formula, the fully-loaded hourly wage rate of a GS-12, Step 5 Analyst is $78.38 (annual salary of $92,421/2087 hours = base wage of $44.28 × 1.6 + $44.28 × .17 = $78.38). A GS-14, Step 5 Supervisor would review the review work. Using the same formula, the fully-loaded hourly wage rate of the supervisor is $110.14 (annual salary of $129,869/2087 hours = base wage of $62.23 × 1.6 + $62.23 × .17 = $110.14).

The cost calculation for manually reviewing Form 300 and 301 data, and removing any PII and other information that could allow re-identification of ill or injured workers, is as follows. OSHA is estimating that the first level review by the GS-12, Step 5 Analyst would take, on average, six minutes per record to review the record and redact any PII and other information that could allow re-identification of ill or injured workers. The agency is also estimating that all records would need to be reviewed. The first level review would have an estimated total annual cost of $6,076,323 (775,210 records × 6 minutes per record × 1 hour per 60 minutes × $78.38 per hour). The second level review completed by the GS-14, Step 5 Supervisor is estimated to take, on average, one minute per record and, again, all records would need to undergo this second level review. The supervisor review of the first-level review has an estimated total annual cost of $1,423,064 (775,210 records × 1 minute per record × 1 hour per 60 minutes × $110.14). The total labor cost to review and remove PII by examination of each record is estimated to be $7,499,387 ($6,076,323 + $1,423,064) annually.

OSHA notes that these numbers are broadly consistent with the annual costs of MSHA's data collection and publication program (from the MSHA ICR Supporting Statement, https://www.reginfo.gov/public/do/DownloadDocument?objectID=76285301 ).

C. New Costs (From the EIN Collection)

In the PEA, OSHA also estimated the potential new costs of amending the recordkeeping regulation to require covered employers to submit their EINs electronically along with their injury and illness data submission. The agency anticipated that some employees given this task would already know their employer's EIN from their other duties, but others would need to spend some time finding out this information. OSHA estimated an average of 5 minutes for an employee to find out his or her employer's EIN and to enter it on the submission form. Therefore, OSHA estimated that the unit cost for a submission would be the loaded wage of the employee who submitted the information multiplied by his or her time plus overhead, or $4.68 [(5/60) × $56.10]. (83 FR at 36502).

OSHA did not receive any comments on this estimate, and the agency has determined that the preliminary estimate was reasonable. Therefore, OSHA has retained the 5 minute estimate in this FEA. The updated unit cost for a submission would be the wage of the employee who submitted the information multiplied by his or her time plus overhead, or $4.75 [(5/60) × $56.96].

In the PEA, OSHA explained that the currently-implemented electronic reporting system is already designed to retain information about each establishment based on the login information, including the EIN. Therefore, employers would only have to provide OSHA their EIN once, so this would not be a recurring cost. However, it would be an additional one-time cost for employers who are newly reporting data because, for example, the establishment is new or the employer newly reached the reporting threshold for employment size. OSHA estimated that each year there will be about 10.15 percent more establishments that will be required to report their EIN. OSHA derived the 10.15 percent figure from the U.S. Census Bureau's Statistics of U.S. Businesses (SUSB), specifically the employment change data set, which shows the increase in U.S. business establishments from 2014 to 2015. In 2015, there were 689,819 new establishments, out of a total of 6,795,201 establishments. Dividing the first figure by the second gives a change of about 10.15 percent. (83 FR at 36502). There were no comments criticizing OSHA's use of the SUSB data or the methodology to estimate the number of new reporting establishments each year, and OSHA continues to find the above methodology and estimates to be reasonable. Therefore, OSHA is retaining these estimates for the FEA.

In the PEA, OSHA estimated costs for covered establishments to provide their EINs, using establishment and employment data from the U.S. Census County Business Patterns (CBP). The three categories of included establishments included in the CBP data are: (1) All establishments with 250 or more employees in industries that are required to routinely keep OSHA injury and illness records, (2) establishments with 20-249 employees in certain high-hazard industries, as defined in the Appendix to the May 2016 final rule, and (3) farms and ranches with 20 or more employees. CBP data do not include numbers of farms and ranches with 20 or more employees, so in the May 2016 final rule, OSHA used data from the 2012 Census of Agriculture. Updated data from the 2017 Census of Agriculture were not available for the PEA, so the PEA used the 2012 count of 20,623 farms with 20 or more employees. CBP data also showed that there were 36,903 establishments with 250 or more employees in industries required to routinely keep records and 405,666 establishments with 20-249 employees in the designated high-hazard industries. Combining these figures with 20,623 farms and ranches results in a total of 463,192 establishments that would be required to submit an EIN under the proposed rule. With a cost per establishment of $4.68, the total first year cost of providing EINs would be $2,165,751 (463,192 × $4.68). The annualized cost over ten years at a 3 percent discount rate was $253,892, and at a 7 percent discount rate the cost was $308,354. (83 FR at 36502).

OSHA did not receive any comments on these estimates, and the agency has determined that the preliminary estimates were reasonable. Therefore, OSHA is retaining them (with the available updates) in the FEA. Because updated establishment data were not available, OSHA has retained the PEA estimate of 463,192 establishments that would be required to submit and EIN under the final rule. With a cost per establishment of $4.75, the updated total first year cost of providing EINs would be $2,200,162 (463,192 × $4.75). When this cost is annualized over ten years, the annualized cost at a 3 percent discount rate is $257,926 and at a 7 percent discount rate the cost is $313,254.

As noted above, OSHA estimates that 463,192 establishments (including establishments with more than 250 employees, those with 20-249 employees in certain NAICS codes, and farms with more than 20 employees) will be subject to reporting their EIN in the first year under this rule. In the PEA, the agency explained that with 10.15 percent new establishments each year, there would be an additional 47,012 establishments each year that would newly need to report their EIN, resulting in an additional cost of $4.68 × 47,012 or $219,858. (83 FR at 36502). OSHA did not receive any comments on the estimated additional costs for new establishments each year, and the agency has determined that this is a reasonable estimate. Therefore, the agency has retained these estimates in the final rule. The final cost for those establishments, using the updated unit cost for a submission ($4.75), will be $4.75 × 47,012 or $223,307. As explained in the PEA, the cost for new establishments each year does not occur in the first year. (83 FR at 36502). Therefore, OSHA annualized 9 years of new establishment costs over ten years, which results in annualized costs of $216,608 at a discount rate of 3 percent and $207,676 at a 7 percent discount rate.

OSHA noted in the PEA that the EIN data field is already included in the reporting system design, so the agency did not anticipate any additional government costs associated with submittal of the EIN. (83 FR at 36502). Commenters did not object to this determination, and the agency has no reason to believe that any such costs will be incurred by the government. Therefore, OSHA is not accounting for any additional government costs associated with EIN submittal in the final rule.

D. Net Cost Savings

OSHA presented its estimates of the cost savings associated with eliminating the Forms 300 and 301 electronic data submission requirements, the new costs associated with collecting the EIN, and the net total costs in Table 1 of the proposed rule. (83 FR at 36502-03). Commenters on the proposal did not submit any thoughts on these estimates. Therefore, OSHA has retained the estimates, with updates, as described above. The cost savings of the final rule, the new costs associated with collecting the EIN, and the net total cost savings are shown in Table 1. Combining the cost savings to the private sector and to the government, the estimated total annual cost savings from the final rule would be $16,383,000 at a 3 percent discount rate and $16,395,000 at 7 percent discount rate. The additional costs to the private sector from collection of the EIN are estimated to be $474,000 at a 3 percent discount rate and $521,000 at 7 percent discount rate. The net cost savings for this rule to the private sector are estimated to be $8,410,000 at a 3 percent discount rate and $8,375,000 at 7 percent discount rate.

As OSHA explained in the proposal (83 FR at 36503), there could be substantial cost savings from requiring covered employers to include the EIN in their reporting. There is roughly a 40 percent overlap between the BLS SOII sample and private sector establishments required to report to OSHA. If OSHA collected Form 300A from all covered private sector units and BLS were able to fully match these units and use them in generating SOII estimates, the reduction in duplication would represent approximately 15,000 hours of respondent burden. In its SOII paperwork burden analysis, BLS estimates the total cost of submitting this form for private sector establishments to be $891,000. The potential cost savings for avoiding duplication is 40 percent of this value—$356,000.

E. Benefits

In the PEA, OSHA preliminarily determined that the substantial benefits to worker privacy outweighed the uncertain forgone benefits to enforcement. The agency requested comment on its preliminary determination, including on its preliminary conclusions that neither worker privacy nor enforcement benefits can be meaningfully quantified. (83 FR at 36503).

As discussed in detail in Section III, Summary and Explanation of the Final Rule, OSHA received a number of comments regarding its preliminary benefits determination. After carefully reviewing these comments, OSHA has determined that the extent of any benefits of collecting the data from Forms 300 and 301 for OSHA enforcement and compliance assistance activities is currently uncertain. OSHA has determined that, at this time, avoiding the risk to worker privacy of collecting the data from Forms 300 and 301 outweighs the uncertain incremental benefits to enforcement from the data. The rule will also allow OSHA to focus its resources on the collection and use of 300A data and severe injury reports, which the agency's past experience has proven useful.

F. Economic Feasibility

In the PEA, OSHA stated that proposed elimination of the requirement for establishments with 250 or more employees to submit the information from OSHA Forms 300 and 301 to OSHA annually would reduce costs and so would have no negative feasibility effects. (83 FR at 36503). Even with the proposed EIN requirement, the proposal still resulted in a large overall reduction in costs. (83 FR at 36503).Thus, OSHA concluded that the proposed rule was economically feasible. (83 FR at 36503). Commenters did not submit any comments objecting to this determination and, due to the increase in the wage rates, the reduction in costs has increased since the proposal. Therefore, OSHA finds that the final rule is economically feasible.

G. Regulatory Flexibility Certification

In the PEA, OSHA explained that the current requirement for annual electronic submission of information from OSHA Forms 300 and 301 affects only a very small minority of small firms. In many industry sectors, there are no small firms with at least 250 employees. Even in those industry sectors where the definition of small firm includes some firms with at least 250 employees, the overwhelming majority of small firms have fewer than 250 employees. There will, however, be some small firms affected in some industries. OSHA estimated that removing this requirement as proposed would result in a cost savings of, on average, $236 per establishment for each establishment with 250 or more employees affected by the 2016 final rule. OSHA preliminarily determined that such a small amount of cost savings would not have a significant impact on a firm with 250 or more employees. (83 FR at 36503). Commenters did not object to these determinations. OSHA reaffirms its preliminary finding and also finds that the updated cost savings of $239 per establishment for each establishment with 250 or more employees affected by the 2016 final rule will not have a significant impact on a firm with 250 or more employees.

The PEA also included a certification that the proposed rule would not have a significant economic impact on a substantial number of small entities. (83 FR at 36503). OSHA did not receive any comments on this certification. As with the proposal, the final rule will result in an overall reduction of costs. Removing the requirement for establishments with 250 or more employees to submit the information from OSHA Forms 300 and 301 annually to OSHA would reduce costs, and the estimated cost of the EIN requirement is $4.75 per establishment, a negligible amount. Hence, per sec. 605 of the Regulatory Flexibility Act, OSHA certifies that this final rule will not have a significant economic impact on a substantial number of small entities.

H. Executive Order 13771: Reducing Regulation and Controlling Regulatory Costs

Consistent with Executive Order 13771 (82 FR 9339, January 30, 2017), OSHA's preliminary economic analysis estimated the net annual cost savings of this rule to be $8.28 million per year at a 3 discount rate, and $8.25 million per year, at a discount rate of 7 percent. (83 FR at 36501). Therefore, OSHA concluded that the proposed rule was expected to be a deregulatory action under the Executive Order. (83 FR at 36496). OSHA received several comments on this preliminary conclusion.

One commenter argued that OSHA did not demonstrate how it complied the Executive Order or with the Office of Management and Budget's (OMB) guidance to agency heads on how to comply with the Executive Order. (See Document ID 2033-A1, pp. 6-7 (citing OMB Memorandum M-17-21-OMB, Guidance Implementing Executive Order 13771, “Reducing Regulation and Controlling Regulatory Costs” (Apr. 5, 2017) (OMB Guidance on E.O. 13771))). But that comment misunderstands the Agency's burden under the Executive Order and the related guidance. The guidance defines the term “deregulatory action” to mean “an action that has been finalized and has total costs less than zero.” (OMB Guidance on E.O. 13771, p. 4). In the proposal, OSHA estimated that this rule would have net cost savings of $8.28 million per year at a 3 percent discount rate, including $8.23 million per year for the private sector and $52,754 per year for the government. (See 83 FR at 36500-501, 36502-03). Annualized at a 7 percent discount rate, OSHA estimated that the proposed rule would have net cost savings of $8.25 million per year, including $8.18 million per year for the private sector and $64,070 per year for the government. (See 83 FR at 36501, 36502-03). The Agency included detailed information about how it calculated those numbers. Because OSHA expected the rule to have cost savings (i.e., total costs less than zero), it stated that it expected the proposed rule to be deregulatory action under the Executive Order. (83 FR at 36596). Nothing more was required under the Executive Order.

Another commenter remarked that adding a requirement for additional data seemed contrary to OSHA's claim that the proposed rule is a deregulatory action under the Executive Order. (Document ID 2039-A1, p. 3 (quoting 83 FR at 36496)). This comment also misinterprets the Executive Order's requirements. As noted above, OMB's guidance defines the term “deregulatory action” to mean “an action that has been finalized and has total costs less than zero.” (OMB Guidance on E.O. 13771, p. 4). This definition does not consider whether part of the rule imposes costs, but other portions of the rule provide cost savings. Rather, it looks at the total costs imposed by the rule. As explained in the proposal, OSHA expected the total costs of the proposal to be well below zero. Therefore, the Agency finds that its preliminary expectation was correct.

After carefully considering the comments submitted on this issue, OSHA reaffirms its preliminary determination that this rule is expected to be a deregulatory action within the meaning of Executive Order 13771. This finding is based on the Agency's estimate that the total annual cost savings from the final rule would be $8,884,000 at a 3 percent discount rate and $8,896,000 at 7 percent discount rate. Further details on the estimated costs and cost savings estimates for this rule can be found in Section VI, Final Economic Analysis and Regulatory Flexibility Analysis.

V. Unfunded Mandates

For purposes of the Unfunded Mandates Reform Act (2 U.S.C. 1501 et seq.), as well as Executive Order 13132 (64 FR 43255 (Aug. 4, 1999)), this final rule does not include any federal mandate that may result in increased expenditures by state, local, and tribal governments, or increased expenditures by the private sector of more than $100 million. Accordingly, OSHA is not required to issue a written statement containing a qualitative and quantitative assessment of the anticipated costs and benefits of the Federal mandate, as required under Section 202(a) of the Unfunded Mandates Reform Act of 1995 (2 U.S.C. 1532(a)).

VI. Federalism

The agency reviewed this rule in accordance with the Executive Order on Federalism 13132. (64 FR 43255). The final rule involves a “regulation” issued under sections 8 and 24 of the OSH Act (29 U.S.C. 657, 673), and not an “occupational safety and health standard” issued under section 6 of the OSH Act (29 U.S.C. 655). Therefore, pursuant to section 18 of the OSH Act (29 U.S.C. 667(a)), the rule does not preempt state law. The effect of the final rule on states is discussed in section VII, State-Plan States.

VII. State-Plan States

Pursuant to section 18 of the OSH Act (29 U.S.C. 667) and the requirements of 29 CFR 1904.37 and 1902.7, within 6 months after publication of the final OSHA rule, state-plan states must promulgate occupational injury and illness recording and reporting requirements that are substantially identical to those in 29 CFR part 1904 “Recording and Reporting Occupational Injuries and Illnesses.” All other injury and illness recording and reporting requirements (for example, industry exemptions, reporting of fatalities and hospitalizations, record retention, or employee involvement) that are promulgated by state-plan states may be more stringent than, or supplemental to, the federal requirements, but, because of the unique nature of the national recordkeeping program, states must consult with OSHA and obtain approval of such additional or more stringent reporting and recording requirements to ensure that they will not interfere with uniform reporting objectives (29 CFR 1904.37(b)(2); 29 CFR 1902.7(a)).

There are 28 state plan states and territories. The states and territories that cover private sector employers are Alaska, Arizona, California, Hawaii, Indiana, Iowa, Kentucky, Maryland, Michigan, Minnesota, Nevada, New Mexico, North Carolina, Oregon, Puerto Rico, South Carolina, Tennessee, Utah, Vermont, Virginia, Washington, and Wyoming. Connecticut, Illinois, Maine, New Jersey, New York, and the Virgin Islands have OSHA-approved state plans that apply to state and local government employees only.

VIII. Environmental Impact Assessment

OSHA has reviewed the provisions of this final rule in accordance with the requirements of the National Environmental Policy Act (NEPA) of 1969 (42 U.S.C. 4321 et seq.), the Council on Environmental Quality (CEQ) NEPA regulations (40 CFR parts 1500-1508), and the Department of Labor's NEPA Procedures (29 CFR part 11). As a result of this review, OSHA has determined that the final rule will have no significant adverse effect on air, water, or soil quality, plant or animal life, use of land, or other aspects of the environment.

IX. Paperwork Reduction Act

Overview

This final rule revises an existing collection of information that is subject to review by OMB under the Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et. seq.) and its implementing regulations (5 CFR part 1320). The PRA generally requires that agencies consider the impact of paperwork and other information collection burdens imposed on the public, obtain public input, and obtain approval from OMB before conducting any collection of information (44 U.S.C. 3507). The PRA defines a “collection of information” as “the obtaining, causing to be obtained, soliciting, or requiring the disclosure to third parties or the public, of facts or opinions by or for an agency, regardless of form or format[.]” (44 U.S.C. 3502(3)(A)). Federal agencies generally cannot conduct or sponsor a collection of information, and the public is generally not required to respond to an information collection, unless it is approved by OMB under the PRA and displays a currently-valid OMB Control Number. In addition, notwithstanding any other provisions of law, no person shall be subject to penalty for failing to comply with a collection of information if the collection of information does not display a valid OMB Control Number. (See 44 U.S.C. 3512).

Solicitation of Comments

OSHA published a Federal Register notice that allowed the public an opportunity to comment on the proposed Information Collection Request (ICR) containing the information collection requirements in the proposed rule for 60 days, as required by 44 U.S.C. 3507. Specifically, in the NPRM, OSHA explained how the proposed rule would affect its ICR estimates and asked members of the public to submit comments on the paperwork requirements. (83 FR at 36504-05). Concurrent with the proposed rule, OSHA submitted the ICR to OMB for review (ICR Reference Number 201807-1218-002) in accordance with 44 U.S.C. 3507(d).

In addition to generally soliciting comments on the paperwork requirements, the proposed rule indicated that OSHA and OMB were particularly interested in comments that:

• Evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility;
• Evaluate the accuracy of the agency's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used;
• Enhance the quality, utility, and clarity of the information to be collected; and
• Minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses.

(83 FR at 36505).

OMB concluded its review by filing a comment requesting OSHA to resubmit the request at the Final Rule stage, after considering any public comments and clarifying how the information collection requirements in final rule were changed because of the comments. OSHA received a number of comments in response to the proposed rule that addressed information collection requirements and contained information relevant to the burden hour and costs analysis in the ICR. Summaries of these comments and OSHA's responses are found above in Sections III, Summary and Explanation of the Final Rule, and IV, Final Economic Analysis and Regulatory Flexibility Certification, and in the final ICR. OSHA considered these comments when it developed the revised ICR associated with the final rule.

Concurrent with publication of this final rule, the Department of Labor has submitted the final ICR, containing the full analysis and description of the burden hours and costs associated with the final rule, to OMB for approval. A copy of this ICR will be available on the internet at http://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=201811-1218-004 on the day following publication of the final rule. At the conclusion of OMB's review, OSHA will publish a separate notice in the Federal Register to announce the results. That notice will also include a list of OMB-approved information collection requirements and total burden hours and costs imposed by the new standard.

Summary of Information Collection Requirements

OSHA's existing recordkeeping forms consist of the OSHA 300 Log, the 300A Summary, and the 301 Incident Report. These forms are contained in the ICR titled Recording and Reporting Occupational Injuries and Illnesses (29 CFR part 1904), which OMB approved under OMB Control Number 1218-0176 (expiration date 06/30/2021).

This final rule affects the ICR estimates as follows:

1. Establishments that are subject to the part 1904 requirements and have 250 or more employees will no longer be required to electronically submit information recorded on their OSHA Forms 300 and 301 to OSHA once a year.

2. Establishments subject to the data collection must provide one additional data element, the EIN.

The burden hours for the reporting requirements under § 1904.41 are estimated to be 140,545 per year, which is a reduction of 112,694 burden hours from what was estimated for the previous reporting requirements. There are no capital costs for this collection of information.

More specifically, this action amends the recordkeeping regulation to remove the requirement for establishments that are required to keep injury and illness records under part 1904, and that had 250 or more employees in the previous year, to electronically submit to OSHA or OSHA's designee case characteristic information from the OSHA Form 300 (Log of Work-Related Injuries and Illnesses) and OSHA Form 301 (Injury and Illness Incident Report) once a year. Under the final rule, these establishments are only required to submit summary information from the OSHA Form 300A. There are approximately 37,000 establishments that are no longer subject to a requirement to submit the information on OSHA Forms 300 and 301 for approximately 775,000 injury and illness cases under the rule. (OSHA used BLS's 2015 Survey of Occupational Injuries and Illnesses (SOII) data ( https://www.bls.gov/iif/oshwc/osh/os/ostb4734.pdf ) to estimate that, without the final rule, covered establishments with 250 or more employees would report 775,210 injury and illness cases per year.)

In addition, under the final rule, 463,192 establishments are now required to provide their EINs to OSHA.

The OSHA recordkeeping and reporting information collection may be summarized as follows. (Note these estimates are for the full burden of the recordkeeping and reporting information collection, including aspects that are unchanged by this rulemaking).

Agency: DOL-OSHA.

Title of Collection: Recording and Reporting Occupational Injuries and Illnesses (29 CFR part 1904).

OMB control number: 1218-0176.

Number of respondents: 1,002,912.

Number of annual responses: 5,903,976.

Total estimated annual burden time: 2,140,856 hours.

Total estimated annual other costs burden (start-up, capital, operation, and maintenance): $0.

X. Consultation and Coordination With Indian Tribal Governments

OSHA reviewed this final rule in accordance with Executive Order 13175 (65 FR 67249 (Nov. 9, 2000)) and determined that it does not have “tribal implications” as defined in that order. This final rule does not have substantial direct effects on one or more Indian tribes, on the relationship between the Federal Government and Indian tribes, or on the distribution of power and responsibilities between the Federal Government and Indian tribes.

List of Subjects in 29 CFR Part 1904

• Health statistics
• Occupational safety and health
• Reporting and recordkeeping requirements
• State plans

Final Rule

Amendments to Regulations

For the reasons stated in the preamble, OSHA amends part 1904 of chapter XVII of title 29 as follows:

PART 1904—[AMENDED]

Subpart E—Reporting Fatality, Injury and Illness Information to the Government

1. The authority citation for subpart E of 29 CFR part 1904 continues to read as follows:

Authority: 29 U.S.C. 657, 673, 5 U.S.C. 553, and Secretary of Labor's Order No. 1-2012 (77 FR 3912, Jan. 25, 2012).

2. In § 1904.41, revise the section heading and paragraph (a)(1), add paragraph (a)(4), and revise paragraph (b) to read as follows: