Employers covered by OSHA generally keep injury and illness records for five years after the calendar year they cover, and employee medical and exposure records for the duration of employment plus 30 years. How long employers keep OSHA records depends on which record you mean: routine logs of workplace injuries follow the shorter clock, while anything tied to chemical exposure or occupational health monitoring follows the much longer one. Training records sit in between and vary by standard.
The Five-Year Rule for Injury and Illness Logs
Three forms make up the routine injury and illness file: the OSHA 300 Log (a running list of recordable cases), the OSHA 301 Incident Report (detail on each case), and the OSHA 300A Summary (the year-end totals). An equivalent form, like a workers’ compensation first report, can stand in for the 301 if it captures the same information.1eCFR. 29 CFR 1904.29 – Forms
All three forms must be retained for five years following the end of the calendar year they cover. Records from 2026, for example, must be kept through at least December 31, 2031. A privacy case list, if you keep one, rides on the same five-year clock.2eCFR. 29 CFR 1904.33 – Retention and Updating
The five-year period is not passive storage. During that window, the OSHA 300 Log is a living document. If you discover a new recordable case from that year or learn that a prior case needs reclassification, you have to update the stored log. When a description or outcome changes, line out the original entry and add the new information. The 300A Summary and the 301 forms do not carry a mandatory updating duty, though you may correct them if you choose.2eCFR. 29 CFR 1904.33 – Retention and Updating
Privacy Concern Cases
Some cases are recorded on the 300 Log without the employee’s name. Instead, you assign a case number and keep a separate confidential list matching numbers to names. The categories that qualify are injuries to intimate body parts or the reproductive system, injuries from sexual assault, mental illnesses, HIV, hepatitis, or tuberculosis, needlestick injuries and cuts from sharps contaminated with blood or other infectious material, and any illness where the employee voluntarily asks that their name be left off the log. No other cases qualify.3eCFR. 29 CFR Part 1904 – Recording and Reporting Occupational Injuries and Illnesses Hold the privacy list alongside the 300 Log for the full five years.2eCFR. 29 CFR 1904.33 – Retention and Updating
The 30-Year Rule for Medical and Exposure Records
Records tied to occupational health monitoring outlive the five-year rule by decades. If your workers are exposed to toxic substances or harmful physical agents, the retention clock runs for the duration of employment plus 30 years afterward.
Employee Medical Records
The 30-year period covers a broad range of documents: exam results, lab reports, medical opinions, diagnoses, and workplace health monitoring such as chest X-rays used to establish a baseline or detect an occupational illness. Chest X-ray films must be preserved in their original state; converting them to a digital copy alone does not satisfy the rule.4Occupational Safety and Health Administration. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records
A few narrow exceptions apply. Health insurance claims kept separately from the employer’s medical program carry no set retention period. First aid records for minor injuries such as small cuts, burns, or splinters do not count either, provided they were created on-site by someone other than a physician, did not involve medical treatment or lost work time, and are stored separately from the medical program. And if an employee worked for less than a year, you can hand them their medical records on the way out instead of storing them for 30 years.4Occupational Safety and Health Administration. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records
Exposure Monitoring Records
Records documenting employee exposure to substances like asbestos, lead, or excessive noise must be kept for at least 30 years. Sampling results, collection methods, and analytical summaries all stay for the full period. Underlying background data, such as raw lab worksheets, can be discarded after one year as long as you retain the summary information.4Occupational Safety and Health Administration. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records
Safety Data Sheets and Chemical Identity Records
Safety Data Sheets themselves have no fixed retention period. What you must keep, for at least 30 years, is a record of each hazardous substance’s identity, where it was used, and when it was used. Holding onto the SDS is the simplest way to meet that duty, since it already contains the chemical identity information.4Occupational Safety and Health Administration. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records
Training Records
Training documentation does not follow a single OSHA rule. Retention varies by standard, and some standards do not specify a period at all. HAZWOPER training records, for instance, must be kept for at least three years from the date of training. Confined space training records in construction must be maintained for the duration of employment.5Occupational Safety and Health Administration. 29 CFR 1926.1207 – Training
Many standards require training but say nothing about paperwork. Keeping training records for the full duration of employment anyway is the safer practice. When a citation lands or an incident is investigated, training records are often the strongest defense an employer can offer, and there is no way to recreate them after an employee has left.
Who Has to Keep These Records
Two partial exemptions carve out employers from the routine recordkeeping duty. If your company had ten or fewer employees at all times during the previous calendar year, you do not need to maintain routine injury and illness logs. The threshold looks at peak employment across the whole company, not a single location.
Businesses in certain lower-hazard industries are also exempt regardless of size. OSHA lists the exempt industry codes in Appendix A to Subpart B of 29 CFR Part 1904, covering fields like software publishing, insurance carriers, real estate brokerages, legal services, accounting firms, and retail categories such as clothing stores and florists.6eCFR. 29 CFR Part 1904 Subpart B – Scope
Both exemptions are partial. They only excuse routine 300, 300A, and 301 recordkeeping. Even exempt employers must still report work-related fatalities, hospitalizations, amputations, and eye losses to OSHA, and must comply with any specific OSHA standard that requires its own records, including the medical and exposure record rules described above.
If the Business Changes Hands
The prior owner is responsible for recording injuries and illnesses only during the period they owned the establishment. All Part 1904 records must transfer to the new owner, who has to keep them for the rest of the five-year retention period. The new owner does not have to update or correct the previous owner’s records, but the records themselves cannot be discarded early.7Occupational Safety and Health Administration. 29 CFR 1904.34 – Change in Business Ownership
What It Costs to Get Retention Wrong
OSHA adjusts its penalty amounts each year for inflation. The figures in the original OSH Act are long outdated. Maximum penalties effective after January 15, 2025 run up to $16,550 per serious or other-than-serious violation, up to $16,550 per violation for posting failures, up to $16,550 per day beyond an abatement date for a failure to abate, and up to $165,514 per willful or repeated violation.8Occupational Safety and Health Administration. OSHA Penalties
These amounts run per violation, and recordkeeping failures stack. An employer who failed to record ten separate injuries could face ten citations, not one.
Criminal exposure is narrower but real. A willful violation that causes an employee’s death can bring up to six months in prison and a fine of up to $250,000 for an individual, or $500,000 for an organization, on a first conviction. A repeat conviction doubles the maximum prison term to one year. OSHA refers these cases to the Department of Justice, and prosecutions are more likely where an employer ignored a known hazard.