DOL Temporarily Shuts Down OSHA Injury Reporting Portal Because of Possible Data Breach

According to Bloomberg BNA, the Labor Department temporarily shut down OSHA’s (ITA) “Injury Tracking Application” portal for employers to report injuries and illnesses so that OSHA can investigate a “potential compromise” of a company's electronic data. 

The Homeland Security Department informed the Occupational Safety and Health Administration on Aug. 14 that “there is a potential compromise of user information for OSHA's Injury Tracking Application,” according to the DOL as reported by Bloomberg BNA, and  “At this time, one company appears to have been affected and that company has been notified of the issue. Access to the ITA has been temporarily suspended as OSHA works with the system developer to examine the issue to determine the extent of the problem.”

OSHA's tracking website currently states that “due to technical difficulties with the website, some pages are temporarily unavailable.” The portal went live Aug. 1, 2017,  although the initial submissions begin to be phased in on December 1, 2017.

Who: Establishments with 250 or more employees that are currently required to keep OSHA injury and illness records, and establishments with 20-249 employees that are classified in certain industries with historically high rates of occupational injuries and illnesses.

What: Covered establishments with 250 or more employees must electronically submit information from OSHA Forms 300 (Log of Work-Related Injuries and Illnesses), 300A (Summary of Work-Related Injuries and Illnesses), and 301 (Injury and Illness Incident Report). Covered establishments with 20-249 employees must electronically submit information from OSHA Form 300A.

When: The requirement becomes effective on January 1, 2017. The new reporting requirements will be phased in over two years. In 2017, all covered establishments must submit information from their completed 2016 Form 300A by July 1, 2017. In 2018, covered establishments with 250 or more employees must submit information from all completed 2017 forms (300A, 300, and 301) by July 1, 2018, and covered establishments with 20-249 employees must submit information from their completed 2017 Form 300A by July 1, 2018. Beginning in 2019 and every year thereafter, covered establishments must submit the information by March 2.

How: OSHA will provide a secure website that offers three options for data submission. First, users will be able to manually enter data into a web form. Second, users will be able to upload a CSV file to process single or multiple establishments at the same time. Last, users of automated recordkeeping systems will have the ability to transmit data electronically via an API (application programming interface). We will provide status updates and related information here as it becomes available.

What to Do.

Many employers and trade associations vigorously oppose the Rule and its potential to be used to shame employers or aid in union drives or public organizations’ attacks on publicly traded or high-visibility companies.  A number of former OSHA officials, including former OSHA head, Dr. Michaels and Jordan Barab have vigorously argued for the Rule’s full implementation and any decision to not do so will likely generate even more litigation. If one is a betting person, the likely outcome is that the first round of covered employees will in fact have to submit information from their Form 300As for 2016 data on DECEMBER 1, 2017.

According to Bloomberg BNA’s Bruce Rolfsen, “some management attorneys have been advising clients not to report during this period of uncertainty in which data disclosure to DOL is voluntary.”

Given that the first round of submission starts on December1, 2017, this advice is sound. While you should not wait until November 30 to try to submit data, you may want to wait until a date such as November 1.

In the interim, get ready, learn the OSHA site, audit and clean up your recordkeeping logs, and be ready.

As you know, when FP audits employers Form 300s, 300As, 301s and related data, we usually find errors - although not the under recording alleged by unions and the former Administration.

However, even over-recording is a violation and as data becomes public, will make employers look bad to customers - many of whom evaluate your injury data - and to third parties, shareholder groups, and unions. Construction companies are already used to this scrutiny during bidding. Now the concept is expanding to other industries. As a recent example, have you experienced a SOCIAL RESPONSIBILITY or SUSTAINABILITY AUDIT? You probably will in the future. 

What do we often discover when we audit Logs? here are a few ... but not all common errors ....

• Incomplete descriptions of the part of the body injured and the circumstances in Column F of the 300.
• Selecting more than one category from columns (G) through (J).
• Excluding an injury because the injured employee tested positive for unlawful drugs after the incident.
• Reporting to OSHA an overnight hospitalization for "observation only."
• Misunderstanding OSHA's narrow list of activities classified as "First Aid."
• Workers Comp Administrators learn of a Recordable Injury not known by supervisors or the person maintaining the 300s, but don't tell them.

Moreover, do you periodically review injury patterns and check Job safety Analysis (JSA) to determine if proper PPE is required, or if work practices need to change?

Use the time between now and December 1, 2017 to clean up and rationalize your practices.

Howard