Can you prove employees received required safety training? Many OSHA standards require you to certify in writing that mandated training has taken place. Certification generally includes:

• Employee name
• Date of training
• Content of training
• Evaluation results
• Name and title of trainer

OSHA also requires a record of employee injuries and illnesses. The Occupational Safety and Health Act requires you to keep a record of all incidents resulting in death, days away from work, restricted work, transfer to another job, treatment beyond first aid, loss of consciousness, or diagnosis of a significant injury or illness by a physician. This information must be recorded and updated on an OSHA Form 300, the log of work-related injuries and illnesses. In addition, an OSHA Form 301, the injury and illness incident report, must be completed for each entry in the Form 300 log. This report includes more detailed data about how the injury or illness occurred. And once a year from February 1 to April 30, you must produce and post, for all employees to see, an OSHA Form 300A, which is an annual summary of work-related injuries and illnesses for the previous year.

Protect yourself with a paper trail. Along with requirements concerning which records you must keep, OSHA also has rules about how long you have to keep those records.

• Training records should be kept for the duration of the worker's employment.
• The OSHA 300 injury/illness log, the 300A annual summary, and all Form 301 incident reports should be kept for a minimum of 5 years following the year to which they relate. Old OSHA 200 and 101 forms, which were replaced by Forms 300 and 301 in 2002, should also be kept for 5 years following the year to which they relate.
• Records of any medical examination required because of exposure to toxic or hazardous substances, or generally required by OSHA, should be retained for 30 years after the employee terminates employment.

Some records raise employee privacy issues. OSHA has designated certain injury/illness records as "privacy concern cases."

Privacy cases involve injuries or illnesses to an intimate body part or the reproductive system, a sexual assault injury or illness, mental illness, HIV infection, hepatitis, tuberculosis, needlestick injuries, and cuts from objects contaminated with blood or other infectious material. If you're dealing with a privacy case, you may not enter the employee's name on the logs, but rather you should enter "privacy concern case" in place of the name. Then you must keep separate, confidential lists of case numbers and employee names so that cases may be identified and updated. In addition, HIPAA (Health Insurance Portability and Accountability Act) imposes national standards to protect individuals' medical records and other personal health information. HIPAA privacy rules provide that, in general, an employee's healthcare information may not be disclosed without permission, except for treatment, payment, or healthcare operations.