When Should the OSHA Annual Summary be Posted?

Posted by Steve Alder

The OSHA annual summary should be posted in a conspicuous place (or places) where notices to employees are customarily posted no later than February 1 of the year following the year covered by the summary. This article explains what the OSHA annual summary is, who is required to post a summary, and what the summary should include.

  • What is the OSHA Annual Summary?
  • Who is Required to Post a Summary?
  • What Should the Summary Include?
  • Who Certifies the Summary is Accurate?
  • How Long Must a Summary Remain Posted?
  • Conclusion: Be Aware of the Posting Requirements

What is the OSHA Annual Summary?

The OSHA annual summary is a form (Form 300A or equivalent) that summarizes the recordable work-related injuries and illnesses that occurred during the previous calendar year. The summary has to be completed by all employers unless exempted due to the size of the business or the nature of activities. Note: Exemption from the posting requirements does not exempt an employer from reporting a workplace incident that results in a fatality or severe injury.

“Covered employers” – i.e., those required to post an OSHA annual summary – must not only post the form in a conspicuous place in the workplace but must also submit the data on the form to OSHA. Data can be submitted using an online web form, uploading a CSV file, or via an API. Details about how to submit annual summary data to OSHA can be found on the Injury Reporting and Injury Tracking Application web page.

Who is Required to Post a Summary?

Who is required to post a summary is currently being reconsidered by OSHA and may be revised by the end of 2023. However, at present, all businesses with more than ten employees that do not appear on the list of exempted businesses (florists, most schools, religious organizations, etc.) are required to submit Form 300A electronically and post an OSHA annual summary in the workplace.

The proposed rule changes are intended to allow OSHA to make better use of its resources. If finalized, all businesses with 19 or fewer employees will be exempted from the reporting requirements, as will businesses with between 20 and 249 employees if they do not appear on OSHA’s list of high-risk industries. Businesses with 250 or more employees will still be required to post OSHA annual summaries unless they appear on the exempted business list.

What Should the Summary Include?

The summary should include the total for each type of recordable work-related injury and illness taken from the OSHA Form 300 log. The totals must indicate:

  • Total number of work-related fatalities.
  • Cases that resulted in days away from work.
  • Cases that resulted in job transfer or restriction.
  • Number of other recordable cases.
  • Total days away from work due to a work-related injury or illness.
  • Total days in which a job transfer or restriction occurred.
  • Total number of injuries in the year
  • Total number of skin disorders.
  • Total number of respiratory conditions.
  • Total number of poisonings.
  • Total number of hearing loss cases.
  • Total number of all other recordable illnesses.

An injury or illness has to meet certain criteria before it is recordable. With regards to being work-related, the injury or illness must have occurred in a work environment (see table in 1904.5 for list of events not considered to be work-related), while the injury or illness must have resulted in death or at least one of – days away from work, restricted work, medical treatment beyond first aid, loss of consciousness, and/or a diagnosis by a licensed health care professional.

Who Certifies the Summary is Accurate?

Any authorized person can complete the OSHA annual summary; however, it must be certified as accurate by a company executive. According to OSHA §1904.32, a company executive is either the owner of the company (if a sole proprietor or partnership), an office of the corporation, the highest ranking company official working at the same workplace, or their immediate supervisor.

Once certified, Form 300A and all supporting Form 300 logs must be retained for a minimum of five years and must be made accessible to employees, former employees, and employees’ representatives on request. Note: It is not permitted to remove employee names or injury/illness details (for privacy reasons) from the Form 300 logs once Form 300A has been certified.

How Long Must a Summary Remain Posted?

The summary must remain posted from February 1 (at the latest) to April 30 (at the earliest). During that time, employers should inform members of the workforce that the summary has been posted, and ensure the summary is not altered, defaced, or covered by other notices. If the summary is altered or defaced in any way, it must be replaced with a copy of the form as soon as possible.

The failure to post or maintain an accurate annual summary is a violation of OSHA that could be reported and result in a citation or fine. It is important to be aware that the failure to post and maintain an OSHA annual summary would be classified as a de minimis violation (rather than a posting requirement violation), which would attract a higher fine if the violation is repeated.

Conclusion: Be Aware of the Posting Requirements

Preparing, submitting, and posting the OSHA annual summary is not complicated provided you are aware of whether you are required to comply with the posting requirements and what qualifies as a recordable work-related injury or illness. If you are in any doubt about the recordkeeping requirements and how they might impact your OSHA compliance efforts, you should seek advice from a compliance professional.

Footnote: In the year ended September 2022, 25 citations were issued against healthcare providers for not posting an OSHA annual summary. One provider was fined $18,325 for a repeated offense including a failure to abate penalty.

The post When Should the OSHA Annual Summary be Posted? appeared first on HIPAA Journal.

Largescale Phishing Campaign Targets Zimbra Collaboration Email Servers

Posted by Steve Alder

Researchers at ESET have identified a largescale and ongoing phishing campaign targeting Zimbra Collaboration email servers at small- and medium-sized businesses and government agencies. The campaign has been active since at least April and is being conducted globally, with Poland, Ecuador, and Italy the most targeted countries. The campaign does not appear to be targeted on any specific vertical.

Targets are sent an email with an HTML attachment. The email warns the user about an email server update or another Zimbra issue, such as a security update. The From field indicates the email has been sent by an email server administrator. The user is told that they need to download the HTML attachment, which will have a URL pointing to a local file patch. The HTML attachment includes the targeted organization’s logo, the organization’s name, and a fake login page, with the username prefilled. The user is only required to enter their password. If the password is entered, the credentials are transmitted by HTTPS POST request to an adversary-controlled server.

The ESET researchers observed waves of phishing emails being transmitted from some of the organizations targeted in the campaign which suggests the threat actor obtained administrator credentials and was able to set up new mailboxes on the server. The researchers suggest that in these cases, the same password may have been used for email and administration. While this email campaign is not particularly sophisticated, it has proven to be effective. Since the HTML attachments contain legitimate code and only one link pointing to a malicious host, which is contained in the HTML rather than the message body, the emails may not be detected as malicious and are likely to bypass antispam policies, especially since the targeted organizations are mostly small- to medium-sized businesses that are unlikely to have advanced email security defenses. ESET was unable to determine which threat actor is behind the campaign.

The post Largescale Phishing Campaign Targets Zimbra Collaboration Email Servers appeared first on HIPAA Journal.