The Occupational Safety and Health Administration (OSHA) has issued its final rule revising its regulations on the recording and reporting of occupational injuries and illnesses.

Under the rule, establishments with 250 or more employees must electronically submit their Form 300, 300A, and 301 information to OSHA or an OSHA designee on an annual basis. Establishments with 20 or more employees, but less than 250 employees in certain designated industries must submit their Form 300A information electronically on an annual basis as well. Additionally, employers may also have to submit additional information upon notification. Under this requirement, an employer will be required to submit data electronically if OSHA orders it to do so as part of a specific data collection. Most controversially, OSHA intends to post the establishment-specific injury and illness data on its public website.

The final rule also amends some existing recordkeeping regulations to include more whistleblower protections. Under the new rule, employers must inform employees of their right to report work-related injuries and illnesses. The rule also clarifies that an employer’s procedures for reporting injuries and illnesses must be reasonable and not deter the reporting of an injury. Finally, the rule incorporates pre-existing statutory prohibitions on retaliation.

The final rule is slated to take effect on January 1, 2017. Employers satisfying the above criteria must submit their 2016 injury and illness data by July 1, 2017, and their 2017 information by July 1, 2018.

The final rule could also create a host of legal headaches for employers moving forward. First and foremost, employers would be wise to immediately review their own workplace policies to ensure they do not deter employees from reporting injuries, as prohibited by the new rule. Additionally, smaller employers should be on the lookout for potential privacy breaches, as the publication of the data, even without names and addresses, could still permit a reader to piece together the identity of the injured worker.