The GC Wants Your OSHA 300 Log Before You Can Bid. Do You Have to Provide It?

No OSHA rule requires you to hand your 300 Log to a general contractor. The access provisions of Part 1904 name every party who holds a right to your injury and illness records, and the list is short: your own employees, former employees, their personal representatives and their authorized employee representatives under 29 CFR 1904.35(b)(2), and authorized government representatives under 1904.40. A GC, a project owner, a construction manager and a prequalification platform hold no OSHA right at all. When the bid packet demands three years of 300 Logs, that demand is a contract term, which means its scope is negotiable, and knowing exactly where the regulation stops is what lets you negotiate it.

Part 1904 gives three audiences a right to your injury records, each on its own clock: your employees and their representatives get Log copies by the end of the next business day under 1904.35(b)(2), an authorized employee representative gets the case-description section of a 301 within seven calendar days, and government representatives get copies within four business hours under 1904.40. A general contractor appears on none of those lists, so a prequalification request is answered on contract terms you can negotiate. And if you do share the forms, 1904.29(b)(10) requires the employee names to come off first: outside of auditors, claim processors and public-health or law-enforcement agencies, an outsider is not entitled to identified records.

The prequal packet on the estimator's desk

A mechanical sub is invited to bid a hospital job. The GC's prequalification portal wants three years of OSHA 300 Logs and 300A summaries uploaded, plus TRIR, DART and EMR, before the bid will even open. The estimator forwards it to the safety director with one question: are we required to give them this?

The honest answer has two halves. OSHA does not require it, and the GC may nonetheless insist on it as a condition of doing business, exactly the way they insist on bonding capacity or insurance certificates. What the regulation gives you is not a way out of prequalification; it is a clear map of what is legally compelled (nothing, for a GC), what is customary (summaries and rates), and what is yours to protect (names and case details).

Who actually holds a right to your records

Three audiences, three different rules, three different clocks:

OSHA underlined the first row in a September 9, 2005 letter of interpretation: when your own workforce or their representatives ask, access reaches the entire Log, and 1904.35(b)(2)(iv) requires the names left on it, union and non-union alike, with one exception covered below. The duty of openness inside the company is broad, though it is not unlimited — a worker has a right to his own 301, not to a colleague's, and the internal picture is worked through in who can see your OSHA 300 Log and injury records. What matters here is the boundary: that duty runs inside the company, plus the government, and stops there.

What to offer a GC instead of the named Log

Prequalification math runs on totals, not on names. Every figure a GC computes comes off the 300A annual summary: total recordable cases, days-away cases, days of restriction or transfer, hours worked. That is the arithmetic behind TRIR and DART, and the 300A was designed to circulate; it is the form you already post where your own crews see it from February 1 to April 30 each year.

So the counteroffer that resolves most prequalification requests: certified 300A summaries for the years requested, your computed TRIR and DART, and your EMR letter from the carrier. The full 300 Log adds employee names, injury descriptions and body parts — none of which the prequalification arithmetic uses.

Two facts strengthen your position at the negotiating table:

1. Part of your data is already public. Covered establishments submit 300A data electronically each year, and OSHA publishes establishment-specific submitted data on its website; since 2024, larger establishments in designated high-hazard industries also submit certain 300 and 301 case details. A GC insisting on your paper is often asking for numbers OSHA already posts.
2. Recording duties do not follow the org chart of the jobsite. Under 1904.31 and OSHA's April 25, 2017 letter, an injury goes on the log of the employer supervising the worker day to day, and 1904.31(b)(4) tells the two companies to coordinate so that each case is recorded only once, on that employer's log. A GC collecting your logs has not taken over your recordkeeping, and nothing about the multi-employer citation doctrine transfers a recordable off your Log. Temp and leased labor follow the same supervision test, covered in our 1904.31 guide.

What the rule requires when you do share the Log

Most prequalification conversations treat redaction as a courtesy the sub may or may not extend. Part 1904 treats it as a duty. 1904.29(b)(10) is written for this exact situation, and its language is mandatory: "If you decide to voluntarily disclose the Forms to persons other than government representatives, employees, former employees or authorized representatives … you must remove or hide the employees' names and other personally identifying information."

The rule then names the only outsiders who may receive identified forms:

• an auditor or consultant hired by the employer to evaluate the safety and health program, 1904.29(b)(10)(i)
• to the extent necessary for processing a claim for workers' compensation or other insurance benefits, 1904.29(b)(10)(ii)
• a public health authority or law enforcement agency, for the uses and disclosures that need no consent or authorization under the HIPAA privacy standards at 45 CFR 164.512, 1904.29(b)(10)(iii)

A general contractor running prequalification is none of those three. Neither is a project owner, a construction manager or a bidding portal. So the safety director who uploads a scanned, fully named 300 Log to satisfy a bid packet is not being generous with the crew's information; they are disclosing it in a way Part 1904 does not permit.

That changes the tone of the whole exchange. Sending totals instead of names is not a concession you are asking the GC to accept — it is what the regulation tells you to do with those forms.

The redaction machinery the rule already runs inside your company

The same regulation forces certain redactions even for disclosures it requires, which tells you how seriously it takes the point:

• Privacy concern cases never carry a name on the Log. Under 1904.29(b)(6) you enter "privacy case" in place of the employee's name and keep a separate confidential case list. The qualifying cases are listed in 1904.29(b)(7): injuries to intimate body parts or the reproductive system, injuries from sexual assault, mental illnesses, HIV, hepatitis and tuberculosis, contaminated needlestick and sharps injuries, and other illnesses when the employee asks for privacy. Per 1904.29(b)(8), "this is a complete list."
• The description can be generalized too. When removing the name is not enough to prevent identification, 1904.29(b)(9) lets you use discretion in describing the injury, keeping enough to show cause and severity while dropping details of an intimate nature.
• Even union representatives never see the whole 301. The 1904.35(b)(2)(v)(B) rule quoted above strips everything except the case-description section before a 301 copy goes to an authorized employee representative.

One more boundary worth knowing before someone asks: the confidential list matching case numbers to names is not a document anyone gets on request. 1904.29(b)(6) requires you to keep it so that you can update those cases and provide the information to the government if asked — employees, former employees and their representatives have no right to it, and a general contractor is not even in the conversation. It stays in your own file, for the five years 1904.33(a) requires.

So the practical answer to the bid packet: send the certified 300A summaries and your computed rates; if the GC insists on Logs, send them with names removed, and say in the response that the redaction is made under 1904.29(b)(10) rather than leaving it to be noticed as an omission.

Building the 1904.29 privacy machinery into the 301 form itself

The redaction rules above fail at exactly one moment, the day a recordable is entered by whoever is available rather than whoever knows 1904.29. HazComFast builds the rule into the 301 form itself: the six privacy-concern categories of 1904.29(b)(7) sit beside the entry fields as a checklist, and a dedicated field prompts for the generalized Log description that 1904.29(b)(9) permits. The person entering the case gets the regulation as a checklist instead of a memory test, at the one moment the decision is actually made.

The same design principle runs through the whole account: your Log, your 301 reports and your privacy case list live in your company's own HazComFast account, under your control, not inside a GC's portal. Each company sees only its own records. A GC sees exactly what you choose to send, nothing else. So when a prequalification packet arrives, nothing has already leaked into a shared portal, and the 300A summary that answers most of the packet is built from the same records as the Log, one level up in detail. Disclosure stays what this article argues it should be: a deliberate act, at a scope you chose.

What a GC can ask for, and what OSHA requires you to share

Related reading

• The rates the GC is really after: How to calculate TRIR and DART
• The forms behind the request: OSHA 300, 300A and 301 guide · OSHA recordkeeping hub
• When the government asks instead: The four-business-hour rule
• Jobsite responsibility questions: Multi-employer citation doctrine · Temp and leased workers under 1904.31

Sources and verification (verified 2026-08-26): 29 CFR 1904.35(b)(2), 1904.40(a)-(b), 1904.29(b)(6)-(9), 1904.31, 1904.32(b), 1904.33(a), quoted from the current regulation; OSHA letters of interpretation of September 9, 2005 and April 25, 2017; OSHA Establishment-Specific Injury and Illness Data (ITA). General guidance, not legal advice; State-Plan states may impose additional requirements.