The Four-Business-Hour Rule: Producing Your OSHA 300 Logs During an Inspection

When an OSHA compliance officer asks for your injury and illness records, you have four business hours to produce copies. That deadline is written into 29 CFR 1904.40(a): "When an authorized government representative asks for the records you keep under part 1904, you must provide copies of the records within four (4) business hours." The request reaches the current 300 Log and everything you are required to retain, which under 1904.33 means five prior years. Employers who treat the request as something to handle "by the end of the week" are collecting citations for it, and failing to produce is a violation on its own, separate from anything wrong inside the records. This guide covers what the rule demands, who can invoke it, and what a four-hour drill looks like before you ever need one.

The four-hour clock in 1904.40(a) covers everything Part 1904 makes you keep: the 300 Log, the annual 300A summary, the 301 incident reports and the privacy case list, for the current year plus the five years of retention required by 1904.33(a). Only government representatives can start it, missing it is a violation in its own right, and if the records sit in another time zone you count the hours on the business hours of the office that holds them.

Ten a.m. at the trailer

A compliance officer presents credentials at a mid-rise project, holds the opening conference, and asks for the OSHA 300 Logs and annual summaries. The superintendent's records are wherever the office manager keeps them: some in the trailer, some at the home office two states away, and the 2021 file last seen by an office manager who left in the spring. Under 1904.40 none of that matters. The request started a four-business-hour clock, and what the company can put in the CSHO's hands before it runs out is now part of the inspection record.

The scenario is routine because the records request is routine: the injury and illness records are among the first documents a compliance officer asks for, and what they show shapes the rest of the inspection.

What the rule says

The whole of 1904.40 fits in three questions:

Two features deserve attention. First, the rule says copies, so photocopies, printouts or legible electronic copies satisfy it; the CSHO does not take your originals. Second, "business hours" is the only mercy in the text, and (b)(2) says which clock to read: if your records sit at a headquarters two time zones away, the deadline runs on that office's business hours, not the jobsite's. A request at 3:00 p.m. on Friday, at whichever location holds the records, with that location closing at 4:00, runs one hour Friday and three hours Monday morning. It does not run over the weekend, and it does not restart. One thing the clock ignores entirely is where the records are hosted: a log sitting in a safety platform you no longer subscribe to gets no extension, which is why the export belongs before the cancellation, not after.

What "the records you keep under part 1904" covers

The request is not limited to the current year's Log. Under 1904.33(a), you must save four things "for five (5) years following the end of the calendar year that these records cover":

• The OSHA 300 Log for each of those years
• The privacy case list, if one exists, matching case numbers to the names withheld from the Log
• The annual summary (Form 300A) for each year
• The OSHA 301 Incident Reports for each recordable case

All of it sits inside "the records you keep under part 1904," and all of it is producible within four business hours. So in August 2026 a CSHO can ask for the 2026 Log to date plus complete records for 2021 through 2025, and the stored years are not frozen: 1904.33(b)(1) requires you to update stored 300 Logs with newly discovered recordable cases and classification changes. The 300A and 301s in storage do not have to be updated, though you may.

Worth knowing at the front end: the 300A you produce must already be certified. Under 1904.32(b)(3), a company executive certifies that they have examined the Log and reasonably believe the summary is correct and complete, and the certified summary is posted in each establishment from February 1 to April 30. An uncertified 300A handed to a CSHO is a violation you are documenting yourself. The forms guide walks through who qualifies as a certifying executive.

What the four hours does not cover

The deadline is written into Part 1904, and it reaches "the records you keep under part 1904" — that phrase is the boundary. The 300 Log, the 300A, the 301s and the privacy case list are inside it. Your written hazard communication program, your training sign-in sheets, your respirator fit-test records, your internal incident investigations: none of those are Part 1904 records, and none of them are on a four-hour clock. A compliance officer can and will ask for them, and OSHA has its own routes for compelling them — including an administrative subpoena, which runs on days rather than hours.

Knowing which category a document falls into is not permission to be slow with the second one. It is how you avoid the two opposite mistakes: treating every document in the trailer as due by lunchtime, and handing over a stack nobody asked for.

One more distinction catches experienced people out. Injury and illness records are not the same as exposure and medical records, which live under 29 CFR 1910.1020 on a different schedule entirely: an employee exposure record is preserved "for at least thirty (30) years", an employee medical record "for at least the duration of employment plus thirty (30) years", and when a worker or their designated representative asks for access the employer provides it promptly — if that is not possible, the requester must be told the reason for the delay within fifteen working days. Five years, four business hours and next-business-day access all belong to Part 1904. A retention policy that blurs the two will be wrong on both.

Central storage does not buy time

Many contractors keep injury records at the home office. That is expressly allowed, and expressly conditioned. 1904.30(b)(2) permits keeping an establishment's records "at your headquarters or other central location" only if you can transmit incident information there within seven calendar days and "produce and send the records from the central location to the establishment within the time frames required by §§ 1904.35 and 1904.40."

Read those two rules together and the operational requirement becomes plain: wherever the paper or the file server lives, that location must be able to send copies to the establishment being inspected inside the deadline. What 1904.40(b)(2) grants is narrow and worth knowing precisely: you may count the four hours on the business hours of the office that holds the records. What it does not grant is a slower standard because the records are far away, or because the person who knows where they are took the afternoon off.

Who cannot invoke the four-hour rule

The list in 1904.40(b)(1) is short and entirely governmental. A general contractor running prequalification, a project owner, an insurance loss-control auditor, a staffing agency: none of them holds any right under 1904.40, and none of the Part 1904 access provisions name them. What you share with a GC is a contract question, covered in detail in our guide to GC requests for your 300 Log.

Your own workforce is a different matter. Under 1904.35(b)(2), employees, former employees, their personal representatives and their authorized employee representatives have a right of access: a copy of the relevant 300 Log by the end of the next business day, and 301 access on defined terms, free of charge the first time. Two audiences, two clocks: the worker's is the more generous of the two, which is worth remembering when a request lands late on a Friday and the temptation is to treat every records demand as equally urgent. Only the government's runs in hours.

Why late production is a citation, and why it is being written

Failure to produce within four business hours is itself a violation of 1904.40, separate from any defect in the records. The 2026 penalty schedule applies, and the practical damage often exceeds the dollar figure: an employer who cannot find its own injury records in half a day has told the CSHO something about its safety program before the walkaround begins, and the good-faith penalty reduction, worth up to 25 percent under the Field Operations Manual (Chapter 6, Penalties and Debt Collection, as updated by CPL 02-00-164-1 in 2025), turns on whether your safety and health program works in practice rather than on paper: 25 percent normally requires a written and effective safety and health management system, 15 percent covers a documented and effective one with only incidental deficiencies, and no good-faith credit at all goes to high-gravity serious, willful, repeated or failure-to-abate violations, so the credit is worth most on exactly the routine citations a records fumble invites.

The inverse is also real. Logs produced in minutes, certified summaries in the file, privacy case list intact and stored years updated: that is the quietest credibility an employer can buy during an opening conference. Our 60-second inspection response plan covers the wider choreography; the records piece is the part you can rehearse today.

The four-hour drill

Run this once, before it counts, with a stopwatch:

1. Pick a random prior year in the retention window. Locate that year's 300 Log, 300A and 301s, and the privacy case list if any case that year used one.
2. Confirm the 300A carries an executive certification under 1904.32(b)(3)-(4).
3. Check the stored Log against later-discovered cases, the 1904.33(b)(1) duty everyone forgets.
4. Confirm the current-year Log is current: each recordable entered within seven calendar days of learning of it, per 1904.29(b)(3).
5. Time how long it takes to produce clean copies of all of it, starting from the jobsite phone call rather than from the file cabinet.

If step 5 lands anywhere near four hours on a calm day, it will not land inside four hours with a CSHO in the trailer.

One screen against the scramble

The drill above is exactly the check that HazComFast runs continuously, and it works because the records the four-hour clock covers are not scattered to begin with: the 300 Log, the 301 incident reports, the certified 300A and the privacy case list live together in the company's account, each year selectable across the full 1904.33 retention window, which is the difference between producing copies and hunting for them. On top of that sits the Inspection Ready screen. It reads the same records an inspector will ask about, the 300 Log, the 301 reports, the 300A, the written programs and the SDS library, and, beneath an overall readiness figure, names what is missing item by item: an uncertified 300A shows up as "Not certified", a chemical without its data sheet shows up by count, a silica exposure control plan without its document shows up as a line item. The gaps get fixed in the weeks before an inspection instead of surfacing during one.

The bottom line

Related reading

• The forms themselves: OSHA 300, 300A and 301 recordkeeping guide · OSHA recordkeeping hub
• The inspection: What to expect in an OSHA inspection · 60-second inspection response plan
• Third-party requests: Does the GC get your 300 Log?
• Building the evidence file: Defense packages for citations and litigation

Sources and verification (verified 2026-08-26): 29 CFR 1904.40(a)-(b), 1904.33(a)-(b), 1904.30(b)(2), 1904.32(a)-(b), 1904.35(b)(2), 1904.29(b)(3), 1904.1(a)(1), quoted from the current regulation; good-faith reduction tiers and exclusions per the Field Operations Manual, Chapter 6, current text read on August 27, 2026. General guidance, not legal advice; State-Plan states may impose additional requirements.