DOL Shuts Down Injury Reporting System Amid Possible Breach

From labor disputes cases to labor and employment publications, for your research, you’ll find solutions on Bloomberg Law®. Protect your clients by developing strategies based on Litigation...

By Ben Penn

The Labor Department temporarily shut down a portal for employers to report injuries and illnesses while the agency investigates a “potential compromise” of a company’s electronic data, a DOL official told Bloomberg BNA Aug. 16.

The possible breach comes as the Trump administration earlier this year suspended, and is now considering reversing, a 2016 regulation that would have required for the first time hundreds of thousands of businesses to electronically report employee injuries. Trade groups and employers that oppose the rule have cited concerns that data could be publicized and accessed by unions to critique safety performance and reveal other employee information.

The Homeland Security Department informed the Occupational Safety and Health Administration on Aug. 14 that “there is a potential compromise of user information for OSHA’s Injury Tracking Application,” according to the DOL official. “At this time, one company appears to have been affected and that company has been notified of the issue. Access to the ITA has been temporarily suspended as OSHA works with the system developer to examine the issue to determine the extent of the problem.”

The official didn’t identify the company involved in the possible breach.

OSHA’s tracking website currently loads with an alert stating that “due to technical difficulties with the website, some pages are temporarily unavailable.” The portal went live Aug. 1, although the initial compliance phase of the regulation isn’t scheduled to take effect until Dec. 1.

No Confidential Info

The first stage of the rule’s staggered rollout involved reporting of generic information, such as number of on-the-job deaths and injuries. David Michaels, the OSHA administrator for most of the Obama administration, told Bloomberg BNA that if a breach occurred, it wouldn’t have uncovered sensitive employee information.

“The injury data system that we designed last year but was delayed by the Trump Administration did not collect any confidential information,” Michaels, now a professor at George Washington University, told Bloomberg BNA via email. “Any data breach would be acquiring data that are designated to be made public.”

However, eventually the rule mandates the sharing of more detailed employee records, which include names and sensitive health information, Eric J. Conn, chair of the OSHA practice at Conn Maciel Carey in Washington, told Bloomberg BNA.

“OSHA has stated repeatedly that their intent is to scrub personal identifying information from what they intended to publicize, but stakeholders have expressed concerns about what has now happened,” Conn said, referring to the potentially compromised data. His practice represents industry clients subject to OSHA enforcement actions.

Deborah Berkowitz, a former OSHA chief of staff under Obama, told Bloomberg BNA that the agency has “decades” of experience collecting other forms of employer data online.

“This agency has a lot of experience with doing this—and doing it right,” said Berkowitz, a senior fellow at the National Employment Law Project. “This is a brand new application, and because of the new administration, it was never tested. OSHA should use this time to get it right and protect the data base.”

Debate Continues on Obama Rule

It’s unclear if the agency’s ongoing review of the rule will lead to a decision to cancel portions of the reporting requirement or to void the entire regulation. Some management attorneys have been advising clients not to report during this period of uncertainty in which data disclosure to DOL is voluntary.

Portal security issues shouldn’t affect the agency’s decision on rolling back the rule, Jamie LaPlante, who represents employers at Porter Wright in Columbus, Ohio, told Bloomberg BNA.

“I do think it underscores the risks of the portal and may be cited as one reason for rescinding the rule if that’s what OSHA eventually does,” LaPlante said in an email.

The rule applies to employers with 250 or more employees and to locations with 20 to 249 employees in industries designated by OSHA as having historically high rates of occupational injuries and illnesses.

—With assistance from Bruce Rolfsen

To contact the reporter on this story: Ben Penn in Washington at bpenn@bna.com

To contact the editors responsible for this story: Peggy Aulino at maulino@bna.com; Terence Hyland at thyland@bna.com; Chris Opfer at copfer@bna.com

Copyright © 2017 The Bureau of National Affairs, Inc. All Rights Reserved.