N.Y. Comp. Codes R. & Regs. tit. 12, § 801.29 – Forms.

(a) The employer must use SH 900, SH 900.1, and SH 900.2 forms, or equivalent forms, and associated instructions, for recordable injuries and illnesses. The SH 900 form is called the log of work-related injuries and illnesses, the SH 900.1 is the annual summary of work-related injuries and illnesses, and the SH 900.2 form is called the injury and illness incident report.
(b) If the case is to be considered a privacy concern case, the employer may not enter the employee's name on the SH 900 log. Instead, the employer must enter " privacy case" in the space normally used for the employee's name. This will protect the privacy of the injured or ill employee when another employee, a former employee, or an authorized employee representative is provided access to the SH 900 log under section 801.35 of this Part. The employer must keep a separate, confidential list (the privacy case list) of the case numbers and employee names for the employer's privacy concern cases so the employer can update the cases and provide the information to the government if asked to do so.
(c) The employer must consider the following injuries or illnesses to be privacy concern cases:
1. (1) an injury or illness to an intimate body part or the reproductive system;
2. (2) an injury or illness resulting from a sexual assault;
3. (3) mental illnesses;
4. (4) HIV infection, hepatitis, or tuberculosis;
5. (5) needlestick injuries and cuts from sharp objects that are contaminated with another person's blood or other potentially infectious material (see section 801.7 of this Part for definitions); and
6. (6) other illnesses, if the employee independently and voluntarily requests that his or her name not be entered on the log. Effective January 1, 2004, musculoskeletal disorders (MSDs) are not considered privacy concern cases.
  This is a complete list of all injuries and illnesses considered privacy concern cases. No other types of injuries or illnesses may be classified as privacy concern cases.