(a) The employer must save the SH 900 log, the privacy case list (if one exists), the annual summary, and the SH 900.2 incident report forms for five years following the end of the calendar year that these records cover.