Health Surveillance: The 3 Regimes That Require It, and the Duty Most Offices Miss

A provider sends a proposal for an annual health surveillance programme covering your whole workforce. It looks thorough, it is priced per head, and somebody in facilities is minded to sign it because the word surveillance sounds obligatory.

For most office-based organisations it is not. Health surveillance is required by three regimes, each triggered by a specific exposure, and an employer with none of those exposures owes none of it. Buying it anyway is not a compliance win. It creates health records you then have to hold, in some cases for forty years.

Meanwhile there is a separate duty, in a different instrument, that a great many professional and technology employers genuinely do owe and almost never provide. Nobody includes it in a health surveillance quote, because it is not health surveillance.

Here is the honest map: what the law actually requires, what it explicitly is not, and the one obligation worth checking before you sign anything.

What health surveillance is for

The HSE defines it as "a scheme of repeated health checks which are used to identify ill health caused by work". Its health surveillance pages set out the logic, and the overview is blunter than most commercial material about when it applies.

It is required where workers remain exposed to health risks after controls are in place, because controls are not always reliable. That framing matters. Surveillance is a check on whether your controls are working, not an alternative to having them, and the HSE is explicit that it should only be used for workers who need it.

So the question is never whether health surveillance is good practice. It is whether a specific exposure in your workplace triggers a specific duty.

1. Substances hazardous to health

The broadest trigger, under regulation 11 of the Control of Substances Hazardous to Health Regulations 2002, and the one with the most structure to it.

Surveillance is required where it is appropriate, and regulation 11(2) gives two routes to that. The first is a listed route: the employee is exposed to a substance in column 1 of Schedule 6 while working in a process in column 2, with a reasonable likelihood that the exposure causes an identifiable disease or adverse health effect. The second is a general route, which needs three things together: an identifiable disease or adverse health effect that may be related to the exposure, a reasonable likelihood of it occurring under the particular conditions of the work, and valid techniques for detecting indications of it. The technique must also pose low risk to the employee.

That three-part test is the one to apply honestly. An office with cleaning products in a cupboard fails it at the second condition, because there is no reasonable likelihood of an identifiable disease under those conditions of work. A university teaching laboratory, a dental school, a veterinary faculty or a technology business with a materials bench may well satisfy it, which is why the answer in education and research is genuinely different from the answer in a law firm. Our guides to what COSHH is and the COSHH assessment cover the assessment that comes first, because the assessment decides this question rather than the other way round.

Two further points from regulation 11 that quotes rarely mention. Where the Schedule 6 route applies, the regime is medical surveillance by a relevant doctor at intervals of no more than twelve months. And the health record, or a copy, must be kept available for at least forty years from the date of the last entry.

2. Noise

Under regulation 9 of the Control of Noise at Work Regulations 2005, where the risk assessment indicates a risk to the health of employees who are or may be exposed to noise, the employer must ensure they receive suitable health surveillance, which must include hearing tests.

The trigger is the risk assessment rather than a single number, which is a nuance worth holding onto. Most offices sit well below the action values, and our note on office noise deals with the things that still matter below them. But a campus with a plant room, a workshop, a performance space or a music department is not uniformly an office, and the population to assess is the people in those areas rather than the headcount on the payroll.

3. Vibration

Regulation 7 of the Control of Vibration at Work Regulations 2005 bites where the risk assessment indicates a risk to health, or where employees are likely to be exposed at or above an exposure action value.

The appropriateness test mirrors the COSHH general route: a link capable of being established between exposure and an identifiable disease or adverse health effect, that effect being probable under the particular conditions of work, and valid detection techniques existing.

In our sectors this reaches grounds and estates teams, maintenance engineers and anybody using powered hand tools regularly. It does not reach the people who use a keyboard, which is a confusion that occasionally surfaces because both involve hands.

The three that are not health surveillance but medical surveillance

Worth separating, because the legal machinery is different and heavier.

Asbestos, lead and ionising radiation attract medical surveillance rather than health surveillance, carried out by a doctor appointed by the HSE, with a narrow exception for some lower-risk asbestos work. Regulation 22 of the Control of Asbestos Regulations 2012 is the asbestos provision.

For most of our clients these are not live duties, because the organisations that owe them are the ones doing the licensed work rather than the ones occupying the building. The relevance for an occupier is knowing that your contractor owes them, and that it is a fair question to ask.

What it is not, in the HSE's own words

This is the sentence to take to whoever is evaluating a proposal. The HSE states that health surveillance "is not the same as health monitoring, health promotion or health screening".

Often sold as this	What it actually is	Does it discharge a duty?
Annual health checks for all staff	Health screening	No. Valuable perhaps, but not a legal requirement
Wellbeing days, blood pressure and BMI testing	Health promotion	No
Fitness-for-work medicals on recruitment	Pre-placement assessment	No, unless a specific regime requires it
Hearing tests for a noise-exposed group	Health surveillance under reg 9	Yes, where the risk assessment triggers it
Lung function testing for a COSHH-exposed group	Health surveillance under reg 11	Yes, where the reg 11(2) test is met
Night worker assessment	A Working Time duty, not surveillance	It discharges a different duty you probably owe

None of this means a wellbeing programme is a waste. It means that calling it health surveillance does not satisfy a regulation, and that an organisation with a generous wellbeing offer can still have an unmet statutory duty sitting beside it.

The duty most offices actually owe

Now the row at the bottom of that table, because it is the one we find missing most often in technology, financial services and insurance operations running cover across time zones.

Regulation 7 of the Working Time Regulations 1998 provides that an employer must not assign an adult worker to night work unless the worker has had a free health assessment, or had one earlier that the employer has no reason to believe is no longer valid. Each night worker must also have the opportunity of a free health assessment at regular intervals appropriate in their case. Free means it costs the worker nothing. And where a registered medical practitioner advises that a worker's health problems are connected with night work, the employer must transfer them to suitable day work where it can.

Read the first limb again. It is a duty that bites before assignment, not after. An organisation that stood up a follow-the-sun support desk, a night operations team or a 24-hour claims line, and offered nobody an assessment, has not been late. It has assigned people to night work without satisfying the precondition.

This is not health surveillance, it sits in a different instrument, and it will not be in the proposal on your desk. It is also cheap to fix.

Records, cost and who attends

Four practical points that apply across the regimes and are consistently underestimated.

Employees must attend during working hours and at the employer's cost, under both the COSHH and noise provisions. Employees have a right of access to their own health record on reasonable notice. The enforcing authority can require copies. And the retention periods are long, with COSHH reaching forty years from the last entry.

Forty years of health records, per person, with access rights attached, is a records management problem rather than a filing one. It is a narrow but real case for health and safety consultants and software working as one thing, because the register has to survive provider changes, office moves and the people who set it up. Periodic health and safety audits should test it by asking which exposures triggered which surveillance and who decided, rather than counting appointments attended.

Why this travels badly

Groups running one global occupational health policy find this area diverges more sharply than almost any other, because the UK ties surveillance to exposure while several countries tie examinations to employment itself.

Brazil is the clearest contrast. Its medical control programme requires examinations on admission, periodically, on return to work after a qualifying absence, on a change of occupational risk and on dismissal, for employees generally rather than only for those with a qualifying exposure. A UK group reading that as an over-engineered version of its own programme has misread it: the trigger is the employment relationship, not the hazard. Germany works differently again, distinguishing examinations the employer must require from those it must merely offer, by prescribed trigger. France runs periodic visits through its occupational health service for the whole workforce.

So a UK-designed programme exported wholesale is simultaneously too much for some countries and far too little for others, and the mismatch is structural rather than a question of standards. The pattern that works is the familiar one: one assessment methodology identifying exposures, with the local examination regime, interval, practitioner category and retention period attached per country.

Where Arinite fits

Arinite's role here is the determination rather than the clinic. We establish whether a regime is triggered, for whom, and what the programme has to consist of, then specify it so that a qualified occupational health provider delivers the right thing to the right population. That order matters, because a programme bought before the assessment is usually both broader and shallower than the law requires.

We support 1,500+ businesses in 50+ countries and protect 100,000+ employees, with 95%+ client retention over 15+ years. Our health and safety consultants work extensively with education, IT and software, insurance and office-based clients, and our COSHH work is usually where the reg 11 question gets settled one way or the other.

For multi-country groups, our global health and safety consultants apply the local examination regime rather than exporting the British one, and our international health and safety consultants can tell you which entities owe examinations your current policy does not provide.

Before signing any health surveillance proposal, ask two questions. Which regulation triggers this, for which group. And separately: has every night worker been offered a free health assessment. Then book a free gap analysis and we will tell you in one call what you owe and what you are being sold.

Related Articles

• COSHH Symbols: A Field Guide to the 9 Hazard Pictograms
• Health and Safety in Schools: 12 Duties Education Settings Miss
• Accidents at Work: The 5 Most Common in Offices and What Prevents Them
• The Ageing Workforce: 11 Things Offices Should Design For