Health Surveillance: The 3-Step Test for Whether You Owe It
There are two ways to get health surveillance wrong, and most organisations manage one of them.
The first is to buy it when you do not owe it. A broker or software business commissions annual medicals for everyone, calls it health surveillance, and spends money on a programme that satisfies no legal duty and detects nothing relevant. The second is to miss the one trigger that does apply, usually night working or a sensitiser in a laboratory, and discover it when someone reports a symptom.
Both come from the same confusion. Health surveillance is not a health check, a wellbeing benefit or a fitness for work assessment. It is a specific, ongoing procedure aimed at detecting the earliest signs of a work-related effect, so that the controls can be fixed before anyone is harmed. It exists to test your controls, using people as the indicator. That is why it is only owed in defined circumstances, and why a general medical does not discharge it.
The test is three steps, in order.
Step 1: Is the exposure inside a prescribed regime?
Several regulations specify surveillance directly. Where one applies, the duty is set and the question of whether it is worthwhile does not arise.
The prescribed triggers most relevant to office-based, professional and education employers are narrower than the industrial list but they are not nothing. Night workers are entitled to a free health assessment under regulation 7 of the Working Time Regulations 1998, before assignment to night work and at regular intervals afterwards, which captures support desks, security teams and follow-the-sun operations that nobody thinks of as shift work. Display screen users may request an eye and eyesight test under regulation 5 of the DSE Regulations 1992, repeated at intervals thereafter, which is a duty on request rather than a programme but is still a duty.
Beyond those, regulation 9 of the Control of Noise at Work Regulations 2005 and regulation 7 of the Control of Vibration at Work Regulations 2005 require surveillance where the risk assessment indicates a risk to health, and regulation 22 of the Control of Asbestos Regulations 2012 requires medical examinations for licensed work. Education estates with workshops, theatres and grounds teams hit these more often than their central function expects.
If you land here, stop. The regime tells you the frequency and who must carry it out, and there is no discretion to exercise.
Step 2: If not prescribed, does the COSHH test bite?
This is where judgement lives, and where most organisations either over-buy or do nothing.
Regulation 11 of the Control of Substances Hazardous to Health Regulations 2002 requires suitable health surveillance where it is appropriate for the protection of the health of employees who are, or are liable to be, exposed to a substance hazardous to health. It then defines appropriate in two ways.
The first is the list route. Where an employee is exposed to a substance in column 1 of Schedule 6 and works in a corresponding process, with a reasonable likelihood that an identifiable disease or adverse health effect will result, medical surveillance by a relevant doctor is required at intervals of not more than twelve months, or more frequently if the doctor requires it.
The second is the general route, and it has four conditions that must all be satisfied. An identifiable disease or adverse health effect may be related to the exposure. There is a reasonable likelihood that it may occur under the particular conditions of the work. There are valid techniques for detecting indications of it. And the technique of investigation is itself of low risk to the employee.
All four. That is the sentence worth reading twice, because it disposes of most speculative programmes. Work-related stress has no validated screening technique of this kind, so it is managed through assessment and the controls rather than through surveillance. Meanwhile a respiratory sensitiser in a teaching or research laboratory satisfies every limb comfortably, which is why the organisation with an unnecessary company-wide medical scheme and no respiratory questionnaire for its lab technicians has the arrangement precisely inverted.
Step 3: If neither applies, is what you need occupational health instead?
Need Expert H&S Guidance?
Our qualified consultants can help you implement the right health & safety measures for your business.
The most useful question on the list, and the one that saves the most money.
If steps one and two produce nothing, you may still have a real need, but it is not health surveillance. Three different things get confused with it. A fitness for work assessment answers whether a particular individual can safely do a particular job, usually at recruitment or on return from absence. A management referral asks a clinician for an opinion on an individual case, including adjustments. And a wellbeing programme is a benefit, not a control, and discharges no statutory duty however good it is.
None of those is surveillance, because surveillance is systematic, population-based, repeated on a cycle, and read as data about your controls rather than as information about a person. An organisation that understands the distinction buys the right service. One that does not usually buys the expensive one and keeps the gap.
The UK triggers on one page
| Trigger | Instrument | Who it catches in a non-industrial setting | What is owed |
|---|---|---|---|
| Night work | Working Time Regs reg 7 | Support desks, security, follow-the-sun teams | Free health assessment before assignment and at intervals |
| Display screen use | DSE Regs reg 5 | Any designated user who asks | Eye and eyesight test on request, repeated at intervals |
| Schedule 6 substance and process | COSHH reg 11(2)(a) | Specialist laboratory and workshop activity | Medical surveillance by a relevant doctor, at most every 12 months |
| Other hazardous substance | COSHH reg 11(2)(b) | Sensitisers in labs, print and prototyping areas | Suitable surveillance, but only if all four conditions are met |
| Noise | Noise Regs reg 9 | Theatres, music departments, plant rooms | Surveillance where the assessment indicates a risk to health |
| Vibration | Vibration Regs reg 7 | Grounds, estates and maintenance teams | Surveillance where the assessment indicates a risk to health |
| Licensed asbestos work | CAR 2012 reg 22 | Specialist contractors, rarely direct employees | Medical examination under the licensed regime |
Two rows in that table apply to almost every employer reading this, and they are the first two. Night work is the most commonly missed duty in the whole of UK health and safety for office-based businesses, because the people it covers are described as being on a rota rather than on nights.
The part nobody plans for: the records
Health surveillance produces two separate records and conflating them is a data protection problem as well as a compliance one.
The clinical record belongs to the clinician and stays with them. The health record is the employer's, contains the particulars approved by the regulator, and records the outcome rather than the clinical detail. Under regulation 11(3) that record must be kept available in a suitable form for at least forty years from the date of the last entry.
Forty years is longer than most companies exist in their current form, which has two consequences people discover late. It survives a change of provider, so the record has to come with you rather than staying in the old provider's system. And it survives a transaction, which is why health records are a diligence item and an acquirer with no copy has bought an evidential gap. This is squarely where health and safety consultants and software are worth more in combination than separately: the health record needs to sit in a system you control, with the clinical detail staying where it belongs. The HSE's guidance on health surveillance sets out the principle.
Where it is mandatory whatever your exposure
International groups built on the UK model get a genuine shock here, because the UK approach is unusually permissive.
The UK asks whether a trigger applies. Several other countries simply require occupational medical provision as a standing arrangement. Article 14 of the EU Framework Directive 89/391/EEC requires measures for health surveillance to be introduced in accordance with national law and practice, and member states implemented that very differently.
Germany is the clearest contrast. Employers must appoint an occupational physician, and the ordinance on occupational medical prevention, the Arbeitsmedizinische Vorsorgeverordnung, prescribes mandatory, offered and voluntary categories of medical prevention for defined activities. The appointment itself is the duty, independent of whether any employee ever needs an examination, which is exactly the point British employers assume away. France routes it through occupational medicine with periodic individual monitoring of each worker's health as a standing obligation, and EU-OSHA's overview of the French system explains where the medical function sits and why it is confidential from management. Japan goes further again, with employer-funded periodic medical examinations for workers and results reported to the labour inspectorate above a headcount threshold.
So a group that has correctly concluded it owes no health surveillance in the UK may owe a physician in Germany, periodic monitoring in France and funded examinations in Japan. One group policy covering that is possible. One group answer is not, and periodic health and safety audits are how you find the entity that has quietly been out of step for three years.
Where Arinite fits
Arinite has spent 15+ years telling clients what they do and do not owe here, which frequently means advising against a programme rather than selling one. We support 1,500+ businesses in 50+ countries and protect 100,000+ employees, with 95%+ client retention. Our health and safety consultants work extensively with offices, education, legal and AI and data clients, where the night work and laboratory questions are the two that reliably surface.
For multi-country groups, our global health and safety consultants establish which jurisdictions require a standing medical arrangement rather than a triggered one, and our international health and safety consultants can tell you which of your entities needs an appointed physician before a local inspector raises it.
Run the three steps against your own operation, then check who is on nights. Then book a free gap analysis and we will tell you in one call whether your programme matches your duty.
Related Articles
Written by
Arinite Health & Safety Consultants
Health & Safety Expert at Arinite
