When is health surveillance required?
A common misconception is that health surveillance is a blanket requirement for anyone exposed to a workplace hazard. It isn't. Health surveillance is risk-based and selective, and the specific trigger depends on the hazard and the regulation that governs it. This guide sets out what health surveillance is, when it is legally required, the GB and Northern Ireland legal framework, what it looks like in practice, and how employers should set up and record a programme.
What health surveillance is (and is not)
Health surveillance is a scheme of repeated health checks used to identify signs of work-related ill health at an early stage, so that action can be taken before the harm becomes serious or permanent. It is not a general wellbeing check, and it is not a pre-employment medical. Crucially, it is not a control measure: it never makes harmful exposure acceptable. You still have to eliminate or reduce the exposure and maintain the controls. Surveillance sits alongside those controls as an early-warning system, it tells you whether people are being harmed despite the controls, and whether the controls are actually working. If surveillance is the only thing you are doing about a hazard, something is wrong.
When is it legally required? The general test
As a general, risk-based principle, health surveillance is appropriate where all of the following apply: there is an identifiable disease or adverse health effect linked to the exposure; there is a valid technique for detecting the disease or effect; there is a reasonable likelihood that it will occur under the particular conditions of the work; and surveillance is likely to further the protection of the workers concerned. That is the general framework used across HSE and HSENI guidance, but it is only the starting point. The precise legal trigger is set by the specific regulation that covers the hazard, so you should always check the regulation that applies rather than assuming any exposure automatically requires surveillance.
The legal framework: noise, vibration and COSHH
Different hazards are governed by different regulations, each with its own trigger. The three most common in general industry are noise, hand-arm vibration and substances hazardous to health.
Noise, Control of Noise at Work Regulations 2005
Health surveillance (usually audiometry, hearing checks) should be provided for employees who are regularly exposed at or above the upper exposure action value, or who are otherwise at particular risk. The upper exposure action values are a daily or weekly personal noise exposure of 85 dB(A) and a peak sound pressure of 137 dB(C). It is risk-based: the trigger is exposure and risk, not a fixed calendar rule for everyone. See noise at work action values.
Hand-arm vibration, Control of Vibration at Work Regulations 2005
Health surveillance must be provided where employees are likely to be regularly exposed above the vibration exposure action value despite control action, or are otherwise at risk. The aim is to detect the early signs of hand-arm vibration syndrome (HAVS) and carpal tunnel syndrome before they become disabling. See what is HAVS.
Substances hazardous to health, COSHH
Under regulation 11 of COSHH, health surveillance is required where an employee is exposed to a substance linked to an identifiable disease or adverse health effect, there is a valid technique to detect it, and there is a reasonable likelihood of the effect occurring, and in certain cases specified in COSHH Schedule 6. Typical examples include respiratory sensitisers (occupational asthma), skin sensitisers and irritants (dermatitis), and certain carcinogens. See what is COSHH. Asbestos and lead sit outside COSHH in their own regimes with their own medical-surveillance rules.
Great Britain and Northern Ireland are not identical
The regulations above apply in Great Britain. Northern Ireland has its own health and safety legislation, and you should not assume a GB regulation applies there unchanged. The Northern Ireland equivalents include the Control of Noise at Work Regulations (Northern Ireland) 2006, the Control of Vibration at Work Regulations (Northern Ireland) 2005, and, for substances hazardous to health, the Control of Substances Hazardous to Health Regulations (Northern Ireland) 2003. HSENI is the enforcing authority. The underlying risk-based approach is the same, but cite the correct jurisdiction.
What health surveillance looks like in practice
The form of surveillance follows the hazard. For respiratory sensitisers it may involve a respiratory questionnaire and lung-function testing; for skin sensitisers and irritants, structured skin checks for dermatitis; for noise, audiometry; and for vibration, the tiered HAVS approach below. The common thread is that the method has to be a valid technique for detecting the specific effect early, a generic "annual medical" is not health surveillance. The surveillance also has to be suitable and carried out competently: HSE has taken enforcement action against an occupational-health service provider over inadequate surveillance, underlining that simply having a provider in place is not enough if the surveillance itself is not fit for purpose.
The HSE HAVS tiers
For hand-arm vibration, HSE describes a tiered system of health surveillance. It escalates only as far as an individual's results require, which keeps clinical involvement proportionate:
| Tier | What it involves |
|---|---|
| Tier 1 | A short baseline questionnaire when someone starts work with vibrating tools. |
| Tier 2 | A short annual screening questionnaire, administered by a responsible person. |
| Tier 3 | Assessment by a qualified person (typically an occupational-health nurse) where screening flags symptoms. |
| Tier 4 | Formal diagnosis and assessment by a doctor with the relevant occupational-health competence. |
| Tier 5 | Optional standardised tests used to help assessment where needed. |
Noise surveillance in practice
Noise health surveillance normally means audiometry (hearing tests) for workers at risk, usually starting with a baseline and repeated periodically so that changes in hearing can be detected and acted on. HSE's guidance is risk-based and does not set a single universal timetable that applies to every workplace, so avoid publishing a fixed "initial, then 12 months, then every three years" rule as though it were the law, the appropriate frequency follows the risk and the guidance for the programme. As with all surveillance, the employer keeps a health record, while the detailed audiogram results are confidential clinical information held by the occupational-health provider.
How an employer sets up a programme
A workable sequence is: start from the risk assessment to establish which hazards are present and whether the regulation-specific triggers are met; identify the individual workers who are exposed; obtain competent occupational-health support to design and deliver the surveillance; carry out baseline or initial surveillance where appropriate; run the ongoing programme at the right intervals; and, most important, act on the outcomes. Health surveillance is worthless if the results are filed and forgotten. Linking surveillance requirements to roles, so the right people are picked up as they change jobs, also connects it to your wider training and competence records.
Health record vs confidential medical record
This distinction is central and often misunderstood. The employer needs to hold a health record for each worker under surveillance. That record should contain administrative information, who the person is, the type of surveillance and the hazard it relates to, the dates, and the outcome relevant to fitness or exposure management (for example "fit" or "refer"). It should not contain confidential clinical detail. The detailed clinical findings, questionnaire responses, audiograms, examination notes, diagnoses, are confidential medical information and belong with the occupational-health provider, not in an ordinary management file. Keeping the two apart protects the worker's confidentiality while still giving the employer what they need to manage the risk. Storing more clinical data than you need is not better compliance; often it is the opposite.
How long records must be kept
Retention depends on the regime, there is no single period for every health-surveillance record. The most-cited rule is COSHH: the employer's health record must be kept for at least 40 years from the date of the last entry, because some occupational diseases can develop many years after exposure. Treat that as a COSHH-specific requirement rather than a universal 40-year rule for everything, and check the specific regime for other hazards. Again, the long-retention duty applies to the (non-clinical) health record; confidential clinical records are held and retained by the occupational-health provider under their own arrangements.
What to do when surveillance finds a problem
A result that flags a possible work-related health effect is a prompt to act, not just to record. The employer should review the risk assessment and the exposure, check whether the controls (for example LEV, RPE, PPE or job rotation) are actually effective, obtain occupational-health advice on the individual, consider adjustments or restrictions where appropriate, and consider whether other similarly exposed workers may be affected. Some occupational diseases are also reportable, for example certain cases can be reportable under RIDDOR, so check the reporting duties. The objective is always to prevent further harm.
Run health surveillance as a managed programme
Complys keeps the records side in order: record which workers need health surveillance and for what hazard, track recall and review dates with reminders so nothing is missed, and hold the outcome status and supporting evidence for audit. The clinical assessment and confidential medical records stay with your occupational-health provider, Complys is not an occupational-health service and does not diagnose, test or store clinical findings.
Health surveillance software →FAQs
Is health surveillance always required?
No, it is risk-based and selective, not universal. The general principle is that it is appropriate where there is a known adverse health effect linked to the exposure, a valid technique to detect it, a reasonable likelihood of harm under the conditions of the work, and surveillance would help protect workers. The exact trigger, though, is set by the specific regulation, the upper exposure action value for noise, regular exposure above the action value for vibration, and the regulation-11 criteria for COSHH, so check the one that applies rather than assuming any exposure requires it.
What are the common triggers?
Noise (audiometry where workers are at risk, typically at or above the upper exposure action value under the Control of Noise at Work Regulations 2005), hand-arm vibration (Control of Vibration at Work Regulations 2005), and substances hazardous to health under COSHH, for example respiratory sensitisers, some skin irritants and certain carcinogens. Other regimes such as asbestos and lead have their own separate requirements.
Does health surveillance replace controlling exposure?
No. Health surveillance never makes harmful exposure acceptable. It sits alongside controlling the risk, you still eliminate or reduce exposure and maintain the controls. Surveillance is an early-warning check that people are not being harmed and that the controls are working, not a substitute for them.
How long must health surveillance records be kept?
It depends on the regime. Under COSHH the employer's health record must be kept for at least 40 years from the date of the last entry, because some occupational diseases develop decades after exposure. That is a COSHH-specific rule, not a universal period for every record. The employer's health record is also separate from the confidential clinical record held by the occupational-health provider.
Who carries out health surveillance?
The surveillance itself and any clinical or fitness judgement are carried out by occupational-health professionals or other competent people, not by an employer or by software. The employer identifies who needs it, arranges it, acts on the outcomes and keeps the (non-clinical) health record.
Is the law the same across the UK?
The principles are similar but the legislation differs. Great Britain uses the Control of Noise at Work Regulations 2005, the Control of Vibration at Work Regulations 2005 and COSHH 2002. Northern Ireland has its own equivalents, including COSHH (Northern Ireland) 2003. Do not assume a GB regulation applies unchanged in Northern Ireland.
Related: what is HAVS, noise at work action values, what is COSHH, what is a risk assessment, and health surveillance software. General information, not legal or medical advice.