Most small business owners asking about occupational health are picturing something they cannot afford: a company doctor, an annual medical for every member of staff, a retainer with a provider.
That is not what the law asks for, and for the majority of small firms the real requirement is considerably narrower — often nothing at all. But where it does apply, it applies in full, because health surveillance has no small business exemption.
Does your work involve any of these?
Noise, vibrating tools, dust or fumes, or substances contacting skin
What occupational health actually means
It is not a company doctor. For a small business it means two separate things, and only one of them is usually a legal requirement.
Health surveillance is the ongoing checking of workers for early signs of harm from a specific known exposure. It is targeted, repeated at set intervals, and legally required in defined circumstances. This is the part that may apply to you.
Occupational health support — return-to-work assessments, fitness-for-work advice, management referrals — is a service you may choose to buy when you need it. Useful, sometimes essential in practice, but not something the law obliges a small employer to have on retainer.
Confusing the two is what produces the fear. A firm of eight people does not need a standing occupational health contract. It may well need annual hearing tests for three of them.
There is no headcount threshold
This trips people up, because other duties do have one. You only have to write down your risk assessment if you employ five or more people. There is no equivalent for health surveillance.
Regulation 6 of the Management of Health and Safety at Work Regulations 1999 requires every employer to provide health surveillance "as is appropriate having regard to the risks to their health and safety which are identified by the assessment." Two employees using a breaker daily are as covered as two hundred.
The trigger is the exposure, not the size of the business. A sole trader with one employee doing the wrong work can owe health surveillance that a fifty-person office owes nothing of.
The four things that usually trigger it
In small businesses, health surveillance almost always comes from one of four exposures.
What triggers health surveillance, and what it involves
| Exposure | What triggers it | What surveillance looks like |
|---|---|---|
| Noise | Risk assessment shows a risk to hearing — in practice, regular exposure at or above 85 dB(A) | Audiometry (hearing tests), usually annual then at longer intervals |
| Hand-arm vibration | Risk indicated, or exposure at or above 2.5 m/s² A(8) | Tiered: questionnaire, then assessment by a qualified person if symptoms appear |
| Dust, fume and vapour | Exposure where an identifiable disease may result — welding fume, wood dust, flour, silica, isocyanates | Respiratory questionnaire and lung function testing |
| Skin contact | Wet work or contact with irritants and sensitisers — cleaning, catering, hairdressing, construction | Skin checks, which a trained responsible person can carry out |
Regulation 9(1) of the Control of Noise at Work Regulations 2005 requires surveillance including hearing tests where the risk assessment indicates a risk. Regulation 7(1) of the Vibration Regulations does the same where risk is indicated or exposure reaches the action value.
For substances, COSHH regulation 11(2)(b) sets a four-part test. Surveillance is appropriate where an identifiable disease may be related to the exposure, there is a reasonable likelihood it will occur under your conditions, there are valid techniques for detecting it, and those techniques are low risk to the employee.
If you cannot point to an identifiable disease that your particular work could cause, health surveillance is probably not required. "We use chemicals" is not a trigger. "We use a respiratory sensitiser without adequate extraction" is.
Health surveillance is not medical surveillance
A narrower category exists, and it is worth knowing you are almost certainly not in it.
COSHH Schedule 6 lists substances requiring medical surveillance — carried out by a doctor appointed by the HSE. The list is short and specialist: vinyl chloride monomer, certain nitro and amino derivatives of phenol and benzene, and a handful of similar processes. Work with asbestos and lead carries its own medical surveillance requirements.
If you are not manufacturing those substances, you are in health surveillance territory, which is a great deal less onerous.
What you can do yourself
Not all of this has to be bought in, and providers do not always volunteer that.
Can be done in-house
- •Tier 1 HAVS questionnaires, by a trained responsible person
- •Routine skin checks, once someone is trained to do them
- •Keeping the health record itself
- •Recording exposure and trigger times
- •Acting on findings — that is your job either way
Needs a qualified provider
- •Audiometry — needs calibrated equipment and a controlled environment
- •Lung function testing and interpretation
- •HAVS tiers 3 and above, once symptoms appear
- •Any clinical judgement on fitness for work
- •Medical surveillance under COSHH Schedule 6
The tiered structure for hand-arm vibration exists precisely so small employers are not sending everyone for clinical assessment. A short annual questionnaire, administered properly and acted on, satisfies the requirement for people with no symptoms.
What it costs, and how it is charged
Two honest points, without pretending to quote you.
Health surveillance is almost always priced per person, per screening — not as a retainer. A firm with four people needing annual audiometry is buying four tests a year, not a contract. Providers who lead with a monthly fee are usually selling occupational health support alongside it, which may be worth having, but is a different purchase from the legal minimum.
Second, and this is a hard rule:
Section 9 of the Health and Safety at Work etc. Act 1974: "No employer shall levy or permit to be levied on any employee of his any charge in respect of anything done or provided in pursuance of any specific requirement of the relevant statutory provisions."
You cannot pass the cost of health surveillance to your staff, deduct it from wages, or require them to attend in unpaid time.
The records
Whatever you commission, you keep the record — and for a long time. COSHH, asbestos and lead all require the health record to be kept for at least 40 years from the date of the last entry.
Two things follow for a small business. Your provider holds the clinical record; you hold the health record, and you are entitled to the fitness outcome rather than the clinical detail. And a record that exists only in a provider's system is not one you control — get your copy when the surveillance happens, not when you need it.
Our guide to how long health surveillance records must be kept covers the periods and the health record versus medical record split in full.
If none of it applies to you
Most offices, shops and low-risk service businesses will not trigger health surveillance at all. That does not leave you with nothing to do:
- Assess the risks — the duty applies whatever your size, and it is what determines that surveillance is not needed
- DSE assessments for anyone using screens as a significant part of their work, and eye tests on request
- Consider stress as a work risk, not just a personal one — see occupational health
- Keep it under review, because buying one piece of equipment can change the answer
The one thing worth writing down is the reasoning. Recording that you considered health surveillance and concluded it was not triggered, and why, is far stronger than silence if you are ever asked.
Common mistakes
Assuming you are too small. There is no threshold. The exposure decides.
Buying a retainer for a legal duty priced per person. Work out what you actually need before signing anything.
Treating surveillance as the control. It checks whether your controls work. It does not replace guarding, extraction, quieter tools or job rotation.
Commissioning it and filing the results. A report showing early hearing loss that changes nothing about the work is documented evidence that you knew.
Charging employees, or expecting them to attend unpaid. Section 9 prohibits it.
Where to start
Start with your risk assessment rather than with a provider. It is the document that determines whether surveillance is required, and it is what a provider should be quoting against.
See risk assessment for the underlying duty, occupational health for what each exposure requires, and COSHH where substances are involved. The Approved Code of Practice for substances is at L5, and noise is covered by L108.