TL;DR
- If workers stay exposed to a health risk after controls are applied, then health surveillance is likely a legal duty — not an option.
- If your main defence is PPE, then surveillance is triggered, not waived; PPE is the least reliable control tier.
- If the agent is asbestos, lead, or ionising radiation in the UK, then a statutory appointed doctor must run the surveillance.
- If you operate across borders, then a single UK-built policy will break — US participation is voluntary, EU rules are set member-state by member-state.
Health surveillance at work is legally required when workers remain exposed to a health risk after control measures are applied, and that exposure links to an identifiable, detectable disease. In the UK this sits under COSHH and hazard-specific regulations; in the US, OSHA’s hazard-specific medical surveillance standards apply; the employer always pays.
This article is general HSE guidance for compliance decision-makers. It is not medical advice and does not replace input from a competent occupational health professional. Workers with symptoms or exposure concerns should consult an occupational physician.
It is also not legal advice. Regulatory content reflects general professional understanding of UK, US and EU requirements as of 2026; statutory duties vary by jurisdiction and must be verified against the current text of the applicable regulation. Direct specific compliance or enforcement questions to qualified legal counsel.
Regulation 11 of the Control of Substances Hazardous to Health Regulations 2002 (UK) carries a duty most employers underrate. Where a worker is exposed to a substance tied to a detectable disease, suitable health surveillance must be provided — and the records can outlive the employment by decades.
Health surveillance at work is not a wellness perk or an annual box to tick. It is a statutory early-warning system that simultaneously tests whether your controls are actually working, and getting the trigger test wrong creates real liability. This guide covers when it is legally required, how the trigger test operates, and how the duty shifts across the UK, US and EU.
What Is Health Surveillance at Work — and What It Is Not
Health surveillance is a scheme of repeated, structured health checks designed to detect work-related ill health early and to confirm your controls are holding. It does two jobs at once: protect the individual through early detection, and act as a feedback loop on the risk assessment.
It sits downstream of the hierarchy of control. Surveillance responds to residual risk — the exposure that survives your engineering controls and PPE — and it never substitutes for eliminating or reducing the hazard at source.
Most confusion comes from blurring it with adjacent activities that look similar but answer different questions.
| What health surveillance is | What it is not |
|---|---|
| Ongoing, exposure-linked monitoring over time | A one-off pre-employment “fit-to-work” medical |
| Triggered by residual risk after controls | General wellbeing or lifestyle screening |
| A legal duty under specific regulations | Voluntary health promotion (flu jabs, BMI checks) |
| Feedback into control review | Health monitoring alone (data with no action) |
| Hazard-specific (noise, dust, vibration) | A generic annual medical for all staff |
The most common failure mode I see across published audit findings is surveillance run as a disconnected annual event. Abnormal results get filed, but they never feed back into changing a control — so the scheme becomes data collection, not risk management.
One term deserves an early flag. “Health surveillance” is the UK umbrella; “medical surveillance” is a higher-tier subset that must involve a doctor, and the two are not interchangeable — more on that below.
When Is Health Surveillance Legally Required? The Trigger Test
Under COSHH 2002 (UK), the duty is risk-assessment-driven, not job-title-driven — surveillance is required where a real, detectable health risk remains after controls. The practical test, drawn from HSE’s official health surveillance guidance, turns on four conditions being met together.
- An identifiable disease is linked to the exposure (for example, occupational asthma from isocyanates).
- A valid technique exists to detect the disease or its early indicators.
- Detection is reasonably likely under the actual work conditions and exposure levels.
- Surveillance benefits the worker — early detection allows meaningful action.
When all four hold, surveillance is a legal requirement, not a discretionary nicety. The same four-part logic underpins HSE’s COSHH health surveillance guidance.
A second trigger catches more employers than the first. Where exposure control relies on PPE — which can fail, fit poorly, or be misused — surveillance becomes a necessary safeguard precisely because the control is fragile.
Beyond COSHH, several UK regimes mandate surveillance in their own right:
- Control of Noise at Work Regulations 2005 — audiometry above defined action values.
- Control of Vibration at Work Regulations 2005 — HAVS assessment for hand-arm vibration.
- Control of Lead at Work Regulations 2002 — biological monitoring and medical surveillance.
- Control of Asbestos Regulations 2012 and Ionising Radiations Regulations 2017 — doctor-led medical surveillance.
Not every check is statutory. Some surveillance is advisable under the general duty of care rather than legally compelled — and conflating the two leads either to over-spend or to a compliance gap.
The misconception worth correcting bluntly: “we provide PPE, so we don’t need surveillance.” Reliance on PPE is a trigger, not an exemption, because respiratory and hearing protection sit at the bottom of the control hierarchy where reliability is lowest.
Hazards That Commonly Trigger Surveillance
Mapping the hazard to its surveillance method lets you self-identify quickly. The pattern is consistent across the regulated agents.
| Hazard | Typical surveillance method | Governing regulation | Jurisdiction |
|---|---|---|---|
| Noise | Audiometry (hearing checks) | Control of Noise at Work 2005 | UK |
| Hand-arm vibration | HAVS questionnaire + tiered assessment | Control of Vibration at Work 2005 | UK |
| Respiratory sensitisers (isocyanates, flour/grain dust, wood dust, solder flux) | Lung function (spirometry) + respiratory questionnaire | COSHH 2002 | UK |
| Skin sensitisers / wet work | Skin inspection for dermatitis | COSHH 2002 | UK |
| Asbestos, lead, ionising radiation | Medical surveillance (doctor-led) | Asbestos 2012 / Lead 2002 / IRR 2017 | UK |
Health Surveillance vs Medical Surveillance: Why the Distinction Matters
The single most expensive mistake here is treating “health surveillance” and “medical surveillance” as the same thing — they sit at different tiers and demand different people. Misclassify the tier and you either overpay or under-comply.
In the UK, medical surveillance is a statutory subset reserved for the highest-risk agents.
- Doctor-led by law. Asbestos, lead, and ionising radiation require an HSE-appointed doctor, with formal record implications.
- One narrow exception. Some lower-risk asbestos work can be handled outside full medical surveillance, but the default is doctor-led.
- General health surveillance can be tiered down — trained supervisors or OH technicians can run skin checks and questionnaires where the law allows.
The US frames the same territory differently, which trips up readers searching the UK term.
- Medical evaluation — a one-time clearance, for example before respirator use under 29 CFR 1910.134.
- Medical surveillance — ongoing, exposure-based periodic monitoring embedded in hazard standards.
The judgment call I see organisations get wrong runs both ways. Many over-spend by sending everyone to a physician when an OH-nurse questionnaire or supervisor skin check would satisfy the duty — others under-comply by using a nurse where the law demands an appointed doctor.
How the Requirement Differs by Jurisdiction: UK, US, EU
The three major regimes share one principle — the employer funds the surveillance — but diverge sharply on terminology, structure, and whether a worker can be compelled to take part. For multinational employers, that divergence is where single-jurisdiction policies quietly fail.
| UK (HSE) | US (OSHA) | EU | |
|---|---|---|---|
| Operative term | Health surveillance | Medical surveillance / evaluation | Health surveillance (per directive) |
| Governing law | COSHH 2002 + hazard regs | Hazard-specific standards | Directives transposed into national law |
| Who must undergo it | Compellable as a role condition | Made available; usually voluntary | Member-state-specific |
| Who pays | Employer | Employer, at no cost to worker | Employer |
| Records kept | Up to ~40 years (COSHH) | Per access-to-records rules | Member-state-specific |
In the US, surveillance is embedded standard-by-standard rather than in a single umbrella rule. The OSHA medical surveillance standards index lists obligations under lead (1910.1025), respirable crystalline silica (1910.1053 / 1926.1153), asbestos (1910.1001), respiratory protection (1910.134), HAZWOPER (1910.120(f)) and the noise standard (1910.95).
The critical US/UK divergence is participation. OSHA generally requires the employer to make surveillance available at no cost, but an employee usually cannot be forced to undergo it — whereas in the UK it can be a statutory condition of doing the work.
The EU operates through directives that each member state transposes into national law. The Chemical Agents Directive (98/24/EC), the Carcinogens and Mutagens Directive (2004/37/EC) and the Asbestos at Work Directive (2009/148/EC) set the floor, but the operative detail lives in national statute.
A current example is reshaping asbestos surveillance. Directive (EU) 2023/2668 amended the asbestos framework to cut the binding occupational exposure limit tenfold — from 0.1 to 0.01 fibres/cm³ as an 8-hour TWA — with member-state enforcement of the lower limit from 21 December 2025 and a further reduction due by 21 December 2029, as set out by EU-OSHA on the Asbestos at Work Directive.
The practical trap: export a UK-built program across US and EU sites unchanged, and it breaks on two points — US voluntary participation and EU national-transposition variance.
How Often Is Health Surveillance Required, and Who Carries It Out?
In practice, frequency is set by the live risk, not the calendar — there is no universal annual interval, and cadence should rise or fall with exposure. The competence required scales with the hazard’s severity.
Surveillance follows a recognisable arc:
- Baseline — an initial check before or at the start of exposure, giving a reference point.
- Periodic — recurring checks at intervals matched to exposure intensity and uncertainty.
- Exit / post-exposure — checks when work ends, and continued surveillance for latency diseases where harm appears years later.
Frequency should tighten where it is unclear whether harm is occurring, and ease only when risk demonstrably falls with occupational health advice. The recurring governance gap is a frequency set once and never revisited — even after a new process or higher throughput changes the exposure.
Competence is tiered to the hazard:
- Trained supervisor — basic checks such as routine skin inspection for dermatitis.
- OH technician / nurse — audiometry, spirometry, structured questionnaires.
- OH physician / appointed doctor — medical surveillance for asbestos, lead, ionising radiation.
On cost, the answer is the same in all three regimes: the employer pays, and in the US it must be at no cost to the worker — typically arranged on work time.
What Happens With the Results: Records, Acting on Findings, and Worker Rights
The duty does not end when the check is done — surveillance generates obligations around records, corrective action, and confidentiality. This is where competent programs separate from box-ticking ones.
- Record retention is long. UK COSHH health records must be kept for around 40 years, reflecting the long latency of diseases like mesothelioma; US rules govern employee access to exposure and medical records separately.
- Adverse findings must drive action. A confirmed work-related case should prompt redeployment, a control-measure review, and where relevant a statutory report (RIDDOR-reportable diseases in the UK).
- Confidentiality has a hard boundary. The employer receives the fitness outcome and recommendations — not the clinical detail — and worker consent and access rights govern the underlying records.
The justification for the 40-year window is the latency data: around 11,000 lung disease deaths each year in Great Britain are linked to past workplace exposures, split across COPD (35%), non-asbestos lung cancer (23%), asbestos-related lung cancer (20%), mesothelioma (20%) and other causes (3%) (HSE, 2025).
The governance failure I see most often is the loop left open — abnormal results are recorded but never trigger a review of the control that allowed the exposure. The legal and moral point of surveillance is the corrective action, not the filed report.
Frequently Asked Questions
Conclusion
The regulatory direction of travel is toward tighter, evidence-led surveillance, and the EU asbestos changes are the clearest signal. With the binding exposure limit cut tenfold and enforcement of the lower figure live since December 2025, surveillance and worker-register duties for asbestos-exposed workers are intensifying — and a further reduction lands in 2029.
For anyone deciding whether health surveillance at work applies to them, the lasting test is simple to state and harder to dodge. If residual risk remains after your controls and is tied to a detectable disease, the duty is live — whichever jurisdiction you operate in, and regardless of the PPE you issue.
The work ahead is keeping frequency tied to the live risk assessment, matching the right competence tier to each hazard, and making sure every abnormal result forces a control review rather than a filing entry. Get those three right and surveillance does what the law intends: it catches harm while it can still be reversed.