Hi, 

The company I work for currently has an 'individual risk assessment' form used for invidividual staff members who disclose an injury or medical condition etc. to decide upon activities the individual may be unable to perform, or if as a result of the injury or health condition they are taking any medication that may affect their ability at work or serious side affects we need to be aware of. 

I am looking to update this, but cannot find anything online to help me do so. Do any other companies have a form like this? 

Thanks

B

Sounds like an OH referral to me

Hi

I've completed one for a member of staff that had Addison's disease. It was done in conjunction with the person's specialist and provided details of the individual, the symptoms associated with the condition, the tasks undertaken and risk reduction procedures in place (in the person's case the main issue was driving between locations so they wore a medical identification bracelet, kept a supply of oral medication and an injection kit in the car with simple instructions plus had to inform staff when they had set off and when arrived etc).

I made sure the specialist had checked through it and agreed everything I'd written then got the person and her specialist to sign it. We then reviewed after 6 months internally then annually. We also had a debrief if the person reported any incidents relating to her condition to check that the assessment was still valid and that there was nothing we'd missed or any new symptoms that we needed to consider.

The person has since left the organisation as it was a few years back (before GDPR legislation!)

Hope this helps...

Edited by user 26 March 2019 16:00:03(UTC)  | Reason: added an extra line

Originally Posted by: jdc1975@hotmail.co.uk

This is a massive area for GDPR and you as a Safety practitioner should not even have access to such medical records.

2) The OP was talking about an individual RA based upon medical/health circumstances NOT the individuals medical records.

3) As the companies competent person why shouldn't the H&S bod have communication regarding health issues - different approaches exist dependent upon the size/nature of a business and the arrangements they choose to set in place. In my organisation I receive the summary surveillance reports from OH to act upon (including re-scheduling individuals who were "unfit" for certain tests on the day e.g. due to a cold) - in a previous employment they went to the MD who then sought management team advice.

4) The DPA does not "trump" other legal duties placed upon employers

Only if your organisation operates in more than one EU member state and you have the responsibility for implementation of Data Protection across all borders.

UK business = UK legislative act or Statutory Instrument which may include interpretation of European Directive or adoption of European Regulation.

Not all businesses are arranged in the same manner - many do not have an HR person let alone a function - so you should not assume what is normal for you applies anywhere else.

Care to enlighten the forum with the full list of all EU legislation that MUST be read side by side with its UK equivalent? Your comments indicate I, and probably many others, have serious omissions to address in the "certified as meeting the requirements of.. management systems" externally audited legal registers.

Some points to note, in my opinion from the above comments: -

1. In the UK the DPA applies. GPDR does not and hopefully in the future will not.
2. H&S Laws overrides the DPA where it is applicable.
3. Data is stored for a reason. If the reason for its storage is H&S related, then the H&S practitioner has a legitimate reason to see it, including medical records. Trust me: working in health and social care as a safety practitioner, I am furnished with the most confidential information when I need to see it, often to keep people safe. For example, I may need to see a person’s criminal conviction or mental health assessment to keep our staff safe when working with or supporting them.
4. Outwith some exceptions, I do-not believe we should be conducting risk assessments on people (or person specific risk assessments). For one reason RA are to subjective, for another its not right and proper to risk rate a person per se.
5. OT, HR, GP’s, Healthcare and Safety Practitioners should work together to ensure the safety of people whilst at work. This attitude that it is someone else’s responsibility (OH referral) is a cause for concern. We should be more joined up in these matters and I see this as a multi-disciplinary function. Think about the staff member being battered form pillar to post.

Just saying.

Edited by user 28 March 2019 23:16:11(UTC)  | Reason: Not specified

This is the conundrum isn't it. I agree the HS personnel should receive and interprete the result but the DPA 2018 itself contracts that slightly. So the original results go to the HR, who forward it to the HS person, who then do what with it?

If the HS person email is hacked and the data gets compromised, what happens then? This needs careful review in my opinion. I never did understood why the results should come straight to myself at the time either. However, it was the company's policy so I adhered to it.

Totally get what you are saying about the HS person having the right knowledge etc. However, the HR team can equally be trained to identify those with high or low results and communicate effectively with them as per company's policy. I still will not agree to having the raw data sent to the HS person. Let it go to HR, who communicate to the IP, then HR will let the HS person know who needs what.

Originally Posted by: jdc1975@hotmail.co.uk

This is the conundrum isn't it. I agree the HS personnel should receive and interprete the result but the DPA 2018 itself contracts that slightly. So the original results go to the HR, who forward it to the HS person, who then do what with it?

Date Protection laws are precise as to the reason why data is being retrieved, used, stored and destroyed. In you example the data  being retrieved is for H&S purposes and H&S Law, i.e. CLWR. So no – the DPA does not contradict why you are retrieving the data.

Lead presents a specific hazard that often needs specialist advise for its control. The specialist advice normally comes from the safety practitioner and not HR people. So, I would expect the safety bod to know exactly what to do with the results of the OH tests.

I remember auditing a large organisation whereas OH skin examinations and lung function tests went directly to the HR department. They duly filed the results in the employees HR files. During the audit, after eventually convincing the HR people as an auditor that I had a legitimate reason to see the results, I had unearthed that a number of the spray painters had low lung function test results and one had a chronic respiratory disease. The OH results had identified these issues over a number of years but because the HR people simply filed the results, they went un-noticed, despite the large red text on the assessments suggesting the employees visit their GP’s as a matter of urgency.

Originally Posted by: toe

I remember auditing a large organisation whereas OH skin examinations and lung function tests went directly to the HR department. They duly filed the results in the employees HR files. During the audit, after eventually convincing the HR people as an auditor that I had a legitimate reason to see the results, I had unearthed that a number of the spray painters had low lung function test results and one had a chronic respiratory disease. The OH results had identified these issues over a number of years but because the HR people simply filed the results, they went un-noticed, despite the large red text on the assessments suggesting the employees visit their GP’s as a matter of urgency.

As a matter of interest were you performing an external audit and did that large organisation have access to their own nominated safety advice?

Regards.

Edited by user 29 March 2019 10:30:37(UTC)  | Reason: Not specified

The only data from health surviellence that a safety person should see is the management summary which is not person specific...https://www.medicalprotection.org/uk/articles/eng-confidentiality-general-principles

I am not sure how you (as an H&S bod) can (as Dave says) manage the risk to a person if you are not allowed to see any medical information relating to that person. If it is established that, for example, an individual is at particular risk of an asthma due to a chemical used in a process; do you stop doing that process even though only one employee out of many is affected? You could insist that everybody takes precautions even though only one person needs them. In the case of PPE, how will you persuade people to wear it if it is not for their benefit?

Sometimes Health and Safety has to be personalised and that means you need personal information.

Rebbekah T

I use the same risk assessment format for this type of risk assessment as I do for all other risk assessments.  As for DPA / GDPR , I wouldn't worry too much about them.  As others have said health and safety takes priority.  The company has a duty of care to protect the employee.  Also providing a medical practitioner has certified them fit for work you'll be fine. 

GDPR regulations 

PART 2Restrictions based on Article 23(1): restrictions of rules in Articles 13 to 21 and 34

4. The function is designed—

(a)

to secure the health, safety and welfare of persons at work, or

(b)

to protect persons other than those at work against risk to health or safety arising out of or in connection with the action of persons at work. 

RebbekahT

I do the risk assessments for individuals based on their applicability under the Equality Act 2010.  For example, someone with diabetes might need more breaks to eat at regular intervals, someone with Crohns or UC may need to be closer to the toilet or may suffer from excessive fatigue, someone with back problems may need an external ergonomic assessment and specialist equipment.  I ask the person in advance if they're happy to have their risk assessment done by me and then for them to furnish me with details of their specific illness/type so I can read these in advance of the meeting to get a better understanding. 

Most people, I have found, are more than happy to share this information in the hopes of getting better understanding and support from their employer.  We then discuss their specific issues, what the doctor and consultant say and how we can best help them.

The whole lot is written on a dynamic risk assessment form and sent to the HR Department and the employee.  The employee's Manager is then sent a document outlining the changes that will be required to accommodate the employee under the Equality Act but with no further detail.  The master risk assessment will be kept on a confidential file that I hold and we revisit it every 6 - 12 months to ensure that everything is still the same.

It works well.