The short answer
Build the access boundary first. The employer is entitled to an opinion on fitness and adjustments; they are not entitled to the clinical detail behind it. A system that does not enforce that separation structurally will leak it eventually.
Everything else follows from that decision.
Two records, one case
| Document | Audience | Contains |
|---|---|---|
| Clinical record | Clinician, individual | Full assessment and history |
| Employer report | Employer | Fitness, adjustments, timescales |
| Consent record | Both, auditable | What was agreed to be shared |
Consent is the hinge. In many jurisdictions the individual has rights over what is shared and when, including sight of the report first. That workflow belongs in the system rather than in someone's inbox.
Referral and scheduling
- Employer raises a referral with the reason and the questions to answer
- Individual is contacted and consents to the process
- Appointment arranged, in person or remote
- Assessment completed and report drafted
- Individual reviews where they have that right
- Report released to the employer, and the release is logged
Each of those steps has a clock the employer cares about, and a set of permissions that differ by step. A generic case management tool usually gets the permissions wrong.
Reporting to the employer
Employers want aggregate insight: absence patterns, referral volumes, common causes, whether adjustments worked. That is legitimate and it has to be genuinely aggregate.
Small numbers are the risk. A report on a team of six can identify an individual even without naming them, so minimum group sizes need enforcing rather than leaving to judgement.
Retention differs from ordinary HR data
Occupational health records are clinical records with their own retention requirements, usually longer than employment data and separate from the employer's own systems.
Keep them separate physically or logically, and make sure that an employer ending the contract does not take clinical records with them. That should be settled in the agreement, not discovered at the end.