Oh Occupational Health and Wellbeing

Mobile menu open

How we store and use your health information and records

This page is for all patients, this explains how Oh Occupational Health and Wellbeing, a part of Cambridge University Hospitals NHS Foundation Trust (CUH) uses and safe guards your personal information.

Oh Occupational Health and Wellbeing keep information about you and your care in various formats including in our electrical patient record system, paper and other computerised records. This includes your personal information:

  • Name
  • Address
  • Date of birth
  • Next of kin
  • Contact details
  • Your G.P details

It also includes your clinical information, such as procedures and treatments in the service.

Your records are identified by a occupational health record number, and used only when in the service.

Will the OH professional inform or write to my manager?

If your manager has referred you, then the Oh Occupational Health and Wellbeing professional will provide a report for them answering the questions asked on the referral form. Please see further information on our website regarding the referral appointment and consent process.

If you have been seen for pre-employment a certificate of fitness will be sent to your manager after your appointment and or any advice in relation to any restrictions or adaptations required (this will be discussed with you).

If you have been seen for health surveillance a report will be sent back to your manager in relation to any actions or advice required to keep you safe at work (PPE/RPE/Controls/Risk assessments etc.) and whether a further review or annual health surveillance appointment will be required.

If you have attended for a blood test or immunisation you may request an immunisation report for your records. You will not have to pay for the first report but may be charged up to £5 for subsequent report requests. Information on your immunity is may be provided to your manager to ensure compliance with trust mandatory screening requirements and to ensure immunity in the event of an potential infection exposure at work for example: TB, VZV, Shingles, measles contact. You will have signed consent for the release of this information on your immunisation and screening questionnaire that you submitted to Oh Occupational Health and Wellbeing as part of your recruitment process when you first started.

Accessing hospital records

Occupational health staff have access to the Trusts’ health records system. Oh Occupational Health and Wellbeing take the accessing of health records seriously and all staff come under the same information governance and data protection policies as the rest of the Trust. Oh staff with permission to access hospital records have attended trust training and are only allowed to access your hospital records in relation to the results of blood tests or MRSA screening undertaken specifically in and for Occupational health.

Bloods taken at your GP: You may give permission for these results to be checked by an Oh Occupational Health and Wellbeing clinician only if these are relevant to your role i.e Hepatitis B immunity results post immunisation schedule. Oh Occupational Health and Wellbeing clinicians are not personally allowed to access health records for anything unrelated to Occupational Health and or to check results/records on your behalf for*:

  • Any results of blood tests undertaken by your GP/specialist or other health professional
  • Any results of scans, tests or other investigations
  • Any notes (medical or otherwise)
  • Any other entries

*Exception: Physiotherapists may ask for your permission during consultation to access records such as X-ray or MRI results. Consent given by you to allow them to access records during consultation will be clearly documented in your records.

To summarise

The role of our department is to help staff remain at work, and remain healthy. Where staff are unable to work because of ill health, our role is to assist in rehabilitation back into work, or, where this is not possible, to look at alternatives. If you have any questions about your appointment, please ask the Oh Occupational Health and Wellbeing professional when you attend.

Clinic consultations are categorised into common health problems (morbidity data) so we can monitor for work-related illnesses and thereby focus our preventative service.

Anonymous data on numbers of appointment attendances, clinical activities and morbidity data may be shared with your employer to monitor the Oh Occupational Health and Wellbeing service provided and to help maintain health and safety in the workplace.

What type of occupational health personal information is protected by the Data Protection Act 2018?

All staff/client health records inputted to the Oh Occupational Health and Wellbeing database which includes:

  • your name
  • address
  • DOB
  • health reports
  • immunisation records
  • consultation records
  • any other health information about you we place on our system

It is held as part of our routine filing process and enables us to produce anonymised data to help us build better services and to show what work activity is happening; this guides us in developing support processes for staff generally and also assists us in budgeting as services delivered increase.

All your health and personal information is held securely and is not accessible by any other department, Trust or organisation.

Can I access my file?

Yes, you can access your own file and it is your right to do so.

What do I have to do to access my file?

It is a simple and easy process. Just write to us requesting a copy of your file or call in and sign a consent to release form and we will print off your file or you can read it on screen in person.

Can you email my files to me?

No, The files can not be sent via E-mail as you do not have the data base system we use so you would be unable to read it once received. But files can be sent securely in paper form, when sent by tracked and signed post.

Are there any exceptions to me being able to access my own records?

Yes, Personal data relating to an individual’s physical or mental health. This applies only in certain circumstances and only if granting a subject access would be likely to cause serious harm to the physical or mental health of the individual or someone else

Who else can see or access my personal occupational health files/record?

Only the relevant Oh Occupational Health and Wellbeing staff can access, read or print any records held by Oh Occupational Health and Wellbeing. This includes paper and digital records/files.

The Oh Occupational Health and Wellbeing team, all of them, sign an annual confidentiality agreement to maintain security and confidentiality of your records/ files.

The record system is coded and allows only the Oh Occupational Health and Wellbeing team access. Please note: some details must be provided in relation to police investigations into a specific incident or crime, or in accordance with legal requirement.

What information is shared with my doctor (GP) or hospital doctors?

No information is shared with or requested from your GP or specialist without your permission. If the Oh Occupational Health and Wellbeing professional requires further information about your health in relation to a management referral in order to be able to advise managers, they will request your permission to contact your GP or specialist. You will be asked to sign a consent form for a medical report (in line with the Medical Reports Act) to access additional information.

Are there any exceptions when you would divulge my personal record/file to a third party without my consent?

Yes, If we believe that you are seriously ill and your health presents a danger to yourself or others, but this would be done with your knowledge and sensitively used with relevant other professionals.

What if I leave employment and move to another employer, what happens to my records then?

If you leave, we will keep your records securely sealed, for as long as guidance recommends in line with the Data Protection Act 2018 before being destroyed. Your new employer (but only the Occupational Health service for your new employer), can ask you to consent to transfer of your records; once we receive your written informed consent we would contact you to discuss transfer of the record

Do I have the right to object to the way my record/ information is used?

Yes, you have the right to share your concerns and summit objections to who has access to your information, what is shared and how its is stored.


If you should have any concerns regarding the inappropriate use of or inappropriate access of your health records please raise your concerns to an Oh Occupational Health and Wellbeing professional either at an appointment, at reception or contact us on 01223 216767 to speak with one of the senior team .

Relevant legislation/guidance

As a user of our service and an employee of Cambridge University Hospitals NHS Foundation Trust or of a contractor working on Trust premises we hold information about you under Article 6 (1)(e) and Article 9 (h) of the GDPR legislation.

If you work for another employer whom we are contracted to provide services on behalf of, we hold information about you under Article 6 (1)(b) and Article 9 (h) of the GDPR legislation.

This includes procedures on storing your information securely, how long we keep it and when it is destroyed. Information about your care is also used to support local and national clinical audits, service improvements, education, contracting and research. However, the following conditions and exceptions may apply:

Clinical Audit

Clinical Audit reviews the current standards of care against best practice standards. This is to ensure the service maintains high standards. Audit results are discussed by clinicians to make improvements to care. The results can be published or presented but always in an anonymised format so that individual clients cannot be identified. Audit staff viewing clinical audits, medical notes and computer files, like all others with access to your information, are legally bound to ensure confidentiality.


Research seeks to investigate new treatments, interventions and management procedures in order to continually improve outcomes. Research looks at what could be done in the future, whereas audit looks at what has been done. Any information used for the purposes of research is anonymised.

UK National Research Ethics Committees often allow health researchers to use clinical information anonymously (without any personal information) for medical research where this does not require any additional contact with patients.

Cambridge University Hospitals NHS Foundation Trust participates in research to benefit patient care, and so your information could be studied anonymously but only after approval by a National Research Ethics Committee. If your identifiable personal information (the information that identifies you) is to be used in research you will be asked for your consent. However a specially appointed national body, the Confidentiality Advisory Group (CAG), may allow personal details to be used without consent in specific circumstances when the research is seen to be in the public interest.

Information Reporting

Anonymised data is sometimes passed for entry into national registers e.g. influenza vaccination records and other national and local databases held about various illnesses. This information is used for management purposes and from a public health perspective to identify where and what types of illnesses the workforce suffer from.

Service Management

Your information is used to help us manage and develop our Occupational Health service. Anonymised data may be provided to the departments / committees within your organisation that monitor the provision of Occupational Health.


The information could also be used to educate other Doctors, Nurses and Health Care Professionals involved in Oh Occupational Health and Wellbeing. Again any information used for the purposes of training is anonymised.

Suggested reading

  • Data Protection Act 2018.
  • What happens to information held about you’, Information Governance, Cambridge University Hospitals. August 2015 (amended November 2018).
  • General Data Protection Regulation 2018 (Article 6 (1)(e) and Article 9(h) for CUH employees.
  • Article 6 (1)(b) and 9 (h) for employees of other employers we support.

Contact us

Tel: 01223 216767
Email the OH helpline

Visit us

Oh Occupational Health and Wellbeing
Box 172, Cambridge Biomedical Campus
Hills Road, Cambridge CB2 0QQ