Ethics Guidance for Occupational Health Practice 9th Edition - Book - Page 45
Ownership & Transfer of Records
Ownership
3.42. For in-house providers of occupational health services, the employer owns the
notes, paper and filing cabinet, but the contents are the intellectual property of
the occupational health professionals. Similarly, for electronic records, the
hardware and software programmes are the property of the employer, but the
data held within them are the intellectual property of the occupational health
professionals creating them. Therefore, the contents cannot be accessed by the
employer or their agents, other than the occupational health department,
without the consent of the data subject.
3.43. Occupational health records generated and held by outsourced providers or
contractors, will normally remain the property of the occupational health
provider unless alternative contractual arrangements have been made.
Transfer of records
Where a company changes its occupational health provider
3.44. Where a company changes its occupational health provider (either in-house or
outsourced) it is generally good practice and in the best interests of all parties
for records to be transferred to the incoming occupational health provider.
Whilst there is no specific legal requirement to transfer records between
providers, individual best efforts should be made to agree arrangements for
transfer between the parties concerned. It is good practice to ensure this is
agreed at the outset of a new working arrangement. The data controller for the
outgoing service should ensure that records are only transferred to competent
persons (normally occupational health professionals) or the subjects of the data.
There have been many instances in which new providers have requested only
part record transfer.
3.45. The practical aspects of transferring records between providers providing offsite services are more challenging than transferring records held on the
employer’s premises. Records of which files have been transferred should be
made as an audit trail, and an appropriate secure method of transfer must be
utilised. The outgoing provider may make a reasonable charge to cover the
costs associated with the transfer of records.
Page | 44
