Occupational health medical history disclosure

Short answer

No. Occupational health at a university cannot lawfully require you to disclose your entire medical history, and you cannot be forced to hand over comprehensive records. Both data protection law and the specific consent rules around medical reports mean that disclosure should be limited to what is genuinely relevant to the specific occupational health question being asked, and it generally cannot happen without your consent.

The legal framework

Two overlapping sets of rules apply.

First, data protection law. Health information is special category data under the UK GDPR and the Data Protection Act 2018, which attracts heightened protection. The Information Commissioner’s Office (ICO) guidance on occupational health schemes is explicit that an employer should not normally ask a worker to consent to the disclosure of their entire medical record, or of comprehensive hospital care and treatment records, because the employer is highly unlikely to need to see the whole record. The governing principle is data minimisation: only information that is adequate, relevant and limited to what is necessary for the specific purpose should be collected. A blanket demand for your complete history is difficult to justify against that standard.

Second, if occupational health wants a report from a doctor who is or has been responsible for your clinical care, such as your GP or a treating hospital consultant, the Access to Medical Reports Act 1988 applies. Under that Act your consent is required before the report can be sought, and you have important rights around the process.

Your rights under the Access to Medical Reports Act 1988

Where a report is sought from your own doctor, the employer must tell you in writing about your rights, and you are entitled to:

1. Refuse permission for the employer to obtain a medical report at all.

2. Ask to see the report before it is sent to the employer.

3. Ask the doctor to correct anything you consider inaccurate or misleading.

4. Refuse to allow the report to be shared with the employer after you have seen it.

5. Change your mind about seeing it beforehand.

6. Ask for a copy at any time within six months of it being completed.

This regime is built around consent and control. It does not give an employer a right to demand your full medical file.

The distinction that matters

There is an important difference between three things that sometimes get blurred:

A request for you to complete a health questionnaire, or to attend an occupational health assessment and answer questions, is normal and legitimate, especially at recruitment for certain roles or where there is a live concern about fitness to work or reasonable adjustments. You are expected to answer honestly, but the questions should be relevant to the assessment being carried out.

A request for a targeted medical report from your GP or specialist, focused on specific conditions relevant to your work or to adjustments, is legitimate provided the consent process under the 1988 Act is followed.

A demand for your entire medical history or complete records is a different thing altogether, and this is what the ICO says employers should not normally do. If occupational health frames a consent form so broadly that it authorises release of your whole record, you are entitled to object and to ask that the request be narrowed to what is actually relevant to the referral question.

Consent must be genuine

Because of the imbalance of power in an employment relationship, consent to processing health data has to be freely given and specific. A consent form that is drafted so widely that you feel you must sign it or lose your job, and that authorises release of everything, is legally weak. You are entitled to give a limited, informed consent, and to strike out or query parts of a form that go further than necessary. It is entirely reasonable to ask occupational health to specify what conditions or issues they need information about and why, before you agree.

Where a broad request might be more justifiable

Context matters, and there are situations where occupational health can legitimately ask fairly wide questions. Examples include safety-critical roles, roles with statutory health surveillance requirements, or a genuine and specific fitness-to-work concern where a fuller picture is needed. Even then, the request should be proportionate and directed at the specific concern, not an open-ended demand for the whole file. If the university can point to a real, role-specific reason, that strengthens its position, but it still does not convert into a right to your complete records.

What happens if you refuse

You can decline to consent, and you cannot be compelled to release records. However, refusal is not without practical consequences. If occupational health cannot get the information it reasonably needs, the university may have to make decisions, for example about fitness to work, adjustments, or a return-to-work plan, on the information it does have, and that may not be in your favour. The sensible course is usually not a flat refusal but a proportionate one: agree to disclosure that is relevant to the specific question, while declining a blanket release. That protects your position and shows you are engaging constructively.

If disability is involved

If the underlying issue relates to a condition that may be a disability under the Equality Act 2010, the university has a duty to make reasonable adjustments and must not discriminate. Occupational health input is often used to inform adjustments, which can work in your favour. Cooperating with a properly targeted assessment can help you evidence the need for adjustments, while still not requiring you to surrender your entire history.

Practical next steps

1. Ask occupational health, in writing, to set out the specific referral questions and exactly what health information they need and why.

2. Review any consent form carefully. If it authorises release of your entire medical record, ask for it to be narrowed to the relevant conditions or issues, and amend or query it rather than signing a blanket authorisation.

3. Exercise your Access to Medical Reports Act rights if a report is being sought from your GP or specialist: ask to see it before it goes to the employer so you can check it for accuracy.

4. Keep everything in writing so there is a clear record of what was requested and what you agreed to.

5. If you believe occupational health or the university is demanding excessive health data, you can raise it as a data protection concern internally, and ultimately complain to the ICO, which regulates this area. If the wider dispute concerns fitness to work, adjustments or discrimination, the university’s grievance procedure and, where relevant, Equality Act protections are the route to pursue.

What would change the analysis

The answer can shift depending on facts I do not have: whether this is pre-employment or an existing role, whether the role is safety-critical or subject to statutory health surveillance, whether there is a specific fitness or absence concern, the exact wording of the consent form or referral, and whether a disability under the Equality Act is in play. In every version, though, the core position holds: a genuine and proportionate request for relevant health information is legitimate, but a requirement to disclose your entire medical history is not.