Informed Consent and Data Protection

Informed consent for biological monitoring is a requirement.  That consent must be "informed", freely given" (the worker understands what they are agreeing to and why) and "explicit" (usually a signature).  Further information is available from HSE's guidance, HSG167.  An example consent form is available here.  Another example (for isocyanates) is given in G408. You may want to design your own consent form but it should be based on the principles in HSG167.  It is the duty of the biological monitoring services "requestor" to obtain consent from workers and store those records appropriately.

Biological monitoring results are workers' 'personal' data.  They are usually measurement of exposure not health and should be treated as "sensitive personal" data (rather than "medical-in-confidence" according to Data Protection Act criteria).  This means that the data have to be stored securely, for sufficient time (generally 40 years) and only shared with people permitted by the worker when giving consent.

In 2018, the General Data Protection Regulations (GDPR) was introduced. This requires a minimisation of the amount of personal data shared with others. In practice this means restricting the data to that which is strictly necessary for fulfilling the service requested. HSE Science and Research Centre now requests anonymised data from customers in respect of this requirement. In order for us to provide the best service to you when interpreting results, we would recommend that you use the same coding for the same worker each time - this way we can check historical data for that worker if you need guidance on results and appropriate subsequent action. We will continue to request birth year (not DoB), sex and smoking status as these can be relevant to interpretation, but are not personal data when using anonymised coding.

The data is stored indefinitely and maybe used to look at trends in data etc. but only in anonymised formats such that no individual or company is identifiable unless they consent.  We have an obligation to inform relevant HSE inspectors when breaches of regulation are suspected however this is only done as a last resort and we seek to work with our customers in the first instance to reduce exposures where results indicate that this may be necessary.

HSE's privacy policy is also available and there is a specific mention of testing tissue samples (such as blood and urine).