Aipedia: Occupational health providers

AI sickness absence analytics and occupational health

Aipedia, by the Apex broking team · Last reviewed 2026-10-27

OH providers can offer absence analytics, but predicting individual workers' health or absence from their data is profiling of special category data and needs a clear lawful basis and safeguards. Blurring OH advice with HR surveillance can damage trust and create data protection claims.

Part of: AI in occupational health providers

In short

Some OH providers may sell dashboards and AI models that predict absence, flag workers at risk of long-term sickness or score wellbeing survey results. Using health and absence data in this way is profiling of special category data. The ICO's workers' health guidance says detailed medical information should stay with health professionals and managers usually need only fitness-for-work information. Solely automated significant decisions about workers engage UK GDPR Articles 22A to 22D. OH providers should keep individual health insight on the clinical side and give employers aggregated, proportionate information.

What absence analytics look like

Employers want to understand absence trends, and OH providers hold much of the relevant data. Analytics products combine absence records, referral reasons, OH outcomes and sometimes wellbeing survey responses. Some simply report trends by department or reason. Others use machine learning to predict which workers are likely to go off sick, which absences will become long-term, or which teams have wellbeing risks. These products may be bundled into an OH contract as a value-added service.

The difficulty is that the same data serves two purposes. To the OH clinician it supports care and advice. To an HR team it can look like a tool for managing people out. Once individual risk scores reach managers, the OH provider has moved from advising on health to supporting decisions about employment.

The duties that apply

Health data: the ICO workers' health guidance says access to and interpretation of detailed medical information should be left to health professionals, and managers usually need only fitness-for-work information. Health data needs an Article 6 basis plus an Article 9 condition, often employment law, with DPA 2018 Schedule 1 conditions and an appropriate policy document where required.
Consent: the ICO notes consent is often not valid in employment because of the power imbalance, so it is rarely a safe basis for analytics.
Automated decisions: where analytics lead to significant decisions about individuals without meaningful human involvement, UK GDPR Articles 22A to 22D require explicit consent or a contract or legal requirement plus Article 9(2)(g), with safeguards.
Professional confidentiality: the GMC's employment disclosure guidance para 115(c) limits disclosure to relevant factual information; NMC Code 5.1 and 5.2 and HCPC standards 5.1 and 5.2 cover confidentiality and telling people how information is used.

What can go wrong

Illustrative scenario: an OH provider supplies a dashboard showing each worker's "absence risk score", built from OH referral reasons and past absence. A manager uses the scores to decide who to move into a restructured team, and several workers with mental health histories are selected. A worker makes a subject access request, discovers the score and complains to the ICO, then brings a disability discrimination claim. The employer argues the provider designed the tool and supplied the health-derived data.

Other risks include combining wellbeing survey answers with OH records without telling workers, poor anonymisation of small teams, and models that encode past bias. Workers who believe OH is feeding management may stop disclosing health problems.

How PI usually responds

Claims here can combine professional advice and data protection. OH professional indemnity may respond to claims alleging negligent design or advice, subject to its terms, but some policies may exclude or limit data protection claims and regulatory fines. A product sold as software may also fall outside a clinical malpractice wording and need technology PI. Check how the activity is described to insurers. See does OH indemnity cover AI mistakes and data breach cover within PI.

Practical controls

Complete a DPIA before offering any analytics product.
Give employers aggregated trends, not individual health-derived scores.
Keep clinical records separate from analytics data and limit access.
Tell workers what data is used and for what, in plain terms.
Set suppression thresholds so small groups cannot be identified.
Put limits on use in the employer contract, including no use for individual employment decisions.

How Apex helps

Apex arranges PI for occupational health providers, including those offering data and analytics services. A broker reviews whether your clinical PI, any technology cover and your cyber policy fit the products you sell; see OH professional indemnity.

Sources

Frequently asked

Can an OH provider give employers absence risk scores?

It is high risk. Scores derived from health data are profiling of special category data, need a lawful basis and an Article 9 condition, and may engage UK GDPR Articles 22A to 22D if used for significant decisions. Aggregated trends are usually more proportionate.

Can workers consent to absence analytics?

The ICO says consent is often not a valid basis in employment because of the power imbalance. Providers and employers usually need another Article 6 basis and an Article 9 condition, such as employment law, with DPA 2018 Schedule 1 conditions where required.

Is analytics work covered by OH malpractice insurance?

Not necessarily. A clinical PI wording may not respond to a software or data product, and data protection claims may be excluded or limited. Describe the activity to insurers and check whether technology PI or cyber cover is needed.

Where does OH advice end and HR surveillance begin?

Broadly, OH advice gives managers the fitness-for-work information they need about a referred worker. Tools that profile workers' health to inform management decisions without a referral move towards surveillance, which raises data protection, trust and liability concerns.

Check your indemnity covers how you use AI

Tell us about your practice and the work you do. A broker will review how your current cover treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start an indemnity quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.