External Company Doctor: Appointment, Qualification, and Legally Compliant Commissioning under § 3 ASiG

§ 2(1) of the Occupational Health and Safety Act (ASiG) requires every employer to appoint a company doctor. For the vast majority of mid-sized businesses between 10 and 500 employees, employing a full-time company doctor is not economically viable. The external company doctor is therefore the standard model for occupational health provision in German SMEs.

This article explains what qualifications an external company doctor is required to hold, what obligations arise from the appointment, how the appointment process is documented in a legally compliant manner, and in what circumstances a structured Officer-as-a-Service model significantly simplifies practical administration. The focus is on the requirements that employers need to understand in order to present reliable evidence in the event of an inspection.

§ 4 ASiG defines who may be appointed as a company doctor. Two levels of qualification are recognised:

1. Specialist in occupational medicine: Has completed a five-year specialist training programme in accordance with the (Model) Specialist Training Regulations of the German Medical Association, covering comprehensive clinical and preventive medicine knowledge. Fully authorised for all mandatory, optional, and voluntary health surveillance examinations under ArbMedVV and for all types of fitness examinations.
2. Doctor with the additional qualification in occupational medicine: Has completed a 360-hour further training course at a medical chamber. Suitable for most care services; for certain specialised mandatory health surveillance examinations (e.g. G26 respiratory protection Category III), subject-specific restrictions may apply.

A general practitioner or specialist in another discipline without an occupational medicine qualification cannot be appointed under § 4 ASiG. Such an appointment would be formally invalid; the liability risk for management would remain undiminished. When structuring the contract, the proof of qualification (specialist certificate or additional qualification certificate from the state medical chamber) should be included as an annex to the contract.

For industry-specific requirements, additional qualifications may occasionally be needed: radiation protection under § 74 StrlSchV requires proof of radiation protection expertise; diving operations require diving medicine training. These special requirements should be explicitly stated in the service specification of any tender. Finding an external company doctor with the appropriate qualification profile is part of the CIVAC appointment process.

The external company doctor assumes the same statutory obligations as an in-house doctor. § 3 ASiG identifies six core task areas:

1. Advice on workplace design: Involvement in the planning of workplaces, manufacturing processes, and work equipment. This task is preventive in nature; the company doctor should be involved before structural or technical changes are finalised.
2. Support with risk assessment: Medical evaluation of hazards under § 5 ArbSchG, particularly for chemical, physical, and psychological stresses. The risk assessment is not a one-off event; it must be updated whenever working conditions change.
3. Carrying out occupational health surveillance: Mandatory, optional, and voluntary health surveillance under ArbMedVV; documentation of the health surveillance register. The distinction between mandatory and optional health surveillance is relevant for budget planning.
4. Site inspections: At minimum the inspection times prescribed in DGUV Regulation 2, with a written inspection report containing recommendations for action.
5. Health protection measures: Involvement in occupational reintegration management (BEM) under § 167 SGB IX, addiction and reintegration programmes.
6. Annual report under § 9 ASiG: Annual written report to the employer on services rendered and deficiencies identified.

Important: even with external commissioning, the employer remains responsible under § 19 ASiG for the proper execution of these services. The external service contract transfers the execution, not the responsibility. This means: the employer must actively monitor that the company doctor actually fulfils their obligations.

The letter of appointment is the central evidential document for the fulfilment of occupational health obligations. Without a written appointment, there is no reliable evidence during an audit or following a workplace accident that the employer has met their obligation. A service contract covering inspection flat fees alone does not fulfil this function; it governs only the contractual relationship, not the formal act of appointment under ASiG.

A legally compliant letter of appointment contains at minimum:

• Name and qualification of the appointed company doctor (specialist title or additional qualification with supporting evidence)
• Name of the appointing company and the responsible management person
• Scope of applicability (site, departments)
• Agreed deployment times in hours per year, referenced to DGUV Regulation 2 Annex 2
• Date of entry into force and duration
• Signatures of both parties

The letter of appointment is not identical to the service contract but is a standalone appointment document that must be brought to the attention of the works council if one exists (§ 9(3) ASiG). It must be retained for the duration of the appointment and beyond; a minimum of ten years is recommended, in line with the retention periods under § 28 DGUV Regulation 1. Where health risks from hazardous substances exist, retention periods of up to 40 years apply (§ 14 GefStoffV).

Letter of appointment: signed, filed, demonstrable – this is the minimum standard for audit-ready compliance in the field of occupational medicine.

In addition to the letter of appointment, a service contract with the external company doctor or the commissioned service is required. It governs the contractual obligations of the engagement and must contain substantially more than merely the hourly rate and payment terms. The following points are indispensable:

• Scope of services: Which services are included? Basic care, company-specific care, and health surveillance examinations must each be listed separately.
• Hour quota or flat fee: How many hours are remunerated per year? How are additional hours billed? Do unused hours lapse?
• Proof of qualification as an annex: Evidence of the specialist title or additional qualification must form part of the contract annexes, not merely be available on request.
• Travel costs and arrival flat fees: Clear provision for billing travel time and mileage costs, including a threshold-free distance.
• Substitute arrangement: Who stands in for the company doctor in case of illness, leave, or cessation? The substitute must also be qualified under § 4 ASiG.
• Reporting obligations: When and in what form are inspection reports, the health surveillance register, and the annual report under § 9 ASiG to be delivered?
• Data protection: Provision for processing personal health data under Art. 9 GDPR; medical professional confidentiality must be contractually reaffirmed.
• Notice periods: Typically three to six months, as finding a qualified successor takes time.

A contract covering these eight points forms the basis of an audit-ready commissioning. Frequently asked questions on contract design and the obligation to appoint are answered on the CIVAC FAQ page.

Company medical documentation spans several levels, all of which must be maintained in a manner suitable for audit. Incomplete documentation has the same effect as a failure to fulfil the obligation: at an audit, what cannot be evidenced is treated as not having been done.

1. Letter of appointment: Evidence of the formal appointment (see section 3). Must be current; if the appointment ends by notice or expiry of term, a new letter must be issued for the successor.
2. Inspection reports: Written records of each workplace inspection with findings, recommendations, and actions; signed by the company doctor and the employer. Open actions must be followed up.
3. Health surveillance register: Individual record for each employee who has received mandatory or optional health surveillance; contains date, medical protocol, and outcome (without medical details due to professional confidentiality).
4. Annual report under § 9 ASiG: Summary of services rendered, deficiencies identified, and recommended actions. This report forms part of management documentation and must be presented to senior management.
5. Risk assessment: The company doctor's involvement in preparation or updating must be documented. An undated risk assessment without evidence of the company doctor's involvement is considered incomplete.

During trade association inspections or checks by the trade supervision authority, the letter of appointment, the most recent annual report, and samples from the health surveillance register are typically requested. The deadline runs from the point of knowledge – this applies to obligations to rectify deficiencies just as it does to all other compliance deadlines.

§ 1 ASiG requires the company doctor and the specialist for occupational safety (SiFa) to work together. Both functions complement each other: the company doctor contributes the medical perspective, the SiFa the safety engineering perspective. DGUV Regulation 2 stipulates that a joint work plan should be drawn up coordinating inspections, risk assessments, and training. This plan is subject to a documentation obligation and forms part of the trade association's inspection set.

In practice, the company doctor and the SiFa are frequently provided by the same external service provider. This offers structural advantages:

• Coordinated annual planning without interface problems between two different service providers.
• Joint inspections reduce the time commitment of both officers; a combined inspection takes less time than two separate ones.
• A single point of contact for all occupational safety matters and all inspectors.
• Combined offers are frequently cheaper than two separate contracts; typical discount: 10–20% on the sum of individual prices.

Where no joint work plan exists, this may be assessed as a breach of DGUV Regulation 2 during inspections. A missing plan does not necessarily mean a fine, but it increases liability risk in the event of a claim because coordinated care cannot be demonstrated.

For organisations that fill both functions externally, a structured selection process that considers both roles together is recommended. The CIVAC role for specialist in occupational safety describes the combined commissioning model and the documentation requirements for both functions in detail.

Company doctors process special categories of personal data (Art. 9 GDPR: health data). The contract structure must take this into account. Ambiguities in this area frequently lead to data protection breaches, which are notifiable under Art. 33 GDPR within 72 hours.

• Medical professional confidentiality: The company doctor does not pass individual medical findings to the employer; they communicate only whether an employee is fit, conditionally fit, or unfit for a particular activity. The outcome of health surveillance is not a diagnosis and contains no information about illness.
• Data processing agreement or independent processing: Since the company doctor acts independently during health surveillance examinations (professional independence), they are not a processor within the meaning of Art. 28 GDPR, but an independently responsible controller. A data processing agreement for the medical data is therefore not the correct legal construction.
• Health surveillance register: The employer may retain only the outcome communication (fit/unfit), not the medical details. These remain with the company doctor.
• Retention periods: Health surveillance documentation must be retained for at least 40 years under § 3 ArbMedVV where exposure to hazardous substances existed; for other activities, a minimum of ten years is recommended.

A frequent practical error: the employer requests the health surveillance register with medical findings because they need evidence for a trade association. The correct request is for the outcome communication, not the medical report. These data protection requirements should be clearly addressed in the service contract to avoid ambiguity during ongoing operations.

The selection of an external company doctor or occupational health service should follow a structured process. Experience shows that commissionings fail not because of hourly rates but because of unclear service boundaries or inadequate documentation.

Recommended steps:

1. Determine the hazard group: Based on the risk assessment under § 5 ArbSchG, establish the applicable group under DGUV Regulation 2 Annex 2. For mixed businesses (office and production), a differentiated classification by activity area is required.
2. Calculate minimum hours: Number of employees multiplied by the deployment time coefficient; separately for company doctor and SiFa. The result is the absolute minimum quota; company-specific care is additional.
3. Tender with service specification: Explicitly name all four cost drivers (basic care, company-specific care, health surveillance examinations, travel costs). Offers that do not reflect this structure are not fully comparable.
4. Request proof of qualification: Specialist title or additional qualification as an annex to the offer. If evidence is not provided, the offer should not be considered further.
5. Obtain and compare three offers: Compare at least three fully structured offers.
6. Discuss the letter of appointment in advance: Reputable providers supply a draft letter of appointment on request. Willingness to do so signals familiarity with ASiG requirements.
7. Check references: Sector-specific references are relevant, particularly for specific hazard situations (chemicals, healthcare, construction).

Businesses that go through this process in a structured manner once will have a documentation basis that withstands inspections without the need for subsequent remediation. The inspector calls, the evidence is ready.

The external company doctor is not an optional service for German SMEs but a statutory obligation with specific documentation requirements. Letter of appointment, inspection reports, health surveillance register, and annual report form the evidence set expected at every inspection. Anyone unable to present one of these elements does not have an audit-ready commissioning – regardless of whether a company doctor was in fact active.

CIVAC offers the external company doctor as Officer-as-a-Service: a certified occupational physician is formally appointed within two working days; the letter of appointment, reporting line, and documentation structure are set up in the CIVAC workspace from day one. Others manage compliance like a filing cabinet. We manage it like software. CIVAC today covers 25 officer roles and connects the company doctor, specialist for occupational safety, and other mandatory functions on a shared platform.

Anyone wishing to fill the company doctor function internally or to equip their own officer with a structured tool can use the CIVAC workspace as a tool licence: 490 audit templates, an AI assistant with source references, and a training module with certificate functionality are immediately available. Licence the workspace for your internal officers or appoint our officers.

Turn reading into action: write to info@civac.de. The initial conversation clarifies business size, hazard group, and commissioning model – with no obligation, in a single appointment.