Hygiene training at the health department: Section 43 IfSG obligations for food establishments

The hygiene training at the health department is anchored in Section 43 of the Infection Protection Act (IfSG). Anyone who produces, handles or places food on the market within the meaning of Section 42 IfSG requires initial instruction from the health authority before starting work and then follow-up instruction from the employer at least every two years; the federal framework collective agreement often applies annually.

This article explains who is required to undergo training, how the initial instruction works, what obligations apply to the employer, what follow-up instruction must be provided and how the compliance platform and officer-as-a-service of CIVAC documents the instruction and activity bans in an audit-proof manner. The appointment certificate, signed, filed, verifiable.

§ 42 IfSG lists the activities that require instruction. This includes people who produce, handle or market food commercially, provided they come into contact with unpackaged food. This also includes cleaning staff in food areas.

The regulation covers classic sectors such as restaurants, bakeries, butchers, food retailers, commercial kitchens, canteens, catering and food production. Activities in schools, daycare centres, nursing homes and hospitals, as long as food is prepared, are also covered.

Voluntary activities are excluded under certain conditions. Section 42 (3) IfSG allows exceptions for short-term voluntary work, such as club parties, if the activity is not carried out regularly.

Independent food business operators are required to undergo training themselves and must complete the instruction like employees. The obligation applies to all people who come into contact with food, regardless of the contractual constellation.

Interns, temporary workers and seasonal workers are also subject to the obligation to provide instructions if their work falls under Section 42 IfSG. The initial instruction must be provided before the start of the activity; a later follow-up is not permitted.

The role of hygiene officer in facilities with food-related areas coordinates the instruction requirements and monitors compliance in the company.

In accordance with Section 43 Paragraph 1 IfSG, the initial instruction is given by the responsible health authority or a body commissioned by the health authority, such as a doctor. It must be completed before starting work and cannot be made up later.

The content of the instruction includes knowledge of communicable diseases, hygiene requirements, bans on activities in the event of certain illnesses and the obligation to report if illness is suspected. The person instructed declares in writing that there are no obstacles to activity.

The certificate is valid for three months after it was issued, which means that the activity must be started within this period. The certificate is then valid permanently, provided that the follow-up instructions are given and no cases of illness occur.

The costs of the initial instruction vary between the federal states and districts, the usual amount is 20 to 30 euros. The costs are often borne by the employer, but the person being instructed is initially legally obliged to do so.

Online instructions have been offered by many health authorities since 2020, with subsequent confirmation by post or digitally. The prerequisite is that the participant must be clearly identified and that knowledge is fully imparted.

The original certificate must be kept in the company. A copy is not enough; the responsible food inspection office requires the original for company inspections.

Section 43 Paragraph 4 IfSG obliges the employer to inform employees about their obligations after starting work and every two years thereafter. Unlike the initial instruction, the follow-up instruction takes place internally and can be carried out by suitable people in the company.

In terms of content, the follow-up instruction includes repetition of the most important content of the initial instruction as well as raising awareness of current hygiene topics, such as norovirus, salmonella or industry-specific risks. Written documentation is mandatory.

The documentation contains the name, date, content and signature of the person being taught. A mere attendance list is not sufficient because the content must be proven. According to Section 43 Paragraph 4 Sentence 2 IfSG, the receipts must be kept for at least two years; in practice, five years is recommended.

In collective agreements, for example in the federal framework collective agreement for the hotel and restaurant industry, annual follow-up instructions are often required. This shortening of the deadline takes precedence over the legal minimum requirements.

HACCP training courses in accordance with Regulation (EC) 852/2004 supplement the IfSG instructions, but the content is different. Both obligations apply cumulatively and should be coordinated in a training concept.

CIVAC's 490 ready-to-use audit templates contain templates for instruction protocols, proof of training and effectiveness tests. The workspace tracks deadlines and automatically reports before the two-year deadline expires. Audit-proof, documented, § 43-IfSG-proof.

Section 42 Paragraph 1 IfSG lists diseases for which there is a ban on activity. These include typhoid fever, paratyphoid fever, cholera, shigella dysentery, salmonellosis, other infectious gastroenteritis and viral hepatitis A or E. Skin diseases that can lead to pathogens are also included.

If illness is suspected or confirmed, the person concerned must inform the employer immediately. The employer immediately releases the person from activities that come into contact with food and informs the health department.

The reporting obligations result from Section 6 IfSG for doctors and Section 7 IfSG for laboratories. The employer himself is not primarily obliged to report, but does have a duty to cooperate in the clarification. This obligation must be distinguished from the GDPR, which particularly protects personal health data.

In terms of data protection law, health data is special data according to Art. 9 GDPR. Processing within the scope of Section 43 IfSG is covered by Article 9 Paragraph 2 Letters b and i GDPR in conjunction with Section 22 BDSG, but requires special protective measures.

The interface to the data protection officer is therefore relevant. A list of processing activities in accordance with Art. 30 GDPR and, if necessary, a data protection impact assessment in accordance with Art. 35 GDPR are required.

CIVAC maps the instruction and reporting chain in the workspace. Activity bans, re-releases and reports to the health department are documented with the date, time and responsible person. Deadline expires as soon as we become aware of it.

The IfSG instructions are just one component of the company hygiene concept. Regulation (EC) 852/2004 obliges food business operators to apply HACCP principles, i.e. the identification of critical control points and their monitoring.

The hygiene concept includes personnel hygiene, cleaning and disinfection plans, pest control, temperature monitoring, incoming goods inspection and traceability. The IfSG instructions sensitize staff to their obligations, but do not replace a technical concept.

In commercial kitchens, hospitals and care facilities, the concept is coordinated by the hygiene officer. In small businesses, the owner often takes on this role; a formal order is not legally required outside of medical facilities.

The TRBA 250 (Technical Rules for Biological Agents) and the Occupational Safety and Health Act supplement the obligations. The employer must provide protective measures, such as hand hygiene facilities, work clothing and training on correct behaviour.

Food monitoring controls risk-based with different intervals. Incomplete instruction documentation can lead to shorter inspection intervals, fines and, in serious cases, an operating ban.

CIVAC combines instruction, hygiene concept, HACCP protocols and supplier controls in the workspace. Licence the workspace for your internal representatives or have our representatives order it. This means that all documents are located centrally and can be audited.

§ 73 IfSG sanctions violations of § 43 with fines of up to 2,500 euros per violation. In the event of repeated violations, a lack of instruction documentation or the employment of sick people, higher fines and criminal consequences can occur in accordance with Section 75 IfSG.

The sanction also applies to formal violations, such as a missing original of the initial instruction certificate in the company, a lack of documentation of the follow-up instruction or late follow-up instruction. Authorities typically check random samples.

In the case of food infections with health consequences for consumers, the managing director may be held criminally liable under Section 130 OWiG and Section 222 StGB. Careful instruction documentation proves that the organisational obligation has been fulfilled in the process.

If a wave of salmonella or norovirus is suspected, the health department initiates an investigation, often with samples being taken from the kitchen and the staff. The instruction certificates are checked; missing documents place a burden on operational responsibility.

In terms of insurance law, incomplete documentation can affect company liability coverage because gross negligence in organisational obligations is assumed. The correct documentation is therefore also relevant for insurance.

CIVAC secures the document chain via the workspace with versioning, time stamps and signatures. The auditor calls, the evidence is ready. EU data residency simultaneously protects employees' personal data.

Online instructions have been widespread since 2020, both as initial instructions from the health department and as follow-up instructions from the employer. The prerequisite is clear authentication, for example with an ID card, and proof of the learning content via interactive modules.

E-learning modules with knowledge tests can be used for internal follow-up instruction. The documentation is carried out electronically, with a qualified electronic signature or with a clearly identifiable confirmation via login.

Personal data in instruction systems includes name, date of birth, address, start of employment and, if applicable, training history. Processing is carried out on the basis of Art. 6 Para. 1 lit. c GDPR in conjunction with Section 43 IfSG.

External training platforms are contract processors within the meaning of Art. 28 GDPR. An order processing agreement with technical and organisational measures is mandatory. EU data residency reduces data protection transfer risks in accordance with Chapter V of the GDPR.

An information security officer ensures the technical protective measures, such as encryption, access control and backup. The ISMS according to ISO/IEC 27001:2022 with 93 controls forms the standard.

CIVAC offers the instruction platform integrated in the workspace with EU data residency, qualified authentication and automated reminder of the two-year deadline. This creates a complete audit trail that meets the requirements of the IfSG and GDPR at the same time.

Additional duties apply in hospitals, nursing homes and rehabilitation facilities. Section 23 IfSG requires hygiene management with a hygiene plan, hygiene commission and hygiene officer doctor. The IfSG instructions according to § 43 only apply to personnel in contact with food.

The combination of medical hygiene and food hygiene requires clear responsibilities. The hygiene officer coordinates both areas, often in close coordination with the senior doctor and the nursing directorate.

In the case of pathogens that must be reported in accordance with Section 6 IfSG, such as multi-resistant pathogens, the reporting obligations in accordance with Sections 6 and 7 IfSG also apply. These are primarily carried out by treating doctors and laboratories, but organizationally affect the entire company.

The remuneration for external hygiene advice is often within the framework of consulting contracts with defined hourly rates or flat rates. Appointment as a hygiene officer requires relevant qualifications, for example according to RKI recommendations.

In outpatient facilities such as doctor's offices and day care centres, reduced requirements apply, but the IfSG instructions in accordance with Section 43 IfSG remain mandatory in the event of food contact. It makes sense to have a representative individually check the areas of application.

CIVAC bundles the roles of hygiene officer, company doctor, data protection officer and information security officer in a compliance platform and officer-as-a-service. The reporting lines are consolidated to the management.

The initial instruction at the health authority in accordance with Section 43 Paragraph 1 IfSG is an individual obligation of every person instructed. The follow-up instructions from the employer in accordance with Section 43 Paragraph 4 IfSG are an organisational obligation of the company. Both strands must be documented completely, otherwise Section 73 IfSG applies with fines of up to 2,500 euros per violation.

CIVAC bundles the obligations in a compliance platform and officer-as-a-service. 25 representative roles, all live, including hygiene, company doctor, data protection and information security officers, plus 490 ready-to-use audit templates and 93 controls according to ISO/IEC 27001:2022.

The workspace keeps initial instruction certificates, follow-up instruction certificates, activity bans, re-releases and reports to the health department in one system. Versions, signatures and confirmations of receipt are audit-proof in the EU data residence.

Licence the workspace for your internal representatives or have our representatives order it. The dual model adapts to whether you have an experienced hygiene officer or want to fill the role entirely externally.

The FAQ page answers typical follow-up questions about deadline logic, online instructions and the interface to HACCP training. Others run compliance like a filing cabinet. We run it like software.

Turn reading into a mandate. Write to info@civac.de or use the contact form on civac.de. Orders and workspace licences are ready for use within 2 working days, are audit-proof and § 43-IfSG-proof.