Hygiene training online: legal framework, content and auditable evidence

The initial instruction in accordance with Section 43 Paragraph 1 of the Infection Protection Act has been mandatory for employees who come into contact with food since the Federal Infection Protection Act of 2001 and is carried out by the health department. Since the 2020 amendment, the federal states have allowed digital instruction to varying degrees; the subsequent instruction in accordance with Section 43 Paragraph 4 IfSG is the responsibility of the employer anyway and is therefore open to online formats. In nursing, Section 35 IfSG together with TRBA 250 regulates the instruction requirements; in food processing, Regulation (EC) No. 852/2004 supplements the requirements. Online hygiene training is therefore not per se permissible or inadmissible, but depends on the area of ​​application, the federal state and the didactic concept. Anyone who ignores this risks complaints from the official food control authorities with fines according to § 60 LFGB of up to 50,000 euros per violation.

This article explains in which constellations online hygiene training courses are recognised, what minimum technical and content requirements apply and how hygiene officers document participation in a verifiable manner. As a compliance platform and officer-as-a-service, CIVAC supports hygiene managers in the catering, nursing, food industry and healthcare sectors with configurable training paths, automatic deadline reminders and an audit-proof document track. Licence the workspace for your internal representatives or have our representatives order it. You will learn about the legal pitfalls, the typical reasons for complaints from supervisors and the mandatory components of a reliable online hygiene instruction. Audit-proof, documented, § 43 IfSG-proof.

The legal basis for hygiene training comes from several sources whose areas of application overlap. Section 43 paragraph 1 IfSG requires employees who work with perishable foods to receive initial instructions from the responsible health authority before starting work. The follow-up instruction in accordance with Section 43 Paragraph 4 IfSG is provided annually by the employer and, according to the prevailing opinion, can be provided in digital form provided that the content, understanding and participation can be proven. Individual state health authorities have published more specific information on this, such as Bavaria, North Rhine-Westphalia and Baden-Württemberg, which serve as an interpretative aid.

In medical facilities, Section 35 IfSG also comes into force, which regulates instructions for employees who have contact with patients. TRBA 250 specifies the requirements for activities with a risk of infection and prescribes annual instructions, which are also possible in digital form. The Food Hygiene Regulation refers to Annex II, Chapter XII of Regulation (EC) No. 852/2004, which requires training according to the activity carried out, without specifying a specific format. Industry standards such as IFS Food Version 8 and BRCGS Global Standard expand the requirements framework to include training matrices and effectiveness tests.

Hygiene officers consolidate these sources in the hygiene plan and training concept. CIVAC maintains the current legal references at civac.de/roles/hygienerechner and automatically assigns them to the fields of activity. This makes it clear which instruction requirement comes from which source and which online portions are permitted. In the event of changes to state law, the hygiene plan is updated centrally and a notification is sent to the hygiene officer so that the obligation to provide instruction is not lost due to an overlooked amendment. This connection to the legal source makes the difference to a free-standing e-learning platform without any legal reference.

The most important distinction in the food sector is between initial instruction and subsequent instruction. The initial instruction in accordance with Section 43 Paragraph 1 IfSG is a sovereign task of the health authority and is usually carried out as a face-to-face appointment or video consultation. Several federal states now offer online procedures with identity verification, such as Bavaria via the BayernPortal and North Rhine-Westphalia via the nationwide health department offer. Without this official initial instruction, the employee is not allowed to come into contact with perishable food, which is immediately noticeable in the audit of new hires and leads to complaints.

The annual follow-up instruction in accordance with Section 43 Paragraph 4 IfSG is the responsibility of the employer. It can take place as face-to-face training, as a hybrid event or as a pure e-learning module, provided three conditions are met. Firstly, the verifiable identity of the participant, for example through personalized access in the workspace. Secondly, the complete mandatory content from Section 43 Paragraph 1 IfSG with activity bans, personal hygiene and reporting obligations. Thirdly, a comprehension test with a passing threshold that complements pure consumption with active knowledge testing. Without a test, the learning success cannot be objectified and can be attacked in an audit because the instruction then appears as a formal act without an effectiveness test.

Hygiene officers determine in the hygiene plan which instruction is carried out in which form and which employee groups follow which path. CIVAC controls this differentiation in the workspace and maintains an individual training pass for each employee. Seasonal employees receive the food trail with a reminder of the official initial instruction, permanent employees receive the annual refresher. The appointment certificate, signed, filed, verifiable. The hygiene officer can see in the dashboard which instruction is due, who has completed it and where there are gaps. This differentiation also reduces training costs because no employees fall into paths that are not necessary for their job.

A legally compliant online hygiene instruction fully covers the mandatory content of Section 43 Paragraph 1 IfSG. These include bans on activities for certain diseases such as typhoid, cholera, paratyphoid, dysentery, hepatitis A and E, infectious gastroenteritis, infected wounds and skin diseases with pathogen excretion. Continue personal hygiene with hand washing according to DIN EN 1499, work clothing, jewelry, hair protection and nail care. In addition, the reporting obligations to the employer and the health authority in the event of suspected cases as well as the consequences of a breach of duty. The Federal Institute for Risk Assessment has information sheets in several languages ​​that must be used in multilingual workforces.

Industry-specific content expands the mandatory catalogue. In the catering industry, HACCP basics, cold chain management, allergen management in accordance with Regulation (EU) No. 1169/2011 and the handling of self-control samples are also included. In nursing, the five WHO indications for hand disinfection, the TRBA 250 specifications for protective clothing, the handling of medical devices and the outbreak notification in accordance with Section 6 IfSG are supplemented. In the food industry, IFS Food and BRCGS topics from the training matrix are mandatory components, and in hospital hygiene the KRINKO recommendations on specific pathogen groups such as MRSA, VRE and Norovirus are also mandatory.

The didactic implementation requires understandable language, visual demonstrations and a comprehension test with at least an 80 percent pass mark. Pure consumption without testing will not be recognised in the audit. CIVAC provides industry-specific training modules in the workspace with knowledge testing, multilingual content and an audit-proof receipt. The 490 audit templates cover the mandatory content and are updated centrally in the event of legal changes. Others run compliance like a filing cabinet. We run it like software. Each module version is linked to a deadline so that the audit can show which content was part of the training at the time and which was only added later.

An online training course must be technically robust, otherwise it will not stand up to the audit. First, the identity of the participant. A generic login from a branch manager is inadequate because it is then impossible to prove who actually consumed the content. Personalized access with a unique employee number, ideally with two-factor authentication in sensitive areas, is the minimum standard. Secondly, the reproducibility of the content. The platform must archive the respective module version and the version valid at the time of the training so that supervisory authorities can trace what content was taught years later. This versioning is regularly queried in audits and decides on recognition.

Thirdly, data protection according to the GDPR. Training participation is personal data related to activity and health. They are subject to the processing principles according to Art. 5 GDPR and require a legal basis according to Art. 6 GDPR, usually the fulfilment of a legal obligation according to Art. 6 Paragraph 1 c GDPR in conjunction with Section 43 IfSG. Processing is carried out according to the principles of data minimization and storage limitation. Storage periods are based on labour law requirements, usually the duration of the employment relationship plus the statutory retention periods, in the food sector often ten years according to tax law requirements.

Fourth, the hosting question. Processing outside the EU requires additional contractual clauses and is increasingly critical in audits. EU data residency is therefore a plus point for many supervisory authorities. CIVAC operates the workspace on EU servers with ISO/IEC 27001:2022-compliant ISMS and 93 controls. The technical minimum is therefore met. The external data protection officer can take over the processing of training data in the directory in accordance with Art. 30 GDPR. This means there is no shadow DSB gap in which the training system runs unobserved from a regulatory perspective. This is regularly a point in audits where free-standing e-learning platforms fail.

In the audit, the training only counts if there is a receipt. A reliable training receipt contains at least nine components. Firstly, the employee's full name and personnel number. Secondly, the name of the training module and its version number. Third, the full content as an attachment or as a linked module snapshot. Fourth, the date of participation. Fifth, the processing time. Sixth, the result of the comprehension test with points and passing threshold. Seventh, the employee's signature or an equivalent electronic confirmation in accordance with Article 25 of the eIDAS Regulation. Eighth, confirmation from the hygiene officer or the employer. Ninth, the reference to the next refresh due with date.

A receipt without these components is regularly not recognised in audits. The module version in particular is crucial because content changes with the legal situation and in the event of a dispute it must be proven which content was conveyed on which deadline. Pure PDF receipts without version reference are critical in modern audits. Collective receipts for groups without individual personnel numbers are equally problematic because individual participation cannot then be traced back. For multilingual workforces, the language of the instruction must be documented so that in the event of a dispute it is clear that the content could be understood.

CIVAC automatically maintains the training receipt in the workspace with all mandatory components. The auditor calls, the evidence is ready. The receipt is linked to the employee's individual training pass and can be exported at the push of a button. An Excel list or a folder with scanned signatures is viewed increasingly critically in audits because neither versioning nor comprehension tests can be depicted there. If you want to impress as a hygiene officer in an audit, you need a platform that automatically creates this trace instead of maintaining it manually. The individual export function also allows requests for information in accordance with Art. 15 GDPR within the monthly period.

Online hygiene training is efficient, but not universally sufficient. Hygienic hand washing according to DIN EN 1499 requires practical practice because the correct sequence of movements with the palms, back of the hands, spaces between the fingers, spread fingers and thumbs is not mastered in pure theory. Studies by the Robert Koch Institute and the Clean Hands Campaign show that the compliance rate often remains below 50 percent even after e-learning modules if there is no observation at the workplace. Practical demonstrations with UV marking make the gaps visible and must be documented in the receipt track as an additional appointment.

The same applies to the handling of personal protective equipment in the healthcare sector. The correct donning and doffing sequence according to TRBA 250 and KRINKO recommendations can be taught theoretically, but must be practiced in practice to avoid contamination. The use of cleaning and disinfecting agents also follows a logic that cannot be learned from the video alone, but requires accompanied initial use. Hygiene officers are therefore planning hybrid paths with online components for theory and face-to-face components for handling. This hybrid form is more resilient in audits than purely online formats because it clearly addresses the transfer of movement knowledge.

CIVAC supports hybrid training in the workspace with two linked modules. The online part forms the theoretical basis with a comprehension test, the face-to-face part is documented with an attendance list and a confirmation of demonstration. Both documents are combined in the employee's training pass so that a consistent picture is created in the audit. Pure online training without a handling component is marked as inadequate in the hygiene plan if the activity requires a practical component. In this way, hygiene officers avoid the most common gap in modern training landscapes: that digital efficiency is confused with the lack of physical practice. The hybrid solution maintains efficiency and closes the effectiveness gap.

The application conditions for online hygiene training differ significantly depending on the industry. In the catering industry, purely online modules are often sufficient for service staff who only deal with packaged food, provided the initial instructions are officially available. A hybrid variant with a practical component is recommended for cooks, food servers and employees in the scullery, particularly for hand hygiene and allergen management in accordance with Regulation (EU) No. 1169/2011. Seasonal workers are particularly vulnerable to gaps because their short assignments break the training chains. An automatic onboarding path with a reminder of the initial official instruction in the first days of employment helps here.

In nursing, the annual instruction in accordance with TRBA 250 and § 35 IfSG is largely permitted online, but the handling of protective clothing and the five WHO indications for hand disinfection require in-person modules or observation appointments. The federal states' hospital hygiene regulations further specify the requirements. In the food industry, IFS Food Version 8 expands the training matrix to include topics such as food defence and food fraud, which can usually be taught online. In administration, the requirements are the lowest and are often limited to a short instruction on hand hygiene and behaviour in sanitary rooms.

Hygiene officers configure industry-specific paths for each field of activity in the CIVAC workspace. The platform automatically assigns employees to the correct path as soon as their job is stored in the HR system. When there is a change in activity, such as the transfer of a service worker to serve food, the extended path is automatically activated and the missing instruction is displayed as a task for the hygiene officer. In this way, you avoid the most common gap after a job change, in which the old training is still formally valid, but the content no longer fits the new field of activity. This link between personnel profile and training path is often the decisive maturity indicator in the audit.

The economic viability of online hygiene training arises from two factors. Firstly, the training time saved in attendance, which in the catering and nursing sectors amounts to 90 to 180 minutes per employee per year. With 100 employees, this results in between 150 and 300 person-hours that can be focused on the actual work. Secondly, the reduced travel costs and space costs in distributed location structures. On the cost side, there are the licences for the training platform, which are usually between 5 and 20 euros per employee per year, as well as the integration into the existing HR system. If you have around 30 employees, the platform solution usually pays for itself within a year.

On the risk side, there are the typical audit complaints. Firstly, there is a lack of versioning of the training modules. Secondly, generic logins without individual participant assignment. Third parties lack comprehension tests or pass thresholds that are too low below 70 percent. Fourth, a lack of adaptation of the content to areas of activity, so that all employees complete the same generic course even though their activities are different. Fifthly, there is a lack of connection with the official initial instruction, so that it is not clear in the audit whether the § 43 IfSG obligation has been fulfilled for every employee. Sixth, lack of storage of receipts after employees leave.

CIVAC closes these gaps in the workspace structurally. Module versions are linked to a deadline, employees have individual access with job assignment, comprehension tests are mandatory, initial instructions are stored with the date and location, retention periods are maintained automatically. The auditor calls, the evidence is ready. Management, hygiene officers and data protection officers each have the views they need, without anyone having to search through Excel lists or paper folders. This structural freedom from gaps is the economic added value that regularly amortizes the licence costs in the first unannounced inspection appointment. The training goes from being a mandatory event to becoming a resilient protective shield for management.

Online hygiene training is a tool, not a replacement for a resilient hygiene organisation. It only takes effect when it is embedded in a hygiene plan that is maintained by an appointed hygiene officer, reviewed annually and validated through controls at the workplace. Supervisory authorities, professional associations and health insurance companies do not check the individual module, but rather the maturity of the entire organisation. A platform alone, without an appointment certificate, without a reporting line and without a control concept, does not protect management. It is precisely this maturity of the organisation that causes free-standing e-learning platforms without a compliance connection to fail.

CIVAC is a compliance platform and officer-as-a-service with workspace, audit templates, appointment certificate, reporting line and EU data residency. Licence the workspace for your internal representatives or have our representatives order it. Hygiene officers receive a preconfigured set for their industry, in which the online training is one module among several. The CIVAC SLA of 2 working days replaces the usual response window of 2 to 6 weeks if new employees need to be trained or an unannounced inspection appointment causes movement in the document track. The appointment certificate, signed, filed, verifiable. In replacement situations, the platform takes care of reminders and escalations without employees having to improvise.

If you want to digitize your hygiene training for the first time or have an existing e-learning solution checked for exam security, we will clarify this in a structured initial consultation. Turn reading into an assignment. Write to info@civac.de or use the contact form to arrange an initial assessment of your current training landscape. You will receive a concrete list of gaps with delivery dates so that the training does not get stuck in the merry-go-round of annual obligations, but rather becomes a managed organisation that is responsible in an emergency and relieves the burden on management. Deadline expires as soon as we become aware of it.