Select occupational health service provider: criteria, contracts, officer mandate

The Occupational Safety Act (ASiG) has required employers to appoint a company doctor and occupational safety specialists since 1973, Section 2 ASiG. DGUV regulation 2 specifies the working times and tasks according to care group, the regulation on occupational health care (ArbMedVV) supplements the compulsory, offered and desired care. For companies without their own occupational health department, this usually means a contract with an inter-company occupational health service, i.e. an external occupational health service provider. The selection is not just a purchasing issue: it concerns the fulfilment of an ordering obligation, which is linked to the catalogue of fines of the professional associations, to the trade inspection and, in the event of damage, to the liability of the management in accordance with Section 130 OWiG. The election is at the same time the election of a representative in the sense of compliance, with all formal consequences for the appointment certificate, hearing of the works council and reporting line.

This article provides the criteria for selection, the contractual components for security and the operational model for anchoring the order in an integrated compliance architecture. CIVAC accompanies the documentation as a compliance platform and officer-as-a-service, with an appointment certificate, reporting line to management, representation regulations and 490 ready-to-use audit templates. The appointment certificate, signed, filed, verifiable, with an SLA of two working days from the conclusion of the contract instead of the classic two to six weeks, and with a data model that neatly integrates occupational health care into the other representative roles.

The legal framework consists of three interlinked regulations. Section 2 ASiG obliges every employer to appoint company doctors to the extent necessary in view of the type of operation, the number of employees employed and the accident and health risks. Section 3 ASiG lists the duties of the company doctor, from advising the employer to examining employees and observing the implementation of occupational safety. The appointment is made in writing and the works council must be heard in accordance with Section 9 ASiG. A missing or incorrect order is an administrative offense according to Section 20 ASiG.

DGUV regulation 2 specifies the operating times. It differentiates between basic care (according to care group of 0.2 to 2.5 hours per employee per year) and company-specific care (risk-related, individually assessed). The division between the company doctor and the occupational safety specialist is determined in the care model. The Ordinance on Occupational Health Care (ArbMedVV) supplements the regulation with compulsory, optional and desired preventive care depending on the activity (appendix to ArbMedVV). Anyone who commissions an external occupational health service provider must contractually cover all three regulations, otherwise there will be a gap between the commission and the fulfilment of the obligation in the audit. CIVAC maintains an overview of the typical company doctor mandates by industry and size in the workspace and provides the associated contract templates, order texts and report templates in an audit-proof manner. The platform clearly distinguishes between basic support in accordance with DGUV regulation 2 and company-specific support, so that the hourly quotas are documented in a verifiable manner and do not have to be reconstructed in the audit from email traffic and invoice attachments. The appointment can also be linked to the mandate of the occupational safety specialist (SiFa), as both act together in the occupational safety committee in accordance with DGUV regulation 2 and share hours, inspections and lists of measures.

The first criterion is the professional qualifications of the provider. An occupational health service provider employs specialists in occupational medicine or doctors with an additional qualification in occupational medicine (Section 4 ASiG). Request an overview of the doctors intended for your location, with proof of qualifications, experience in your industry and hourly quota. A reputable list lists a named main contact person, a representative with the same qualifications and an emergency path in the event of a failure. Also request membership in the Association of German Company and Company Doctors (VDBW) or an equivalent professional association as an indicator of ongoing training.

Doctor density and regional coverage are the second element of the qualification test. A provider with two doctors for the whole of Germany can be formally qualified, but fails the on-site inspection, which is required at least once per year per location according to DGUV regulation 2. Clarify arrival times, response times for preventative care appointments (typically within two weeks for compulsory preventive care) and the capacity for special appointments (reintegration examinations, new job changes). Document the answers in the selection protocol, which will later become part of the commissioning document. CIVAC provides a structured tendering grid with 23 criteria that queries the points mentioned and passes the answers straight into the contract negotiation, so that you don't have to ask the same questions twice and the selection process is completed within four weeks instead of three months. The providers' answers are incorporated directly into the subsequent ordering document, without an employee in the compliance team having to manually switch back and forth between email, spreadsheet and draft contract. Others run compliance like a filing cabinet. We run it like software. As a result, at the end of the selection phase, a complete award dossier is available, with an evaluation matrix, justification protocol and recommendation to the management, which can approve the conclusion of the contract in a single meeting.

Operating times are the heart of the contract. DGUV regulation 2 measures basic care according to care group (Group I: 2.5 hours per employee per year, Group II: 1.5, Group III: 0.5). In addition, there are company-specific components that result from risk assessments and activity profiles. A qualified provider calculates these hours transparently, documents the distribution in a written timetable and at the end of the year issues a proof of performance that compares the hours actually worked with those agreed. This transparency is the basis for every supervisory audit by the professional association.

Accessibility is the second operational element. An occupational health service must be available by telephone and email during normal business hours, with a callback promise within one working day. For occupational medical emergencies (e.g. after a needle stick injury with a risk of hepatitis), a hotline with a response time of under two hours is required. Demand SLA clauses with measurable values, penalties for failure to comply, and escalation paths. A flat rate without an SLA is a risk: it cannot be enforced in the event of a claim. CIVAC provides an SLA sample matrix with eight categories (initial response, mandatory preventive care appointment, requested preventive care appointment, report of findings, inspection, annual report, emergency hotline, representation in the event of vacation), which can be used directly as an appendix to the contract and can later be tracked as a KPI in the workspace. The auditor calls, the evidence is ready., with daily accuracy for each location. In the annual report, the fulfilment of the SLA can be shown for each category, which makes the dispute with the service provider more objective and provides reliable arguments in the event of an escalation. For multi-location companies, it is recommended to differentiate the SLA according to location size in order to avoid blanket accusations against the service provider in the audit and at the same time reduce the effort for hourly billing and reporting.

Occupational medical findings are health data in accordance with Art. 9 GDPR and are subject to medical confidentiality in accordance with Section 203 of the German Criminal Code. The employer does not receive any findings, but only the suitability statement (suitable, suitable with restrictions, not suitable), and this only to the extent that it is necessary for the activity from an occupational health perspective. Compulsory and optional pensions are also subject to the prohibition of transmission to the employer in accordance with Section 6 Paragraph 3 ArbMedVV. Aptitude tests are to be separated from this and have their own legal basis.

When selecting a provider, it is therefore important to check how the practice of communicating findings is specifically organised. Does the provider have an encrypted patient management system according to BSI recommendations? Are findings processed in the EU (Schrems II conformity)? Does an order processing contract exist in accordance with Art. 28 GDPR for administrative data processing, separate from medical confidentiality? How are suitability statements transmitted (paper, encrypted portal, signed PDF)? A qualified service provider presents this architecture transparently and concludes an AV contract that clearly shows the separation between administrative processing and medical work. In the mandate of the external data protection officer, the audit of occupational health data processing can be integrated into the regular processor review, without separate audit loops, which materially increases auditor acceptance. The data protection officer's obligation to submit an annual activity overview to the supervisory authority can also be supplemented by the occupational medical processing context without creating a second, parallel documentation. The EU data residency of the CIVAC platform guarantees that the administrative data (appointments, attendance, suitability statements) never flow to a third country, which is not a self-evident feature of US-based occupational health platforms and, in the Schrems II context, can lead to contract negotiations lasting several years.

A reliable contract with an occupational health service provider contains at least nine building blocks. First: Service description with a separation between basic care (DGUV regulation 2, appendix 2), company-specific care and compulsory/offered preventive care according to ArbMedVV. Second: hourly quota per year and location, with carryover regulations and minimum order quantities. Third: SLA with response, appointment and findings transmission times, penalties, escalation. Fourth: Representation regulations with named representation and handover regulations. Fifth: Data protection and medical confidentiality with AV contract, Schrems II conformity and EU data residency.

Sixth: Reporting line to management, with annual report and event-related reports (e.g. after an accident at work, when certain illnesses accumulate). Seventh: Appointment certificate as an annex to the contract, with the order date, the name of the responsible company doctor, and termination regulations. Eighth: the employer's obligation to cooperate (provision of job profiles, risk assessments, lists of employees, suitable premises). Ninth: Termination and transitional regulations with data portability, end of contract report and transitional period. CIVAC provides a contract template with all nine components in the workspace, coordinated with DGUV regulation 2 and ArbMedVV and tested in the past against typical supervisory examinations by the professional associations. Audit-proof, documented, § 2 ASiG-proof, DGUV-2-proof, with a clear separation between the commercial flat rate and the legally defined minimum performance, so that no alternative arguments remain open in the event of a dispute. A poorly worded flat rate without a stated hourly structure is a common finding in audits, which often ends with the requirement that the contract be improved within three months, which creates operational uncertainty and puts management in an unnecessary situation with explanations to the professional association. The nine building blocks are therefore not a recommendation, but rather the minimum equipment. In the case of group contracts, there are typically three additional building blocks: group framework with order approval for each subsidiary, a uniform reporting structure to the group occupational health and safety committee and volume discount regulations with transparent distribution to the individual locations. CIVAC provides these group modules in the workspace and consolidates the role, location and mandate data so that annual group reporting is available at the push of a button.

The appointment of the company doctor is made in writing, Section 2 Paragraph 1 ASiG. The appointment certificate names the person (not the company), the date the order begins, the scope of the mandate (with reference to the framework agreement), the reporting line to management and the termination regulation. Even when commissioned externally, the order is specific to each person, not a flat rate for a company. If the responsible company doctor changes at the service provider, a new appointment certificate is required that documents the change. According to Section 9 ASiG, the works council must be heard before the appointment is made; the results of the hearing are included in the appointment certificate.

The reporting line is the second supporting pillar. The company doctor reports directly to the management, without an intermediate authority, and is not subject to instructions in his work (Section 8 ASiG). In practice, this means: an annual report on the status of occupational health care, participation in the occupational health and safety committee in accordance with Section 11 ASiG (at least quarterly), and the right to escalate if risks are identified without a reaction from the employer. The appointment certificate, signed, filed, verifiable. CIVAC produces the appointment certificate as a standard template with a hash-anchored timestamp and stores it in the workspace together with the works council hearing result, the contract and the annual reporting chain. During a supervisory audit, the complete file for the occupational health order is available as an audit package within minutes, without having to research personnel files or contract files or in email communications with the service provider. Licence the workspace for your internal representatives, or have our representatives order it. The order can be fully documented in both models without having to employ staff with specialist knowledge internally, which is the decisive lever for compliance without full-time positions, especially in companies with fewer than 250 employees. If the company doctor changes within the service provider, the new appointment certificate is automatically generated in the workspace, the works council is heard again and the handover is recorded so that the order chain remains unbroken for years.

The company doctor does not work in isolation. The occupational safety specialist (SiFa, § 5 ASiG), the fire protection officer (BSB, ASR A2.2), the hygiene officer (HB, § 23 IfSG for medical facilities) and the data protection officer (DSB, Art. 37 GDPR) are closely interlinked roles. In the occupational safety committee in accordance with Section 11 ASiG, the company doctor, SiFa, safety officers and representatives of the employer and works council sit at one table. An integrated platform enables coordination across role boundaries without appointments, inspections and follow-up measures being managed in four different isolated solutions.

Concrete interfaces are, for example: joint inspection (company doctor and SiFa carry out a joint site inspection every year, DGUV regulation 2 appendix 3), joint risk assessment (§ 5 ArbSchG, with occupational health and safety assessment), joint list of measures with escalation Failure to complete. Licence the workspace for your internal representatives, or have our representatives order it. At CIVAC, all 25 supported officer roles come together in one data model, with joint inspections, joint action lists and joint reporting cycles to management. Anyone who selects an occupational health service provider without this integration is accepting an isolated solution with a foreseeable consolidation debt in twelve to twenty-four months as soon as audit or group reporting requires a harmonised presentation. Practice shows that subsequent consolidation is significantly more expensive than initial integration because data models and contractual clauses have to be renegotiated. Audit-proof, documented, § 11 ASiG-proof. The interface to the DSB is particularly sensitive, as occupational medical data belongs to the special categories according to Art. 9 GDPR and must be shown separately in the list of processing activities. The DSB not only checks the legality, but also the technical and organisational measures of the occupational health service provider and reports findings directly into the CIVAC measures module, with deadline tracking and automatic escalation to management if they are exceeded.

Changing occupational health service providers is operationally sensitive and legally demanding. There must not be any gaps in the order during the change, otherwise § 20 ASiG (administrative offense due to missing order) and § 130 OWiG (breach of the duty of supervision) will apply. The preventive care file according to Section 3 Paragraph 4 ArbMedVV is part of the personnel file and is subject to medical confidentiality; The transfer does not take place automatically, but rather at the employee's request or with separate consent. Findings may not be exchanged between doctors without the employee's consent.

An orderly rotation follows a six-week plan. Week 1: Termination of the old contract with a deadline and determination of the expiry phase. Week 2: Selection of the new provider according to the criteria of this article. Week 3: Contract negotiation and appointment certificate with effect on the desired deadline. Week 4: Works council hearing according to Section 9 ASiG for the new appointment. Week 5: Handover discussion between the old and new company doctor on the general occupational health situation at the location (without personal findings), consent forms to employees for individual data transfer. Week 6: Start of the new order, handover protocol, entry in the workspace. CIVAC provides a change assistant that maps the six-week plan, provides templates for termination, hearing and handover and ensures that the appointment certificate transitions seamlessly into the following period. Turn reading into a mandate., without audit gaps and without repeated data protection conflicts. The clock starts on awareness.

The selection of an occupational health service provider is a compliance process with three levels: fulfilment of legal obligations (ASiG, DGUV regulation 2, ArbMedVV), operational provision (operation times, prevention, communication of findings, reporting line) and audit-proof documentation (appointment certificate, contract, reporting cycle, interface integration). Anyone who only negotiates the flat rate is missing two thirds of the relevant substance. The platform question is not secondary: an integrated solution across all representative roles reduces duplication of work, harmonizes reporting to management and makes the company doctor population a verifiable element of the corporate duty of care according to Section 130 OWiG.

CIVAC is the compliance platform and officer-as-a-service for German companies, with 25 productive representative roles including company doctor, 93 controls according to ISO/IEC 27001:2022, 490 ready-to-use audit templates, EU data residency and integrated 24/72 reporting path according to NIS-2. Licence the workspace for your internal representatives, or have our representatives order it, with an appointment certificate, reporting line to management and an SLA of two working days. You can find an overview of the supported roles on the company doctor page and in the CIVAC FAQ. Turn reading into a mandate.: Write to info@civac.de or use the contact form on civac.de. You will receive an initial assessment of your occupational health care situation within one working day, free of charge and confidentially, including a suggestion for integration with SiFa, BSB and DSB. If necessary, we also take care of the provider search, contract negotiations and the works council consultation within an agreed six-week plan, so that management anchors fully documented occupational health care with a single signature, instead of coordinating three months of appointments between HR, purchasing and compliance. The platform licence and the Officer-as-a-Service can be operated side by side: you let the company doctor order externally, but run the SiFa internally on the same workspace without creating double data maintenance.