A 'how to guide' regarding the legal dos and don't when conducting health checks as part of an employment screening process.
Pre-employment Medical Checks
There is no legal obligation for employers to require prospective employees to undergo medical examinations.
Under the Equality Act 2010, employers must not ask job applicants to complete a health questionnaire or undergo a medical examination prior to making job offers to them (whether conditional or unconditional).
The same principle applies to questions about disability or health asked at a job interview.
Nevertheless, many employers require pre-employment medical checks to confirm job fitness and detect pre-existing conditions.
These checks should be relevant and not excessive for the position.
Employers must clearly define their objectives and only conduct consistent health checks.
Data Protection
Health information obtained from prospective employees, whether through medical questionnaires or health assessments, must remain confidential and be managed in compliance with UK GDPR regulations, as it is classified as a special category of personal data subject to enhanced protections.
The processing of such data typically requires explicit consent or may be permitted when necessary, under employment law; however, obtaining valid consent in the workplace is uncommon due to inherent power imbalances.
Employers may process health data for legal compliance, provided actions are proportionate and follow ICO guidance.
The ICO advises employers to:
- Only collect essential health information
- Clarify why medical exams are needed
- Be transparent about data use
- Consider alternatives like health questionnaires
- Inform applicants early if medical exams are required
- Ensure assessments are relevant to the role or preventing discrimination
- Have qualified professionals interpret medical data
Managers should access health information about job applicants only when it is necessary for fulfilling management responsibilities or evaluating fitness to work.
Pursuant to the Data Protection Act 2018, organisations that process special categories of personal data are required to maintain an up-to-date policy detailing its use, retention, and erasure.
This policy must be accessible for review by the Information Commissioner.
Additionally, employers who collect health data from applicants during the recruitment process must disclose this practice within their privacy notice.
Access to Medical Reports
An employer cannot contact a job applicant's GP or consultant for health information without first giving the applicant a written statement of their rights under the Access to Medical Reports Act 1988 and getting their written consent.
A job applicant is entitled to review a copy of the report before it is provided to the employer and may request the doctor to remove any information, they consider damaging or irrelevant.
This right does not apply to reports prepared by a company doctor or by a doctor selected and compensated by the employer processing health data under UK GDPR, it remains a legal requirement under the Act.
The job applicant has the legal right to see a copy of the report before the employer and can ask the doctor to redact information that they consider to be damaging or irrelevant.
That same right does not extend to reports prepared by a company doctor or a doctor nominated and paid for by the employer.
Download our health checks guide