Why a separate regime
Health data cannot be processed like an ordinary personnel record. Who may access it, how long it is kept and what happens when the relationship ends are defined in advance. Without those definitions, the data is not in fact protected.
Narrowing access
The fitness conclusion of an examination and the clinical detail are not held at the same access level. What goes to the employer is fitness for work; diagnosis and test detail stay with the physician. If that separation is not built technically, a policy document alone is not enough.
Retention and destruction
A retention period is set for each record type; data past its period is destroyed by a defined procedure. Indefinite retention is a sign of neglect, not of protection.
When the relationship ends
When the service relationship ends, records are delivered to the employer. What happens to the copy in the provider's system afterwards is decided in writing, and its application is recorded.
In Optifora
Health surveillance data is visible under separate permissions; access is logged, retention is defined, and which records were delivered at handover is listed.