Coronavirus: Workplace Health and Safety

On this page, we highlight the key health and safety issues, and provide links to the most up-to-date Scottish and UK Government guidance on workplace health and safety, and workplace closures, in light of coronavirus. We also summarise the legal risks for employers, if you don't take the steps required in terms of health and safety.


Which workplaces must remain closed?

For the most up-to-date position, see:

Scotland: Coronavirus (COVID-19) Phase 3: business and physical distancing guidance

England: Closing certain businesses and venues in England.

If you are in any doubt as to whether your workplace can open, please get in touch.

Should employees still be working from home if possible?

Even if your workplace is open, the Scottish Government guidance states that "remote working should remain the default position for those who can", and that "if you can work from home, you should." 

For some workers, it might be appropriate to take a 'blended' approach - whereby they carry out certain tasks in the workplace, which cannot be done from home, but work from home where possible.

The latest guidance in England is here. There is also sector-specific guidance for England, which includes guidance on who should come to work.

Government and Health & Safety Executive guidance for workplaces

The Scottish and UK Governments have produced guides for workplaces that are open, covering issues such as risk assessments, social distancing, cleaning and workforce management.

Workplace guidance in Scotland: 

Workplace guidance in England:

  • Working safely during coronavirus - this now includes 'taking part in NHS Track and Trace' (by keeping a record of all staff, contractors and visitors for 21 days) as one of the seven priority actions for businesses. 

Health and Safety Executive guidance:

Acas guidance:

Health and safety COVID-19 risk assessment

You have a duty, so far as is reasonably practicable, to ensure the health, safety and welfare of those working for you as well as those who physically interact with your business such as customers, contractors and delivery drivers.

If your workplace is open, but some employees can work from home, consider the government guidance discussed above.

For those in the workplace, you should carry out a specific risk assessment regarding the risks posed by COVID-19. This assessment should cover all aspects of your business activity, and consideration should be given to your employees' commute.

You should consider how you will manage workers who are pregnant, shielding, or at higher risk from COVID-19 - see below. You should also consider those who live with someone who is shielding or at higher risk - see below.

Advice on COVID-19 risk assessments is on the Health and Safety Executive website. See also the relevant guidance for your sector - see above.

Scottish Government guidance also indicates that support is available for workplace risk assessments for small and medium-sized businesses.

UK Government guidance advises that, if possible, you should publish the results of your risk assessments on your website. Businesses with over 50 employees are 'expected' to publish their risk assessments on their website.

Consultation with employees / representatives

You have a legal duty to consult your employees on health and safety matters. Depending on your circumstances, this consultation will be with representatives appointed by trade unions, employee-appointed representatives, or employees directly.

Your consultation should cover, for example, the measures you are introducing to manage COVID-19 risks. You should provide sufficient information to allow effective consultation. You should keep good written records of the consultation process, in order to evidence, if required at a later stage, that you have complied with this duty.

For more information on health and safety consultation obligations see Health and Safety: Consultation, or contact us if you have a specific query.

Implementation and review

Once you have identified risks, you will need to implement control measures to reduce or eliminate those risks. You must also take steps to enforce those control measures. For example, communicate effectively with your workers, explain any new processes, and take steps to ensure workers comply with these.

This is an evolving situation, and government advice could change as matters develop. You should therefore keep your risk assessment under review to take account of changing government advice and as your business operations develop.

Social distancing


In Scotland, legislation provides that all businesses must:

  • take all reasonable measures to ensure that a distance of two metres is maintained between people - which will cover both your workers and clients / customers - on the premises (except between two members of the same household, or a carer and the person assisted by the carer);
  • take all reasonable measures to ensure that they only admit people to their premises in sufficiently small numbers to make it possible to maintain that distance; and
  • take all reasonable measures to ensure that a two-metre distance is maintained between any person waiting to enter the premises (except between two members of the same household, or a carer and the person assisted by the carer).

In some settings, including shopstransport, tourism and hospitality, the two-metre rule is reduced to one metre, but mitigating measures should be in place - the guidance in each of the links provides more detail. 'Shops' does not include banks or building societies.

Failure to comply with these rules will be a criminal offence (and may carry some of the risks set out below).

See also the Scottish Government business and physical distancing guidance, and sector-specific guidance, mentioned above. There is also separate guidance on social distancing in non-healthcare public services.


In England, sector-specific workplace guidance includes advice on how to implement social distancing for that type of workplace. The social distancing guidance in England is not backed by legislation, however, a breach could still carry some of the risks set out below.


In addition to social distancing in your workplace, consider also whether you can help employees maintain social distancing when travelling to work – for example, can you change their working hours so they are travelling at quieter times, provide a car parking space near the workplace or encourage travel by foot or by bike?

In implementing social distancing, don't forget about your normal health and safety duties. For example:

  • Does a reduction in staff on-site present a security / safety risk to those in the workplace?
  • If a task had previously been assessed as requiring two people, but social distancing makes that impossible, how should you react? Contact us if you need advice.

Other health and safety measures

The guidance above from the Scottish and UK Governments sets out measures you should take in your workplace. However, if your risk assessment identifies additional measures that are not in the guidance, you should also implement these measures.

There may be additional steps you need to take, from an employment law perspective, before you can implement certain health and safety measures. For example, putting a new shift system in place is likely to mean you will need to amend employees' contracts – see Changing Terms and Conditions, or contact us if you need advice. You should also consider your duty to consult on health and safety matters, discussed above.

Personal Protective Equipment (PPE) and face coverings

The guidance above includes advice on PPE and face coverings.

The UK Government and the Scottish Government have issued separate guidance on the use of face coverings, which includes advice on the circumstances in which face coverings are required by law.

You should read the guidance, as well as consulting the sector specific guidance relevant to your business and consider, via your risk assessment, whether PPE or face coverings are required in your workplace. You should regularly review the position to ensure you are complying with the current Government guidance and legislation. If you need advice on what is appropriate in your workplace, please contact us.  

Staff testing and temperature checks 

Can we refer staff for virus testing?

The NHS services offer testing to anyone with symptoms.  Workers can self-refer, or alternatively:

Internal staff testing programmes

Given the constraints on testing services provided by the NHS, you may be looking to develop (or engage third parties to provide) internal testing services for the workforce. The government has set out some guidance which applies to England only - equivalent guidance is to be published for Scotland, Wales and Northern Ireland.

What do we need to consider before deciding to test staff?

Before implementing a testing programme, consider the following issues:

  • Who will the testing cover – just employees or anyone working onsite? Will it apply to all workers or just certain groups? Will it apply to staff with or without symptoms? How will you deal with agency workers and contractors?
  • How often will staff be tested?
  • Do you have appropriate testing facilities?
  • What will you do if individuals refuse to be tested?
  • Is the proposed programme compatible with your employment, data protection and health and safety obligations?
  • What type of test will be used? If a third party is providing the testing services, have you carried out appropriate diligence and put in place an appropriate contract?
  • How will you use the test results? Do you have staff that have been properly trained in handling health data?
  • What policies need to be updated to deal with, for example, handling health information, absence from work and self-isolation?
Communicating with staff prior to starting a testing programme

The guidance emphasises that it is important to be as transparent as possible about any new internal testing programme before it begins. Communications with the workforce should include clear information on the purpose of the testing; whether or not it will be mandatory; what happens after the results are received, what support will be available throughout the process; and what the consequences will be of failing to agree to take a test.

In addition, in order to comply with your data protection obligations, staff being tested should be given details of what data will be collected; how long it will be kept for and where; and on how and with whom their data may be shared. This could be in an updated privacy notice or a COVID-19 testing policy.

The guidance strongly advises employers to consult with staff associations or trade unions before implementing a testing policy. This is likely to help deal with any initial issues, and their support would obviously make the introduction of any regime easier.

Data protection obligations

Although data protection law does not stop you from testing employees for COVID-19, workplace testing will only be appropriate in specific circumstances (see the ICO guidance and our earlier blog). It's therefore essential to carefully consider the data protection issues before commencing a testing programme. 

In summary, in addition to the requirement to communicate with staff on the processing issues noted above, you must:

  • Undertake a data protection impact assessment in advance of the start of the testing programme (because testing employees for COVID-19 amounts to processing health information which is special category personal data). This will help identify whether the proposed testing programme is fair and lawful, the potential risks and what further policies, procedures, and notices are required.
  • Identify what objectives the testing is designed to achieve; and then consider if testing is necessary to achieve those objectives. Is testing a proportionate way to address the risks identified in your health and safety risk assessments, or could less intrusive measures be used?
  • Consider what the legal basis is for processing the data associated with the tests. This will most likely be compliance with employer health and safety obligations, but each organisation will need to reach its own conclusion on this. Whether testing is necessary will depend on the risks and options for mitigating those risks. Testing may be necessary for compliance with health and safety obligations for one group of employees, but not another. Different considerations will apply, however, if testing is also offered to individuals living in the same household as your staff.
  • Keep test results secure and disclose them to as small a group as possible. Develop appropriate policies and protocols for this.
Selecting the appropriate type of testing kit

The guidance contains information and links to further details on the following issues:

  • The difference between virus and antibody testing
  • Selecting and procuring test kits
  • Collecting COVID-19 samples to test – both point of care tests and self-administered/assisted sampling tests
  • Handling samples in transit
  • Minimum standards for laboratory facilities
  • Using technology to capture and disseminate results
  • Collecting results 

You will want to ensure that these issues are addressed in your contract for the supply of testing kits and testing services.

Communicating test results
  • Before taking a test, if should be clear to employees what happens with their test results; and who they will be shared with, why and when.
  • Test results should ideally be communicated by a healthcare professional, or someone in occupational health or HR who is subject to confidentiality restrictions and has had training on handling health information. If, however, results are communicated via text message or an app, the healthcare professional (or appropriate person) should be accessible to staff.
  • It's good practice for test results to be accompanied by clear information on what they mean and guidance on what happens next. If an individual tests positive they must self-isolate in accordance with current guidance.
  • Public health authorities must be notified by the laboratory carrying out the test if a member of staff has a positive virus test result. NHS Test and Trace (in England) or NHS Test and Protect (in Scotland) will then contact the individual to collect information about their recent contacts.
  • If there is more than one case of COVID-19 on the premises, you are required to contact the local Health Protection Team.
  • The guidance encourages employers to keep staff informed about potential and confirmed COVID-19 cases but makes it clear that individuals should not be named.
What about temperature checking or using thermal cameras?

The guidance issued by the government does not cover temperature checks or the use of thermal cameras as a means of testing staff. It notes that there is little scientific evidence to support them as reliable methods of detecting COVID-19.

The data protection considerations outlined above may also apply to these forms of workplace testing depending on how the checks are carried out; and as part of that you would need to consider whether the same results could be achieved through other less privacy intrusive means.

What can we do if an employee refuses to take a test?

Obtaining consent is the ideal from an employment law perspective. However, some employees may be reluctant to agree on the basis that it is an unnecessary intrusion of privacy, particularly if they are not exhibiting symptoms and there are other ways to minimise the spread of infection (e.g. effective social distancing at work).

If an individual refuses to take a test, the reason for withholding consent should be explored: is it financial, medical or as a 'point of principle'? Re-iterate the reasons for and benefits of the testing; and provide information about sick pay during self-isolation. Medical objections might have to be referred to HR/occupational health; and there may be additional considerations for those with disabilities.

If the refusal is unreasonable, and testing is clearly justified, as a last resort it may be possible to discipline the employee on the basis that they have failed to follow a reasonable management instruction intended to protect health and safety.

Further information

For information on contact tracing go to the page on Coronavirus: FAQs for employers or click on the following:

What if someone is unwell or is self-isolating?

You should communicate regularly to your workers, and others using your premises, that they should follow the government rules on self-isolation.

If someone becomes unwell at work with symptoms of COVID-19, you should send them home and advise them to remain at home in line with the government rules on self-isolation. See our FAQs for Employers for more on sick pay and self-isolation.

The Health and Safety Executive has also clarified that, in certain circumstances, employers must report new cases of COVID-19 under RIDDOR - this is discussed in our blog Navigating COVID-19: reporting requirements under RIDDOR.

From 28 September it is an offence in England to allow someone required to self-isolate to come to the workplace.

See also, If an employee refuses to self-isolate, can we prevent them from accessing our premises?

What if someone who has been at the workplace tests positive?

ACAS advises that, in these circumstances, the workplace does not necessarily need to close, but should follow government advice on cleaning. However, you will need to consider whether any other workers, who have been in contact with that person, will need to self-isolate - here is the NHS guidance on self-isolation.

Government guidance advises that if there is more than one positive case in a workplace, employers should contact their local health protection team to report the suspected outbreak.

The Health and Safety Executive has also clarified that, in certain circumstances, employers must report new cases of COVID-19 under RIDDOR - this is discussed in our blog Navigating COVID-19: reporting requirements under RIDDOR.

Employees who are pregnant, shielding, age 70+, or with underlying health conditions

Guidance on managing these employees is in our FAQs for Employers.

What if a worker lives with a vulnerable person, or is just concerned about coming to work?

Guidance is in our FAQs for Employers.

What about the health and safety of homeworkers?

We have a separate Workbox page: Health and safety: Homeworking.

Business travel

Guidance is in our FAQs for Employers.

What are the risks for us as employers?

In summary, if you don't take the steps that are required in terms of health and safety, the risks include:

  • Increased risk of COVID-19 spreading in your workplace, with potential consequences for individual workers and your business.
  • If you open your business when it has been ordered to close, or fail to comply with Scottish legislation on social distancing, this will be a criminal offence. Penalties include a fixed penalty notice, or prosecution and an unlimited fine, if convicted. Police officers and local authorities can also issue prohibition notices, which require the business / individual served with it to stop doing something - this could be a specific work task or even forcing all work to stop until the officer considers that the legislation is no longer being breached.
  • Allowing someone who is required to self-isolate to come into the workplace is an offence in England, with fines starting at £1000.
  • Breaching health and safety obligations could result in investigation and/or criminal prosecution of the business and/or its officers / directors / managers as individuals. Potential penalties include fines, and prison sentences for individuals.
  • Missing a reporting requirement under RIDDOR in relation to COVID-19 is a criminal offence.
  • Claims for personal injury from workers who have contracted COVID-19 (or other injury) as a result of the business' failings.
  • Increase in grievances, whistleblowing and health and safety-related complaints. You should not dismiss an employee or subject them to a detriment simply because they make a health and safety complaint or blow the whistle - if you do, this could lead to an employment tribunal claim.
  • In theory, employees resigning and claiming constructive unfair dismissal, although, in the short-term, given the current employment climate, this is perhaps less likely than would normally be the case.
  • Automatic unfair dismissal, or detriment claims, in an employment tribunal, if you dismiss an employee or subject them to a detriment (such as disciplinary action) because they refuse to attend work in circumstances where they reasonably believe that there is a risk of contracting coronavirus due to insufficient protective measures in the workplace.
  • Unlawful discrimination, particularly on grounds of age, pregnancy or disability.
  • Risk to your business reputation.

Consider your insurance position

In addition to ensuring safe working practices, it is important to ensure that, in the event of an investigation or claim you are covered by your existing insurance policies. Some business insurance cover is dependent on disclosure of material changes in operating circumstances. Whilst insurers are deemed to be well aware of COVID-19, they may not be aware of the specific way in which it is impacting your business and the steps you are taking to adapt.

To ensure you don't fall foul of a notification requirement, you should make sure your insurer or brokers have been updated with the steps you have taken to adapt working practices and insurers should be asked to confirm in writing that the arrangements satisfy the policy requirements. Contact us if you need to discuss this.