© Crown copyright 2020
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: email@example.com.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/coronavirus-covid-19-testing-guidance-for-employers/coronavirus-covid-19-testing-guidance-for-employers-and-third-party-healthcare-providers
Important: NHS Test and Trace is for those who display symptoms of COVID-19 or who have been advised to take a test by a medical practitioner or public service. Employer and third-party healthcare providers wishing to provide a test to staff must not advise individuals without symptoms to get a test from the limited supply offered by Test and Trace, but may offer alternative private provision, in accordance with this guidance.
High-quality testing provides confidence and clarity – for employers and for their colleagues.
The creation of a large-scale programme of testing and tracing is designed to help us lift some of the national restrictions and slowly restore our economy and our society.
As well as this, many employers wish to introduce their own internal testing programmes outside the NHS Test and Trace service, which focuses tests on symptomatic individuals.
It is a voluntary decision for employers to run testing programmes for their staff. If done correctly, testing can provide confidence to workers and customers in the workplace and may help to protect and enable business continuity.
Where employers are considering – or are already running testing programmes – this guidance sets out the legal obligations and best practice to follow, ensuring new and innovative programmes are as reliable and effective as possible.
This guidance covers:
- the legislation, regulations and guidance for employers and third-party healthcare providers
- virus and antibody testing
- how to interpret test results and what the next steps should be after a positive or negative test
This guidance does not:
- replace the need for independent legal advice and it does not supersede existing legal obligations, including those relating to health and safety, employment law, data protection or equalities
- cover temperature checks or the use of thermal cameras as a means of testing staff. As the Medicines and Healthcare products Regulatory Agency (MHRA) has set out, there is little scientific evidence to support temperature screening as a reliable method for detection of COVID-19
- excuse employers from following the broader national measures in place and any specific regional or local requirements in relation to 'areas of concern' or areas of intervention', for example:
- following the guidance for employers and businesses on coronavirus (COVID-19) on COVID-19 protective measures in the workplace
- following the guidance on local restriction tiers
- referring staff to NHS Test and Trace, which offers testing to anyone with COVID-19 symptoms. A virus test can be booked via the NHS website for anyone with symptoms, see information on which employees are eligible
- supporting staff to self-isolate if they or a household member have symptoms of, or have tested positive for, COVID-19 or if they are advised to do so by NHS Test and Trace.
- following the Health and Safety Executive (HSE) guidance on member of staff safety and conducting risk assessments
This guidance will be updated on an ongoing basis. It applies to England only, and there will be equivalent guidance published for Scotland, Wales and Northern Ireland.
What test results mean
Tests results identify whether an individual has a current or past infection. For COVID-19, there are 2 categories of tests: virus tests and antibody tests. Before deciding to test staff, it is essential employers understand what a test result actually means.
All employers and workers must follow the guidance for employers and businesses on coronavirus (COVID-19) on protective measures in the workplace, regardless of the result of either a virus or antibody test. Employers and employees must also follow the guidance set out for local restriction tiers.
A virus test will identify whether somebody has COVID-19 at that moment.
There is a legal duty to self-isolate:
if you have received a positive test result from a COVID-19 test and/or you are a close contact of someone who has tested positive; and
if, in both circumstances, you have been notified of the need to self-isolate by NHS Test and Trace, a person employed or engaged for the purposes of health service, or a local authority
There is no legal duty to self-isolate while waiting for a test result or if you live with someone with symptoms who has not received a positive test result. However, guidance remains that you do self-isolate where advised to, including in these circumstances, where there is no legal requirement to do so.
If a member of staff tests positive, the member of staff will be informed by the medical practitioner or diagnostic laboratory analysing the test and they:
- must, by law, immediately self-isolate (or continue to self-isolate if they are already doing so) when asked to do so by Test and Trace, a person employed or engaged for the purposes of health service, or a local authority, until 10 days after the point of developing symptoms (if they have symptoms), or 10 days from the date of the test if they do not
- should share information promptly about their recent contacts when they are contacted by NHS Test and Trace, so that Test and Trace can alert those contacts if they need to self-isolate.
If a worker tests negative for the virus, this means they are at low risk of having COVID-19 at that moment in time. It does not mean they are definitely negative for COVID-19, nor that they are no longer at risk of catching it in future. A member of staff does not need to self-isolate if their test is negative, as long as:
- no other member of their household has symptoms or has tested positive
- no one in their support bubble has symptoms or has tested positive
- NHS Test and Trace has not told them to self-isolate
- they feel well – if they feel unwell, they should stay at home until they feel better
See more details on what a virus test result means.
If testing symptomatic staff, a virus test should be carried out as soon as possible and, in all events, within the first 5 days of having symptoms.
NHS Test and Trace is only for those who display symptoms of COVID-19, or who have been advised to take a test by a medical practitioner or public service. Employer and third-party healthcare providers must not advise individuals without symptoms to get a test from the limited supply offered by Test and Trace, but may offer alternative private provision, in accordance with this guidance.
If testing asymptomatic staff, the current advice is clear that a virus test will tell the individual whether they potentially have COVID-19 at that moment in time. If employers wish to offer repeat tests to asymptomatic staff, there is not yet a clinically defined number of times that an individual should be tested within a given timeframe. However, guidelines on how to decide on the frequency of testing are in annex B. A worker does not need to isolate whilst awaiting their result unless they have COVID-19 symptoms.
If somebody develops symptoms after receiving negative results from a test when they were not displaying symptoms, they must self-isolate for 10 days from the point of developing symptoms and should get re-tested.
An antibody test looks for the presence of antibodies (which are produced by people with the virus) against the COVID-19 virus.
A positive result indicates the person has previously had the virus, but does not indicate immunity to COVID-19 infection, or whether you can spread the virus to other people. Those who test positive, and those who test negative, should continue to follow safer workplace guidelines including social distancing measures.
It is important to recognise that there is currently no strong evidence to suggest that those who have antibodies have developed long-lasting immunity which would prevent them from ever getting the virus again.
The value of antibody tests is currently limited to answering the question of whether someone has had the virus or not, and helping us to understand more about the virus and how it spreads.
See more details on what an antibody test result means.
The testing process
Before deciding to test staff
Before deciding to establish a testing programme, employers are advised that they are clear on:
- who the testing will cover – for example, whether this is all directly employed staff, or includes individuals working onsite, like contractors
- what the focus of the programme is: staff with symptoms or without symptoms
- how often staff will be tested
- the appropriate facilities for carrying out the tests
- which test should be used (to be clear, virus tests are designed to detect active infection whereas antibody tests only reveal evidence of previous infection)
- what the arrangements will be for any individual who does not wish to be tested
- how the employer will use test results, including its policies on matters like handling health information, absence from work, self-isolation, diversity, non-discrimination, and so on
- the compatibility of the programme with its legal responsibilities to staff including under health and safety, equalities, data protection and employment law
- how, and by who, the legal duty to report test results to Public Health England (PHE) will be carried out
- the affordability of implementing a testing programme
Third-party healthcare providers who want to sell a testing service are advised that they are clear with employers on:
- the benefits and downsides of testing their staff
- how reliable the results will be, and what the limitations are
- what a test result means, in non-medical language
- how they are following the measures set out in this guidance
Third-party healthcare providers should understand what legislation and regulations they will need to follow, including around data protection and patient confidentiality, and how they will meet these as required.
Communicating the intention to test staff
Transparency is very important when outlining to staff an employer's decision to develop and implement a testing programme.
When communicating with staff about a new internal testing programme, employers are strongly advised to communicate clear information on:
- why they are setting up a testing programme, as well as or instead of accessing the existing national programme
- whether the programme is voluntary or mandatory
- what the consequences are for staff who decline to take part in the testing programme
- what the next steps are for staff after they receive the result, including the requirement to notify their employer of a duty to self-isolate if the worker is due to work (or undertake work activities) during the isolation period. Failure to do so may result in a £50 penalty
- where staff can seek advice on their rights throughout the process
- whether staff will have the opportunity to discuss the collection of such data if they have any concerns
- what to do after receiving a test result, including the legal requirement to self-isolate for 10 days from the beginning of any symptoms, in the case of a positive test
Employers are strongly advised to consult with their staff associations or unions ahead of developing and implementing any policy.
The Information Commissioner's Office (ICO) has set out specific points on GPDR and the Data Protection Act 2018.
To comply with the GDPR and the Data Protection Act 2018 employers must:
- process all data lawfully, fairly and transparently
- ensure staff are aware of what personal data is required, what it will be used for, and who it will be shared with taking account of the ICO's guidance on individual rights
- make staff aware of how long they intend to keep the data for
Employers are advised to make all staff aware of how their personal data will be processed before processing begins. Further detailed information on how to do this is set out in the guidance for employers by the ICO.
Selecting and procuring test kits
Selecting a type of test
The MHRA has set out guidance explaining how both virus and antibody tests work. More information on the process can be found in the What test results mean section.
Third-party healthcare providers who offer a testing service are strongly advised to be as open and clear with employers as possible when informing them of the clinical specification and implications of the test result.
Procuring test kits
Test kits in the UK are regulated by the MHRA, which is responsible for administering and enforcing the law on medical devices in the UK. It has a range of investigatory and enforcement powers to ensure their safety and quality.
As with all medical devices sold in the UK, manufacturers must place a CE mark on products that diagnose diseases (sometimes known as IVDs).
Tests without a CE mark are not legally allowed to be placed on the EU and UK markets, unless they have an exemption. All tests granted an exemption during the pandemic are published by the MHRA.
Employers must make sure that the test kit they or their provider is procuring is legal in the UK, either through having the CE mark or an exemption.
The EU directives below have more information on the definitions and regulations of medical devices:
- the In Vitro Diagnostic Medical Devices Directive 98/79/EC sets out the regulatory requirements for in vitro diagnostic medical devices (test kits). This was transposed into UK law in in the Medical Device Regulation 2002
- the Medical Devices Directive 93/42/EEC sets out the regulations for other medical devices (that is swabs, lancets) and for software (including apps) which meet the definition of a 'medical device'
If a testing service takes on the role of legal manufacturer then the regulations that cover manufacturing become obligations.
Third-party healthcare providers and any staff responsible for procuring test kits on behalf of the employer are strongly advised to be aware of the MHRA's guidance below:
- guidance on the In Vitro Diagnostic Medical Devices Directive 98/79/EC. This guidance outlines the current controls on the sale and supply of IVDs (test kits) and explains the main features of Directive 98/79/EC which regulates the manufacture and procurement of an IVD
- guidance on Management of In Vitro Medical Devices. This guidance is aimed at all staff who are responsible for purchasing, supplying, using, maintaining and replacing IVDs (test kits)
Collecting COVID-19 samples to test
The Medical Devices Directive 93/42/EEC and the In Vitro Diagnostic Medical Devices Directive 98/79/EC require test kits and sampling kits to have appropriate instructions for use for the intended sample collector, whether that is a healthcare professional or lay person.
The packaging and labelling must also clearly advise on the correct storing, handling and transporting of the device.
Everyone who is responsible for overseeing sample collection must understand these instructions clearly and are encouraged to feed information into manufacturers' post market surveillance system through the coronavirus Yellow Card reporting site. MHRA has published guidance on reporting to the Yellow Card scheme for health care professionals.
There are currently 2 methods for collecting samples for COVID-19, that apply for both virus and antibody testing:
1. Point of care tests
A sample is collected by a fully trained and qualified healthcare professional in a medical or laboratory setting, rather than by the person being tested.
The results should be interpreted by a trained and qualified healthcare professional.
Depending on the type of test and how the sample is collected, the healthcare professional collecting the sample may need to be registered with CQC for either the regulated activity of diagnostic and screening procedures or treatment of disease disorder and injury procedures. You can see further guidance on regulating coronavirus (COVID-19) testing.
2. Self-administered and assisted sampling tests
The sample is collected by the person having the test (self-administered) or by someone else (assisted) in a home or non-laboratory environment like a police station, care home or drive-through centre.
A sample for antibody tests is often a finger prick blood sample, and for virus tests it is often a swab sample. The sample is placed into the special packaging provided with the sample kit and sent to a lab for analysis. The tests may give results that need to be interpreted by a trained and qualified healthcare professional.
If these tests are taken outside the home, such as in a drive through test site, the individual collects their own sample, such as using a swab on themselves. For those who have assistance in collecting their sample, it is strongly recommended that the individual assisting the collection is trained by a healthcare professional in sample collection. This ensures the sample is taken properly and future results are more reliable.
Employers are strongly advised to make reasonable adjustments for a member of staff's personal situation if they ask them to give one of these samples, for example taking into account if they cannot drive to a testing facility.
It is very important for self-administered and assisted sampling tests that employers and third-party healthcare providers are aware:
- of the NHS guidance on how to use self-test kits safely and warning about self-test health kits. All staff who are asked to collect a self-administered virus test sample are also advised to watch the short video on how to self-administer a swab from a sample kit
- that self-administered and assisted sampling is sometimes confused with less reliable 'self-test kits'. A self-test kit involves a non-medical professional, for example the individual member of staff, collecting their own sample. They then test that sample and read and interpret the results by themselves rather than sending the sample to a laboratory for testing and processing. None of these COVID-19 kits have currently received a CE mark and so there are currently no self-test kits in the UK suitable for home use. Using the wrong type of testing kit in the wrong setting can lead to inaccurate results, a false sense of confidence and increased pressure on our NHS and social care systems
After a sample is collected, the individual being tested is advised to follow the below steps while waiting a test result:
- if symptomatic, the individual being tested should self-isolate for 10 days while waiting for, and regardless of, the test result. Anyone the individual being tested lives with, or are in a support bubble with, should also self-isolate for 14 days from the last point of contact
- if asymptomatic, the individual being tested does not need to self-isolate, until they receive a test result. If the test result is positive, they must then isolate once contacted by Test and Trace, a person employed or engaged for the purposes of health service, or a local authority. If the individual becomes symptomatic between taking the test and receiving the result, we advise that they should self-isolate for 10 days from the point at which they received their result, regardless of the test result. Anyone they live with or are in a support bubble with should self-isolate for 14 days from the last point of contact, regardless of the test result
Handling samples in transit
PHE follows the World Health Organization guidance on regulations for the transport of infectious substances 2019-2020. Employers are advised to follow the same guidance.
It’s a legal duty for those responsible for the handling, transportation and laboratory analysis of test samples to meet the provisions set out in the Control of Substances Hazardous to Health Regulations 2002 Schedule 3: Additional Provisions Relating to Work with Biological Agents. Employers and third-party healthcare providers are highly advised that they ensure these provisions are met.
Whether privately contracted laboratories or in-house laboratories are being used, it is highly recommended that they are UKAS accredited, or working towards UKAS accreditation, and have quality management systems operating according to ISO 15189 and/or ISO 17025. This is the standard used in all NHS laboratories.
If a laboratory is already UKAS accredited, it may still need to apply for an 'extension to scope' to deliver COVID-19 testing. If procuring or being offered laboratory services, it is important to check the laboratory's UKAS accreditation includes COVID-19 testing. You can see more information, including identifying laboratories with accreditation.
An employer or third-party healthcare provider is strongly encouraged to make sure the systems below are in place, as a minimum, before procuring its services:
- clear governance and lines of accountability for example senior responsible officer, clinical lead, quality lead, training lead
- staff are appropriately trained and there is evidence of competency assessment and participation in the External Quality Assessment (EQA) competency tool
- liability and indemnity cover for staff
- a verification report for the laboratory element of the test (known as the assay), in line with national protocols
- appropriate laboratory information management systems (LIMS) to monitor sample delivery and tracking
- working to containment level CL3 or CL2+ with HSE approval
Laboratories are legally obliged to ensure they have a mechanism to report any COVID-19 virus test results (positive, negative, void and indeterminate) to PHE.
All employers and third-party healthcare providers are recommended to make sure laboratories are following PHE, Royal College of Pathologists (RCPath) and Institute of Biomedical Science (IBMS) guidance on safe handling, processing and recording of samples and specimens in laboratory conditions. These include:
- guidance on safe handling of samples and processing in laboratories
- guidance for sampling and for diagnostic laboratories
- guidance on retention and storage of pathological records and specimens
Collection of results
Use of technology (such as apps) to capture and disseminate results
Apps that are used to capture, store and disseminate health results can be considered to be medical devices, and so are regulated by the MHRA under the Medical Devices Directive 93/42/EEC. Employers and third-party healthcare providers have a legal duty to meet these regulations if they apply to their technologies.
The MHRA has also published advice for apps and software that is used or developed in response to COVID-19.
Collection of results
Clinical responsibility to report virus test results
When collecting results, all medical practitioners have a statutory duty to report positive, negative, void and indeterminate results of COVID-19 virus tests under the Public Health (Control of Disease) Act 1984 and the Health Protection (Notification) Regulations 2010.
If a member of staff has a virus test, employers and third-party healthcare providers should ensure that the test provider, or laboratory processing the tests, is meeting their legal requirement to notify PHE of test results. This includes employers running internal testing programmes that are not using a third party. There is further guidance for reporting results to PHE.
From 28 September, individuals who test positive must notify their employer of a duty to self-isolate if they have been contacted by Test and Trace, a person employed or engaged for the purposes of health service, or a local authority and are due to take part in any work-related activities outside of the place where they are isolating during the isolation period. This is set out in the Health Protection (Coronavirus, Restrictions) (Self-Isolation) (England) Regulations 2020.
Awareness of false results
False results undermine the reliability and effectiveness of our response to COVID-19.
Employers and third-party healthcare are strongly advised to report all suspected incidents that may lead to false virus or antibody test results (both false negative and false positive) associated with medical devices and IVDs:
- health institutions in England and Wales are advised report to MHRA via Yellow Card
- Welsh incident reports are advised to also be copied to the Surgical Materials Testing Laboratory
- health institutions in Scotland are advised to report via the Health Facilities Scotland Incident Reporting and Investigation Centre
- health institutions in Northern Ireland are advised to report via the Northern Ireland Adverse Incident Centre
Data collection and individual rights
Data protection does not prevent the necessary and proportionate use of personal data for COVID-19 response. Data protection law has built-in flexibility to ensure it does not prevent appropriate health and safety measures being implemented in the workplace or action taken in the overwhelming public interest. Nevertheless, there are important data protection considerations to take into account when processing personal data, particularly health data.
The ICO has set out FAQs on data collection and data protection relating to COVID-19 that provide further information.
Contact tracing staff
NHS Test and Trace
The government has developed NHS Test and Trace to ensure that anyone with symptoms of COVID-19 can quickly be tested to find out if they have the virus, help trace close recent contacts of anyone who tests positive for coronavirus and, if necessary, notify them that they must self-isolate at home to help stop the spread of the virus. Employer guidance is available in NHS Test and Trace in the workplace.
The providers of, and laboratories processing, virus tests are legally required to notify PHE of all test results. This ensures that NHS Test and Trace is able to trace the individual concerned to collect information about their recent contacts and alert those contacts if they need to self-isolate.
Individuals who test positive must notify their employer of a duty to self-isolate if they have been contacted by Test and Trace, a person employed or engaged for the purposes of health service, or a local authority, and are due to take part in any work-related activities outside of the place where they are isolating during the isolation period.
It is an offence for an employer to knowingly allow a person who has been told to self-isolate (either following a positive test, contact by NHS Test and Trace, or due to a requirement to quarantine after travelling from abroad) to work anywhere other than where they are self-isolating.
NHS Test and Trace will not generally contact employers unless 2 or more new COVID-19 cases are linked to a workplace setting. If employers identify that there is more than one case of COVID-19 on your premises, they should contact their local health protection team (HPT).
Internal tracing systems
Some employers may want to introduce their own internal tracing systems alongside internal testing programmes. This would be a voluntary decision, and it would not be a substitute for NHS Test and Trace. It is important that advice from NHS Test and Trace takes precedence over internal advice on isolation.
When developing a system, it is critical that due regard is given to the interaction between internal tracing systems and NHS Test and Trace and how this impacts employee rights such Statutory Sick Pay (SSP). An individual who has been identified as a contact by an internal contact tracing system but is not defined as a contact by the NHS Test and Trace service, does not qualify for SSP. If an employer decides to keep the employee away from the workplace, the employer should where possible arrange for the member of staff to continue to work from home. If working from home is not possible the employer may have to keep them on full pay, unless their contract of employment provides otherwise. If an individual is contacted by NHS Test and Trace as well, they will be eligible for SSP (if they meet the other eligibility criteria) from the day that NHS Test and Trace has told them to self-isolate.
If employers choose to take precautionary measures by keeping an asymptomatic member of staff away from the workplace, the employer is strongly advised to ensure they are providing them with the correct public health advice. This includes advising the individual to request a test if they become symptomatic. Until they are contacted by NHS Test and Trace, they do not have to self-isolate. Instead, they should:
- avoid contact with people at high increased risk of severe illness from coronavirus, such as people with pre-existing medical conditions
- take extra care in practising social distancing and good hygiene
- watch out for symptoms and self-isolate if they also show signs of coronavirus
Employers should not attempt to trace any contacts beyond the workplace but should refer these cases to the local HPT.
Communicating results to staff
Communicating results to the person who had a test
It is a legal obligation for employers and third-party healthcare providers to directly share all results from a member of staff’s virus and antibody tests with them, should they ask to see them. A worker must inform their employer that they have a duty to self-isolate if they have been contacted by Test and Trace, a person employed or engaged for the purposes of health service, or a local authority, and are due to take part in any work-related activities outside of the place where they are isolating during the isolation period. (Workers can decide that their results are shared with employers either before or at the same time as the worker receives them.) What will happen to the workers’ results, who they will be shared with, why, and when, should be clear to the staff member before they take the test.
It is highly advised that when the result is communicated to the individual, it is accompanied with clear information on what the results means in non-technical language, along with what actions they should take. A healthcare professional is expected to communicate the results, but in the absence of a healthcare professional a person owing a similar duty of confidentiality to the employee may communicate test results (for example, someone who works in occupational health or HR who has signed confidentiality clauses over and above the employer’s standard wording, and has received additional training on the handling of sensitive health data).
If results are being communicated via text message or app, it is strongly encouraged for a healthcare professional (or a person owing a similar duty of confidentiality) to be accessible to members of staff to discuss the results.
Communicating a positive virus test case to the workforce
Employers are encouraged to keep staff informed about potential or confirmed COVID-19 cases amongst their colleagues. However, they should not name individuals, and should not unlawfully share anyone's personal data (including anyone's test results).
The ICO is clear that data protection law does not prevent an employer ensuring the health and safety of their staff. It should not to be viewed as a barrier to sharing data with authorities for public health purposes when necessary and proportionate, such as working with the NHS Test and Trace service. More information is provided by the ICO's FAQs.
What an employer can and cannot do with a result
What an employer can do with the results
Employers can use virus test results to understand who in their workforce currently has COVID-19, and who is legally required to isolate following a positive COVID-19 virus test. Employers can also use antibody test results to understand the percentage of their workforce that has already potentially had COVID-19.
They can use antibody test results to understand the percentage of their workforce that has already potentially had COVID-19.
What an employer cannot do with the test results
An employer must ensure that any lists of members of staff made from collecting their sensitive health data, including their test results, do not result in any unfair or harmful treatment of workers.
It would also not be fair to use, or retain, information for purposes staff members were not told about or would not reasonably expect.
If a member of staff receives a positive antibody test result, employers cannot assure them that they are immune, or allocate to them any form of immunity certification, for example an ‘immunity passport’.
Employers should not treat staff who have had a positive antibody test any differently from staff who do not.
Please be aware that employers must not knowingly allow a person who has been told to self-isolate to work anywhere other than where they are self-isolating. Employers found to be in breach of this requirement will be issued with a Fixed Penalty Notice (starting at £1,000).
This guidance does not supersede any legal obligations relating to employment, equalities and data protection nor does it provide any advice on the steps that might be required in order to meet those, or any other, legal obligations to which you as an employer might be subject when undertaking any activity that falls within the scope of this guidance. Accordingly, it is important that as a business or an employer you continue to comply with your existing obligations and take independent legal advice if in any doubt about what those obligations are and how they might apply to you.
The current NHS antibody testing service is targeted at NHS patients and staff, and social care staff and residents, and is not accessible by private employers.