If COVID-19 is a ‘biological agent’, as defined in the Control of Substances Hazardous to Human Health Regulations 2002 (COSHH), how can employers, particularly health care providers, ensure they comply with COSHH?


Jamas Hodivala

Jamas Hodivala

This Q&A focuses on the risks presented by Covid-19 to health care providers, such as those working in care homes and hospitals. The Health and Safety Executive website provides additional resources to assist compliance and the HSE’s detailed Approved Code of Practice for compliance with COSHH can be found here. This Q&A is only intended as a guide and does not replace legal advice tailored to individual circumstances.

The phrase “biological agent” is defined by reference to regulation 2 of the Control of Substances Hazardous to Human Health Regulations 2002 and includes any micro-organism which may cause infection. This is broad enough to include Covid-19. In addition, the HSE has provided some recent guidance on reporting COVID-19 cases under RIDDOR (see previous Lexis PSL Q&A here).

It can be safely assumed that Covid-19 is a “biological agent” for the purpose of COSHH.

To whom does the employer owe a duty?

The employer’s duties under COSHH extend to employees and any third parties who may also be affected by work carried out by the employer. Whereas the duty to his employees is absolute, the duty to third parties only extends so far as is reasonably practicable: regulation 3(1).

Limitations on the duty

By regulation 5(1)(c), the employer’s duties contained in regulations 6-13 do not extend to any risk to health caused by substances that are administered to a person in the course of his “medical treatment”. “Medical treatment” is any medical examination or treatment provided by a registered medical practitioner, or any other person suitably approved for the purpose of s.58 of the Medicines Act 1968, and includes treatment conducted for the purpose of research. Covid-19 vaccine trials would be an example of such an exclusion.

What are the employer’s duties?

  1. Risk assessment

Regulation 6 of COSHH requires employers to avoid carrying out work which is liable to expose any employee to Covid-19 unless a suitable and sufficient risk assessment has been conducted of the steps required to meet the employer’s obligations under COSHH. This risk assessment must be regularly reviewed, and immediately if there is any reason to believe it is no longer valid, there has been significant change in the work to which the risk assessment relates or the results of health monitoring show it to be necessary. Any risk assessment and advice on suitable prevention and control measures must be carried out by a competent person. It would be sensible to document the employer’s thought process in relation to seeking advice from a competent person.

The risk assessment shall include consideration of:

  • The hazardous properties of Covid-19;
  • The level, type and duration of any employee’s exposure to Covid-19;
  • The circumstances of the work undertaken by the health care worker;
  • Any additional circumstances that give rise to a high risk of exposure (e.g. non-availability of PPE);
  • The effect of any preventative and control measures that have been, or will be, taken;
  • The results of “health surveillance” (as to which, see further below);
  • The results of monitoring of exposure;
  • Any further information the employer requires in order to complete the risk assessment (e.g. limitations on cross-infection control measures as a result of limited availability of PPE).
  1. Duty to adequately control exposure to Covid-19

The employer’s duty to ensure the safety of employees under s.2 of the Health and Safety at Work, etc. Act 1974 requires the employer to take measures to prevent the risk of his employees’ exposure to Covid-19 (e.g. social distancing measures in the workplace and working from home where possible). Regulation 7 specifically requires the employer to design and use appropriate work processes (e.g. work rotation systems to minimise the time exposed to risks from Covid-19) and provide suitable work equipment appropriate to the activity and consistently with the risk assessment. This requires consideration of the eight principles of “good practice” for the control of exposure to harmful substances set out in Schedule 2A to the Regulations. In addition, regulation 7(6) requires the employer to specify appropriate decontamination and disinfection procedures, the safe collection, storage and disposal of contaminated waste, testing where possible for the detection of Covid-19 outside the strict confines of the primary confinement area, making effective vaccines available to employees where appropriate, introducing appropriate washing facilities and prohibiting eating, drinking, smoking and the appliance of cosmetics in areas where there is a risk of contamination.


Where adequate control of exposure cannot be achieved simply by the implementation of appropriate work processes, the employer is additionally required to provide “suitable” Personal Protective Equipment (“PPE”). The employer cannot charge for the provision of PPE.

PPE must comply with any applicable legal requirement. This will include compliance with manufacturing, importing and distribution requirements set out in the Personal Protective Equipment Regulations 2018 (for PPE first placed on the market after 21 April 2019).

Regulation 4(3) of the Personal Protective Equipment Regulations 1992 specifies that PPE will not be “suitable” unless:

  • it is appropriate for the risk or risks involved, the conditions at the place where exposure to the risk may occur, and the period for which it is worn;
  • it takes account of ergonomic requirements and the state of health of the person or persons who may wear it, and of the characteristics of the workstation of each such person;
  • it is capable of fitting the wearer correctly, if necessary, after adjustments within the range for which it is designed;
  • so far as is practicable, it is effective to prevent or adequately control the risk or risks involved without increasing overall risk;
  • it complies with any legal requirement which is applicable to that item of personal protective equipment.

Medical aprons are required to comply with: British Standard (BS) 3314:1982: Aprons for wet work.

Medical gowns are required to comply with: BS EN 13795-1 2019: Surgical clothing and drapes. Requirements and test methods; and BS EN ISO 22610: 2006/2018: Surgical drapes, gowns and clean air suits, used as medical devices, for patients, clinical staff and equipment. Test method to determine the resistance to wet bacterial penetration

The principles of “good practice” recognise that PPE is generally less effective and reliable than other control options because it has to be worn, fit properly, has to be properly stocked and checked, and may provide no protection if it fails.

Proper training must also be provided by the employer. This includes identifying the hazards and risks from Covid-19 and the use of control measures to minimise these risks to health.

On 24 April 2020, Public Health England issued revised guidance on the use of PPE in the health and social care industries during the Covid-19 pandemic (see section 5 of the revised guidance here and a general announcement here). The HSE has completed a rapid review of PPE to be used in the healthcare industry during the pandemic (click here).

In summary, the new guidance from PHE on the provision and use of PPE is:

  • Aprons and gloves remain subject to single patient use;
  • Certain respirators, fluid resistant masks, eye protection and disposable fluid-repellent coveralls or long-sleeved disposable fluid-repellent gowns can now be used throughout a single session in certain circumstances;
  • It is recognised that provision of healthcare is dynamic and in a single care episode more than one context may be encountered, PPE should be changed as appropriate;
  • While generally considered good practice, there is no evidence to show that discarding disposable respirators, facemasks or eye protection in between each patient reduces the risk of infection transmission to the health and social care worker or the patient. Frequent handling of this equipment to discard and replace it could theoretically increase risk of exposure in high demand environments, for example, by leading to increasing face touching during removal. The rationale for recommending sessional use in certain circumstances is therefore to reduce risk of inadvertent indirect transmission, as well as to facilitate delivery of efficient clinical care;
  • PPE should not be subject to continued use if damaged, soiled, compromised or uncomfortable. While the duration of a session is not specified, the duration of use of PPE items should not exceed manufacturer instructions. Appropriateness of single versus sessional use is dependent on the nature of the task or activity being undertaken and the local context;
  • Where staff consider there is a risk to themselves or the individuals they are caring for they should wear a fluid repellent surgical mask with or without eye protection, as determined by the individual staff member for the episode of care or single session;
  • Disposable aprons are subject to single use and must be disposed of immediately after completion of a procedure or task and after each patient contact. Hand hygiene should be practiced and extended to exposed forearms;
  • Disposable fluid repellent coveralls or long-sleeved gowns are for single use or for single session use in certain circumstances but should be discarded at the end of a session or earlier if damaged or soiled;
  • Disposable gloves must be worn when providing direct patient care and when exposure to blood and or other body fluids is anticipated or likely, including during equipment and environmental decontamination. Disposable gloves are subject to single use and must be disposed of immediately after completion of a procedure or task and after each patient contact, followed by hand hygiene. Double gloving is not necessary.

As at 26 April 2020, PHE has provided a table on its current guidance regarding the suitability of PPE as follows:

  • Table 1: Recommended PPE for healthcare workers by secondary clinical care clinical context
  • Table 2: Recommended PPE for primary, outpatient, community and social care
  • Table 3: Recommended PPE for ambulance, paramedics, transport pharmacists
  • Table 4: Additional considerations (any settings) for Covid-19

More general guidance on the suitability of PPE can be found in the HSE’s document INDG174: Personal Protective Equipment (“PPE”) at Work. More detailed guidance on suitable control measures is available on the HSE’s biosafety webpages.

  1. Maintenance, examination and testing of control measures

Regulation 9 place the employer under a duty to ensure any PPE (or other control measure identified in the risk assessment) is maintained in an efficient state, in efficient working order, in good repair and in a clean condition. This includes a requirement that PPE is properly stored, is checked at suitable intervals and is repaired or replaced before using if found to be defective.

  1. Monitoring of exposure in the workplace and health surveillance

Regulation 10 provides that where identified by the risk assessment, the employer must ensure that the exposure of employees to Covid-19 is suitably monitored. Records should be kept of these results and provide access to the employees of his personal monitoring records.

Regulation 11 requires that, where appropriate for the protection of his employees, an employer should ensure that employees who are liable to be exposed to Covid-19 should be under suitable health surveillance. Records must be kept of this surveillance and the employee must be allowed access to his personal health record.

  1. Information, instruction and training

An employer must provide his employees with sufficient information, instruction and training. This includes the nature of the risks, the significant findings of the risk assessment and the appropriate precautions that should be taken.

  1. Arrangements to deal with accidents, incidents and emergencies

By regulation 13, the employer must have appropriate first aid facilities and relevant safety drills which can be put into effect if necessary in the event of any accident, incident or emergency.


This Q&A was first published on Lexis®PSL