Inside the standard
This page is for the reader who wants to see the actual shape of the thing: the entities, a real record, and the rules that make a record valid. It summarises a specification that runs to full per-field tables, versioned code lists, worked JSON Schemas with passing and failing examples, and a reference validator, all readable and downloadable here ahead of the public repository.
The entities
| Entity | What it records |
|---|---|
| Organisation | The employer: Companies House number, SIC code for ONS-comparable sector, size band. Identity for organisations, never for people. |
| OrgUnit | Team or department, the unit results are aggregated to. |
| WorkerPseudonym | A person, pseudonymously: an opaque identifier plus banded demographics only. Names, emails and dates of birth are structurally forbidden everywhere. |
| AbsenceEpisode | One episode of sickness absence, with the ONS reason taxonomy and working-days-lost semantics, a fit-note flag, work-relatedness, and provenance. Optional SNOMED clinical-cause extension for those licensed to use it. |
| ReturnToWorkOutcome | What happened after: outcome type, adjustments drawn from the fit note's own categories, and sustained-return checkpoints. The entity with no official taxonomy anywhere: insurer and OH case systems track this in proprietary, non-harmonised ways. |
| OHEpisode | An occupational-health referral and its management-facing result: referral reason, assessment type, categorical fitness opinion. Diagnosis and clinical content cannot appear, by schema. |
| ReasonableAdjustment | An Equality Act adjustment: category, status, review date. One of the few things lawfully individual and employer-visible, and enumerated as such. |
| WellbeingObservation | One answer to one survey item from any vendor's product, with construct code, native and normalised values, and a sampling-design descriptor so consumers know whether gaps are planned or dropout. |
| InstrumentAdministration | A completed validated instrument, referenced by citation and version, never reproduced: scores, band per the instrument's published cut-points. |
| MeasurementContext | What makes scores comparable: producing system, scoring approach, window, known limitations. |
| BenefitEntitlement | What support a workforce has: statutory (SSP semantics) and commercial (the UK market's own product vocabulary), with access routes and health-domain tags shared with measurement. |
| BenefitUtilisation | Whether provision gets used: aggregate counts per service per period. Individual usage is never employer-visible. |
| AggregateReport | Employer-visible aggregate results: level, n, value with interval, completion rate, and suppression metadata recording what was withheld and why. |
| BenchmarkRelease | A published comparison set with composition disclosed: contributing organisations, sectors, size bands, sample sizes, validity window. |
| Crosswalk | Versioned mappings from every construct to the HSE Management Standards, ISO 45003, and the reserved namespace for the Workplace Health Intelligence Unit. |
| DisabilityParticipation reserved | The WHIU's third measure, held deliberately minimal until national definitions exist. |
| RiskAssessment / WorkplaceIncident reserved | Reserved shapes for psychosocial risk assessments and RIDDOR-adjacent incident records, not built in v0.1 or v0.2. |
Statutory health surveillance, sector screening and vendor-specific machinery live in named profiles that extend the core without touching it. The full catalogue, field tables and code lists are in the specification.
The entity map
The same model as a picture: how the seventeen entities relate, which flows aggregate, and where the reserved shapes sit. Drawn from the specification's data model.
Individual instrument results are never employer-visible. Only the expressly classified individual-employer fields may be disclosed at individual grain under the specification's independent-legal-basis condition. The diagram does not grant permission to disclose a record.
Solid lines are structural references. Dotted lines are the aggregation flow. Aggregate-only field values reach an employer through a report that satisfies the privacy profile. The expressly classified individual-employer fields have a separate, narrow disclosure condition; individual instrument results remain prohibited from employer-visible output. Dashed outlines are reserved names, listed since v0.1 and not yet built. Open the map on its own page.
A real record
This is a valid AbsenceEpisode, exactly as the schema accepts it:
{
"episodeId": "abs-2026-000123",
"pseudonymId": "owhs:pseudo:a1b2c3d4e5f60718", // keyed hash; no name, ever
"reasonCode": "musculoskeletal", // ONS reason taxonomy
"startDate": "2026-03-02",
"endDate": "2026-03-13",
"workingDaysLost": 9, // ONS 7.5-hour day unit
"fitNoteFlag": true,
"workRelatedFlag": false,
"sourceProvenance": { "sourceType": "hris" }
}
And this is what the reference validator says about the same record with a name added, a raw employee identifier as its pseudonym, a free-text reason and no provenance:
[additionalProperties] <root>: Additional properties are not allowed ('name' was unexpected) [required] <root>: 'sourceProvenance' is a required property [pattern] pseudonymId: 'EMP-Jane-Smith' does not match '^owhs:pseudo:[0-9a-f]{16,64}$' [enum] reasonCode: 'back-pain' is not one of ['minor-illness', 'musculoskeletal', 'other', 'mental-health', 'gastrointestinal', 'respiratory', 'eye-ear-nose-mouth-dental', 'genito-urinary', 'heart-blood-pressure-circulation', 'headaches-migraines', 'prefers-not-to-give-details']
That is the design in one demonstration: privacy violations are not policy breaches to be audited after the fact. They are invalid data.
The four visibility classes
| Class | Meaning |
|---|---|
| open | Structural metadata, never personal. May appear in any output. |
| aggregate-only | Employer-visible only through an AggregateReport clearing the floor: five people minimum, ten for severe-distress measures. |
| individual-never | Never leaves the producer at individual grain in any output, even to the employer. All instrument results. All safeguarding-category signals, at any group size. |
| individual-employer | The narrow, exhaustively enumerated exception: things an employer lawfully holds about an identified pseudonym under an independent legal basis, such as a released fitness opinion or an Equality Act adjustment. Never clinical content. |
Three conformance levels
Level 1, schema-valid: the structures hold, the identifier ban passes, the cross-field rules fire. Level 2, current code lists: every coded value resolves against the versioned registries, and dates make sense. Level 3, privacy profile: the aggregation floors, visibility classes and safeguarding exclusions are enforced, and a producer that cannot clear a floor refuses to emit the value rather than hiding it. A producer declares the highest level it meets; a consumer states the minimum it accepts.
Read the whole thing
The full specification, schemas, examples, code lists and the honesty pass (our own list of the decisions most worth disputing) are published here, with an open change process at github.com/openworkplacehealth/OWHS. Two of the specification's siblings are already live on this site: the instrument registry and the question bank. The Measurement Companion (construct definitions, the framework crosswalk, comparability rules) is available on request from hello@openworkplacehealth.org.