Occupational Health Is Not Just a Clinic EMR with an Employer Login

A generic EMR knows one relationship: a patient and the clinician treating them. Occupational health has three. The worker is the patient. The employer is the account, pays for most of the services, and is owed a decision about fitness for duty. The insurance carrier or third-party administrator pays for injuries and is owed a claim.

Each of the three is entitled to a different slice of the same record, and the slices are defined by law rather than by preference. An employer may know that a driver passed a DOT physical. An employer may not know the blood pressure reading that nearly failed it. A carrier may know the body part and the work restrictions. A carrier may not read the note about the worker’s unrelated diabetes.

Most occupational health software is a clinic EMR with an employer portal bolted on and a hope that nobody clicks the wrong tab. HealthPlex Occupational Health is built the other way round: the three-party model is the data model, and the record each party sees is a projection enforced at the decision point, not a screen somebody remembered to hide.

Programs, not visits, are the organising unit

In a primary care chart, the visit is the unit of work. In occupational health, the program is. A worker exists in the platform because of a program that requires something of them: a DOT physical every two years, a random drug test this quarter, annual audiometry because of noise exposure, a respirator clearance before the job starts, an injury that has to be tracked to closure.

So the chart is organised by program, and each program carries its own rules:

• DOT and FMCSA physicals. The exam form follows the federal medical examiner’s report, the Medical Examiner’s Certificate is generated with the correct validity period, the examiner’s national registry number is on it, and the expiry is tracked so the employer sees who lapses in thirty days.
• Drug and alcohol testing. Chain of custody from collection to laboratory to Medical Review Officer, random pool selection with a documented algorithm, and notification to the employer’s Designated Employer Representative in the words the regulation permits.
• Surveillance programs. Audiometry with the standard threshold shift calculation against the worker’s own baseline, spirometry with the reference set the program requires, respirator clearance questionnaires.
• Injury care. First report, triage, the recordability decision, work status, and the workers’ compensation claim.
• Pre-placement. Post-offer examinations against the essential functions of the job, with reporting to the employer that stays within what disability law allows.

The program model does something a visit model cannot. It makes compliance a query. Which drivers at this site have a certificate expiring before the end of the quarter? Which workers in the hearing conservation program have not had this year’s test? Which random pool selections are still open? An employer dashboard is those queries rendered, and nothing else.

What each party gets

The policy decision point described in our privacy post evaluates every read against role, relationship to the record, program and consent. In occupational health, the relationship to the record is the interesting part.

The worker gets the full clinical record through the portal: results, certificates, restrictions, reminders, and the consent form that authorises release of specific results to the employer.

The employer gets a fitness decision and a compliance status. Fit, fit with restrictions, not fit. Compliant, due, overdue. For an injury, the work status and the restrictions in plain language. Never the diagnosis, never the result, never the note. The employer dashboard is generated from a projection of the chart that does not contain those fields, so a screen cannot leak what the data it was given does not hold.

The carrier gets the claim packet: claim number, date of injury, body part, the ICD codes the claim requires, the work status history, and bills priced on the state fee schedule rather than the clinic’s chargemaster. When maximum medical improvement is reached, the impairment rating goes to the carrier; the rest of the chart does not.

The same decision point handles the release-of-information cases that occupational health generates constantly: the worker who authorises their own physician to see the audiogram, the employer’s attorney requesting the injury file, the regulator inspecting the drug testing program. Each is a consent or a legal basis recorded in the registry and checked on the read.

An injury, followed to the end

Injury care is where occupational health software either works or quietly creates liability. One encounter produces three outputs with three audiences and three clocks.

The first report captures the worker, the supervisor, the date and time, the mechanism and the body part. Triage and examination follow, and here the clinician makes a distinction that determines everything downstream: was treatment beyond first aid? A bandage and a return to work is first aid. Sutures, prescription medication, restricted duty: those are medical treatment, and the case becomes recordable.

The recordability decision drives the employer’s OSHA 300 log. The platform counts days away and days restricted from the dated work status records, not from a field somebody updates by hand. The 300A annual summary is generated for the posting window, and the privacy case flag suppresses the worker’s name for the injury types the regulation lists.

Work status is the employer’s operational record. Restrictions are written as instructions a supervisor can act on: no lifting over ten kilograms, no ladder work, seated duty only. The status carries a start date and a review date, and expires unless it is renewed. The employer contact is notified on every change, and the diagnosis does not appear on the form.

The carrier claim is the financial record. The claim number and date of injury travel on every bill line. The bill is priced on the state’s workers’ compensation fee schedule, which the platform loads per state and per year, and the forms the carrier requires (first report, work status, treating notes) are attached from the chart automatically. Denials are tracked against the claim, not the patient, because a workers’ compensation denial is an argument with a carrier about a claim, not a question about the worker’s eligibility.

Follow-up visits update restrictions, and the employer sees the change the same day. At maximum medical improvement the case closes, the impairment rating is filed if the state requires one, and the OSHA log entry is finalised with the total day counts.

Billing three ways

A single occupational health clinic bills three different ways in one afternoon. The DOT physical is invoiced to the employer on a contracted price list. The injury visit is billed to the carrier on the state fee schedule. The worker’s incidental request for a flu shot is billed to their own insurance or paid at the desk.

The billing engine treats these as three payer lines on the same encounter rather than three encounters. The employer invoice aggregates a month of services by site and program, because that is how employer accounts payable departments read them. The carrier bill is one claim per injury per date of service. The personal charge follows the ordinary patient billing path. Configuration decides which line a service defaults to, and the front desk can override with a reason.

What to ask a vendor

Occupational health demos are convincing because the exam forms look right. The questions that separate a platform from a clinic EMR are about the record boundary:

• Show me the employer dashboard, then show me the query that generated it. Does the query touch the diagnosis column?
• A worker revokes consent for employer release. What does the employer see the next morning?
• The carrier’s attorney requests the injury file. What exactly leaves the system, and who logged it?
• Change a work status from restricted to full duty. Show me the OSHA 300 day count updating.

If the answers are “we trained the staff not to”, the platform has a policy. A policy is not an architecture.