Inside the standard
This page is for the reader who wants to see the actual shape of the thing: the entities, a real record, and the rules that make a record valid. It summarises a specification that runs to full per-field tables, versioned code lists, worked JSON Schemas with passing and failing examples, and a reference validator, all available on request ahead of public release.
The entities
| Entity | What it records |
|---|---|
| Organisation | The employer: Companies House number, SIC code for ONS-comparable sector, size band. Identity for organisations, never for people. |
| OrgUnit | Team or department, the unit results are aggregated to. |
| WorkerPseudonym | A person, pseudonymously: an opaque identifier plus banded demographics only. Names, emails and dates of birth are structurally forbidden everywhere. |
| AbsenceEpisode | One episode of sickness absence, with the ONS reason taxonomy and working-days-lost semantics, a fit-note flag, work-relatedness, and provenance. Optional SNOMED clinical-cause extension for those licensed to use it. |
| ReturnToWorkOutcome | What happened after: outcome type, adjustments drawn from the fit note's own categories, and sustained-return checkpoints. The entity with no incumbent anywhere. |
| OHEpisode | An occupational-health referral and its management-facing result: referral reason, assessment type, categorical fitness opinion. Diagnosis and clinical content cannot appear, by schema. |
| ReasonableAdjustment | An Equality Act adjustment: category, status, review date. One of the few things lawfully individual and employer-visible, and enumerated as such. |
| WellbeingObservation | One answer to one survey item from any vendor's product, with construct code, native and normalised values, and a sampling-design descriptor so consumers know whether gaps are planned or dropout. |
| InstrumentAdministration | A completed validated instrument, referenced by citation and version, never reproduced: scores, band per the instrument's published cut-points. |
| MeasurementContext | What makes scores comparable: producing system, scoring approach, window, known limitations. |
| BenefitEntitlement | What support a workforce has: statutory (SSP semantics) and commercial (the UK market's own product vocabulary), with access routes and health-domain tags shared with measurement. |
| BenefitUtilisation | Whether provision gets used: aggregate counts per service per period. Individual usage is never employer-visible. |
| AggregateReport | The only way results leave an organisation: level, n, value with interval, completion rate, and suppression metadata recording what was withheld and why. |
| BenchmarkRelease | A published comparison set with composition disclosed: contributing organisations, sectors, size bands, sample sizes, validity window. |
| Crosswalk | Versioned mappings from every construct to the HSE Management Standards, ISO 45003, and the reserved namespace for the Workplace Health Intelligence Unit. |
| DisabilityParticipation reserved | The WHIU's third measure, held deliberately minimal until national definitions exist. |
| RiskAssessment / WorkplaceIncident reserved | Reserved shapes for psychosocial risk assessments and RIDDOR-adjacent incident records, not built in v0.1. |
Statutory health surveillance, sector screening and vendor-specific machinery live in named profiles that extend the core without touching it. The full catalogue, field tables and code lists are in the specification.
A real record
This is a valid AbsenceEpisode, exactly as the schema accepts it:
{
"episodeId": "abs-2026-000123",
"pseudonymId": "owhs:pseudo:a1b2c3d4e5f60718", // keyed hash; no name, ever
"reasonCode": "musculoskeletal", // ONS reason taxonomy
"startDate": "2026-03-02",
"endDate": "2026-03-13",
"workingDaysLost": 9, // ONS 7.5-hour day unit
"fitNoteProvided": true,
"workRelated": false,
"sourceProvenance": { "sourceType": "hris" }
}
And this is what the reference validator says if you try to sneak a name into the same record:
[additionalProperties] Additional properties are not allowed ('name' was unexpected) [not] P1: forbid direct identifiers anywhere [pattern] pseudonymId: 'EMP-Jane-Smith' does not match '^owhs:pseudo:[0-9a-f]{16,64}$'
That is the design in one demonstration: privacy violations are not policy breaches to be audited after the fact. They are invalid data.
The four visibility classes
| Class | Meaning |
|---|---|
| open | Structural metadata, never personal. May appear in any output. |
| aggregate-only | Employer-visible only through an AggregateReport clearing the floor: five people minimum, ten for severe-distress measures. |
| individual-never | Never leaves the producer at individual grain in any output, even to the employer. All instrument results. All safeguarding-category signals, at any group size. |
| individual-employer | The narrow, exhaustively enumerated exception: things an employer lawfully holds about an identified pseudonym under an independent legal basis, such as a released fitness opinion or an Equality Act adjustment. Never clinical content. |
Three conformance levels
Level 1, schema-valid: the structures hold, the identifier ban passes, the cross-field rules fire. Level 2, current code lists: every coded value resolves against the versioned registries, and dates make sense. Level 3, privacy profile: the aggregation floors, visibility classes and safeguarding exclusions are enforced, and a producer that cannot clear a floor refuses to emit the value rather than hiding it. A producer declares the highest level it meets; a consumer states the minimum it accepts.
Read the whole thing
The full specification, schemas, examples, code lists and the honesty pass (our own list of the decisions most worth disputing) are available now on request, and move to a public repository with an open change process at release.