Occupational Health Software Problems: The 7 That Cost Real Money, and How to Avoid Them

Why does the protocol engine get scoped as a template feature?

This is the scope failure that defines the category. Someone reads the requirement as configurable visit templates, prices it accordingly, and delivers a system where a protocol is a document attached to an employer. Six months later the front desk is back to a binder, because a document cannot decide anything.

This is specific to occupational health because your protocols are not clinical pathways, they are contract terms. A regional manufacturer with eleven plants and forty job classes has forty service lists, each negotiated, each changeable by their safety director on a Tuesday, each binding on you from a date. Primary care has nothing equivalent, which is why general electronic health records treat employer as free text and why appointment types named after clients accumulate until nobody can read the schedule.

The fix is to model the protocol as a versioned record with an effective date, and to resolve every visit against the version in force on the date of service. Employer, location, department, job class, protocol version, service, rate. When the safety director adds the freezer role, they add it in a portal, you both see the date it takes effect, and every check in for that job class after that date builds the correct service list without anyone deciding. Ask any prospective developer what happens when a protocol changes mid year. If the answer is that you update the template, the re-dos will continue and you will also lose the ability to prove what was owed on a past date.

What goes wrong when you migrate history out of SYSTOC or Agility?

Migration is consistently the most underestimated line in this category, and the damage is not evenly distributed. Some records matter far more than others.

• Audiometric baselines. These are the highest risk records you hold. A baseline is the reference point for every future standard threshold shift calculation, and if it migrates without its test date, its ear specificity or its revision history, your surveillance programme has no defensible foundation. Losing a baseline is not a data quality issue, it is a compliance issue.
• Certificate history. Commercial driver certification dates drive the compliance clock. If expiry dates arrive without the exam date and examiner that produced them, the audit trail is broken even though the calendar looks correct.
• External events. A large share of your surveillance facts did not happen at your clinic. Baselines from a prior employer, a respirator clearance done by a mobile vendor, a titer faxed in. Systems that only migrate their own encounters silently drop these, and the clock restarts on people it should not.
• Employer contract history. Rates change at renewal. If only the current rate card migrates, you cannot reprice or defend a historical invoice, and any billing dispute becomes a negotiation instead of a lookup.
• Restriction and clearance decisions. These are legal determinations. Migrating them as note text rather than as structured decisions means you cannot report on them or produce them cleanly when asked.

Get written confirmation of the export format and cadence from your current vendor before the project starts. Plan three to six weeks and insist on at least one full dry run against production data, with your medical director checking a sample of audiometric baselines personally.

Why do lab and drug screen interfaces break after go live?

Interfaces do not fail loudly. They fail on the small share of messages that do not match, and that share is somebody's expired card.

The recurring causes are consistent. A result arrives for a patient whose identifiers do not match your record, because the employer submitted a roster with a nickname and the collection site keyed a legal name. A collection site is added to an employer's programme and its results route to nobody. A medical review officer outcome arrives on a different channel and timeline from the laboratory result, so the visit sits incomplete while the clock runs. A reference laboratory changes a code and the mapping quietly stops resolving, producing results that land as unmatched rather than as errors.

Design the error queue before the interface. Every unmatched result needs a visible owner, an age, and an escalation, because an unmatched result is a person whose clearance is not recorded and whose employer believes they are cleared. Ask a prospective developer who owned the error queue after go live on a named interface they built. If they have not thought about it, they have built a happy path.

The other structural fix is to treat any inbound fact as a first class event regardless of source: your exam, an uploaded document, a laboratory result feed, a screening vendor callback. Document extraction earns its line item here, pulling thresholds and expiry dates from inbound paper and posting them as events with a confidence score, with anything below threshold routed to human review rather than left in a shared drive.

What happens when ADA record segregation and DOT reporting are not covered?

Two gaps in this vertical carry consequences that are not merely operational.

The first is the wall between medical information and the employer. Under the Americans with Disabilities Act, employee medical records must be kept separate from personnel records, and the employer is entitled to the fitness determination and the restrictions, not the diagnosis. A general electronic health record has a share the chart function, and that function does not make the distinction. This has to be enforced at field level in the routing logic: the employer contact receives fitness and restrictions, the clinical detail stays inside. Bolting a portal onto a system that was not designed for this produces an exposure, not a feature.

The second is commercial driver work. Certified examiner workflow, the examination report and certificate forms, and reporting to the national registry on the required timeline are not places to improvise, and the audit trail matters as much as the submission. Get it right and certificate expiry becomes an event in the same clock that drives your recall list and your revenue forecast.

The related gap is restrictions themselves. If a physician writes them as free text in a note, you cannot route them, report on them or pre populate a state form from them. Model them as structured data: body part, activity, limit, duration, effective dates, review date. Then the employer summary, the state form and the case follow up all fire from the same signed decision, and a case that would have become lost time gets a light duty offer the same afternoon.

Should you build custom or configure what you already own?

Plenty of providers should not build, and we say so. If you run one or two sites with under roughly fifteen employer contracts and a mix of commercial driver physicals, drug screens and minor injury care, Net Health Agility or SYSTOC will hold that comfortably. Your protocols fit in a binder because there are twenty of them, and a build is a distraction from hiring another provider. The same answer applies if your plan is to be acquired within about eighteen months, because the acquirer will migrate you onto their stack regardless.

Before commissioning anything, look hard at what you already own. Agility and SYSTOC do model the employer, and a lot of pain at mid sized providers comes from a configuration that was never finished: rate cards never loaded, recall logic never switched on, reports never built past the defaults. Enterprise Health handles surveillance capably. If the surveillance module is sitting unused next to a spreadsheet, a configuration engagement costs a fraction of a build.

Build when the signals cluster, and they usually arrive together. Three or more sites with protocols that differ by client rather than by service. A named person whose actual job is maintaining the surveillance spreadsheet. A prospect that asked for an employer portal and chose someone else. Contract revenue past roughly forty percent of the top line. The settling tell is when your best clients ask for reporting you cannot produce without a week of manual work, because the thing they are asking you to customise is precisely the thing a vendor cannot let you customise.

How do hidden costs get into the quote?

• Interfaces priced per project rather than per interface. Each laboratory result feed, screening vendor callback and collection site flow is separate work with its own testing and its own error queue.
• Multi state workers compensation. One state's forms and fee schedule is a feature. Six states is a subsystem, and it needs an owner after go live because fee schedules change.
• Migration dry runs. Budgets often include one extraction. In practice you want a dry run, a review by your medical director, corrections, and a second run before cutover.
• Security posture. Health information handling is table stakes. If you are chasing national accounts they will ask for a formal security attestation, which changes your architecture and your timeline, so decide before design rather than during sales.
• The error queue owner. After go live, somebody has to work unmatched results and low confidence extractions daily. Costing the software without costing that role is how the queue silently grows.

What separates a build that works from one that fails here?

Make them draw the data model on the call. Ask for the entities and relationships across employer, location, job class, protocol version, service, rate card and clearance decision. If the first shape drawn is patient centric, you will get an urgent care record system with an employer field, and you will discover it in month five.

Ask what happens when a protocol changes mid year. Effective dated versions with visits resolving against the version in force on the date of service is the answer that separates people who have shipped this from people who have read about it.

Ask for a named interface they have built and who owned its error queue after launch. Ask how they enforce the separation between clinical detail and employer facing determinations at field level. Ask how a charge line is created, because tying every charge to the executed protocol version at the rate in force on the date of service, with a nightly reconciliation flagging documented services with no charge, is what closes the billing leak that funds the build.

Finally, get ownership in writing before kickoff: the source code, the repositories, the infrastructure and the data. At Digital Heroes the client owns all of it from the first commit. For a system sitting directly on top of your employer contracts, hesitation on that point is the whole answer.