Safety incidents

A safety incident is one record of one occurrence: what kind of thing it was (injury, near-miss, property damage, environmental, occupational illness, fire), how bad, when and where, who was involved, and what is being done about it. Each report that is filed gets a reference — HSE-… — and the register is the list of those references.

A near-miss is a first-class entry, not a lesser one. The report where nobody was hurt is the cheapest safety information the company will ever get, which is why staff can file one from the portal in under a minute and why filing one is never held against anyone.

This register records occurrences; it does not judge conduct. If what happened points at somebody's behaviour, the case escalates to an investigation, which carries signed statements and approval routing. The incident and the investigation then link to each other.

HR (anyone with safety.manage) files from Safety incidents → New incident. A new report starts as a draft: everything is editable, nothing has a reference yet, and a draft filed by mistake can simply be deleted. Fill in the kind, severity, when and where (site, and free-text detail — deck 3, the loading jetty, the staff kitchen), what happened, and what was done immediately.

The staff member on the header is optional, deliberately: a fuel spill or a kitchen fire may involve nobody in particular, while a fall involves one person centrally. Everyone touched by the incident — injured, involved, witnesses, the first aider — goes on the people list, whether or not they are on the header.

When the draft is right, Report it. That allocates the HSE reference, stamps who reported and when, locks the facts, and notifies every safety.manage holder. Reports staff file from the portal skip the draft entirely and land already reported — see what staff see.

Draft → Reported → Investigating → Closed, with Withdrawn for the report filed in error.

• Reported locks the facts — what happened is what was reported. People, corrective actions and files can still be added; the narrative cannot be rewritten.
• Start investigating opens the findings half: root cause, preventive measures, and a severity re-grade if first impressions were wrong.
• Close requires an outcome — the sentence or two that says how it ended. Closing warns about open corrective actions but does not wait for them: the actions outlive the closure and the overdue chase keeps running.
• Withdraw keeps the reference. A withdrawn report stays on the register as withdrawn — the trail shows it existed, and the number is never reused.
• Reopen takes a closed case back to investigating when something new surfaces.

Every transition is a single button on the incident page, offered only when it applies, and every one is audit-logged.

One incident carries many people, each with a role: injured, involved, witness, first aider. A person is usually picked from the staff register, but a name typed free-hand works too — a contractor or a guest has no staff record and still belongs on the list.

Injury detail is health data. What the injury was, the body part, the treatment given — these render only for users holding the sensitive: medical claim, the same claim that guards medical examination paperwork. Anyone with safety access can record an injury when adding a person (the first aider writes what they saw); rewriting one later needs the claim.

Lost time is not health data. "Off work from the 12th, back on the 19th" is an absence fact, visible like leave is, and the days are always counted from the two dates — nothing stores a number that could drift. The register's days since last lost-time injury derives from these rows.

A corrective action is a thing somebody must do — replace the guard rail, re-brief the night shift, service the hoist — with an owner and a due date. Its status is never set by hand: an action is done when a completion date is recorded, overdue when its due date has passed, and open otherwise.

Overdue actions are chased nightly: every safety.manage holder gets one digest notification, coalesced so a chronically late action does not become a daily drumbeat of separate alerts. Completing an action is allowed at any status — including after the incident closes, which is exactly when most of them are finished.

Where an incident must be reported to a regulator, tick reportable to the authority and record when it was reported and under what reference. HumanR keeps the fact and the reference; it does not file jurisdiction-specific forms — the authority's own paperwork, scanned, belongs in the incident's files.

While a case is investigating, a user who also manages investigations can escalate it. That creates a draft in the investigation module pre-filled from the incident — the who, when, where and what-happened carry over — and links the two records.

Escalate when the case needs what the investigation module has and this register deliberately does not: signed witness statements, approval routing, fines and disciplinary consequences. The incident stays open on this register with its corrective actions; the conduct question travels.

Staff with portal access get a Safety tab: a report form and a list of their own reports. The form asks what happened, roughly how bad, when and where, and whether they were hurt — their best guess on severity is enough, the safety team re-grades it. Filing is atomic: the report lands already Reported, with its reference allocated and the safety team notified, so nothing a crew member files can sit unseen in a draft.

A person sees their own report in full and their own injury row in full. On any incident they appear in, other people are a name and a role only — never injuries. Findings, files and the closing outcome never render in the portal; what became of a report is its status badge.

• safety.view — see the register, incident pages, files and the CSV.
• safety.manage — file, edit, run every transition, and manage people, actions and files. These users also receive the new-report and overdue-action notifications.
• sensitive: cases — read the narratives (what happened, root cause, preventive measures, outcome). Without it the register itself — kind, severity, when, where, status — is still visible and useful.
• sensitive: medical — read and rewrite injury detail on person rows.
• Drafts never have a reference and only drafts can be deleted; everything after Reported is permanent, including withdrawn reports.
• Incident files (scene photos, the authority's letter) are register material gated on safety.view — unlike investigation evidence, which has its own stricter rules.
• The whole module is dark until Features:EnableSafety is turned on for the instance; turning it on shows the module, and granting the permissions opens it.