You must keep a simple record (a 'health record') of any health surveillance carried out. COSHH requires you to keep health records for at least 40 years. (If a business ceases to trade, its health records should be offered to HSE for safe keeping.)