Staff wellbeing is a safety system, not a perk

Correctional officers work inside an environment engineered for containment, then go home to families. Research highlighted by the US National Institute of Justice found 27% of correctional officers reporting PTSD symptoms; studies of jail officers have screened positive at over half. Organisational hazards — understaffing, overtime, rotating shifts, threat exposure, low control, poor support, work–family conflict — are not personal failings. They are design decisions.

Three systems that must share outcomes, not answers

Workforce safety fails when it is built as one database. It works when three systems share outcomes and nothing else:

• Roster and HR hold hours, shifts, skills, posts, leave and fitness restrictions. They never hold a diagnosis or a stress score.
• Occupational health holds questionnaires, clinical history and consultations. It returns exactly four values to management: fit, fit with restriction, temporarily unfit, review date.
• 360° feedback holds observed behaviours by rater group, strengths and development plans. It carries no mental-health inference and never feeds discipline.

What we measure, and with what

Screening is voluntary, confidential and completed on the officer's own device or in private. The instruments are standard and validated rather than invented: PSS-10 for perceived stress, GAD-7 for anxiety, PHQ-9 for depression, WHO-5 for wellbeing, MBI-HSS for burnout across emotional exhaustion, depersonalisation and personal accomplishment, PC-PTSD-5 stepping to PCL-5 for trauma, ISI for insomnia in shift work, AUDIT-C for alcohol use, and CD-RISC-10 for resilience.

Cut-offs come from the literature, not from a product manager. Elevated screens produce an offer of clinician follow-up — not a flag on a roster.

The rule that makes it credible

Aggregates render only above a confidentiality threshold — n ≥ 8 in our default configuration — and smaller teams roll up to facility level. Cohorts below threshold are discarded unread, because partial data would deanonymise the people who answered. A manager's request for individual answers is denied by the access policy, and the denial itself is written to the audit log.

Would you assign this officer to the high-security escort? 74 hours worked in seven days, 13 exposure points, two quick returns. The answer is to ask privately and build relief — not to assign as planned, and never to let an algorithm decide fitness.

Aggregate signals point at rosters, not people

In our reference deployment the unit stress index tracks the overtime curve with roughly a three-week lag. That is the whole argument: the lever is staffing, rotation and post design. When a high-security wing crosses threshold two cycles running, the output is a rotation proposal with no names attached — and a wellbeing command that can act on it.