Medical information management for employers

I gained a penchant for diagrams during my foray into the business world that I make no apologies for!

I’d like to build this post around the diagram below, which illustrates a very common model by which employers manage medical information – i.e., one in which the employer seeks information from an employee’s treating physician through its own medical adviser. 


The point I’d like to make is that role definition is key to effective medical information management.  When there is confusion about the players’ roles and responsibilities (especially vis-a-vis confidential medical information) the management process tends to break down.

Relationship “A” is the employment relationship.  In most cases employers cannot obtain employee medical information without express written consent, but employees have a duty to consent to the release of medical information when it is reasonably necessary to the administration of the employment relationship.  Employers typically need medical information for four purposes:  (1) to determine the validity of an absence, (2) to determine eligibility for an income protection benefit, (3) to develop accommodation plans and proposals and (4) to ensure that employees can safely return to work.

In Ontario, section 49 of the Personal Health Information Protection Act requires employers to use and disclose medical information for only those purposes specified in the written medical release (ordinarily, the four noted above) and, essentially, share information internally on a need to know basis.

Relationship “B” is the treatment relationship.  An employee’s treating physician has a professional and legal duty to act in the employee’s best interests.  This does not mean that a physician must let a patient dictate his or her opinion.  To the contrary, abdicating professional judgment in this manner is a breach of a physician’s duty.  In this regard, the Ontario Medical Association has helped physicians reconcile employee and employer interests by advising them of the health-related benefits of a safe and early return to work.

Treating physicians also have a professional and legal duty to maintain patient confidentiality.  They are subject to the full range of “health information custodian” rules in PHIPA, and may only release medical information to employers based on written consent.

Relationship “C” is either an employment or contractual relationship.  Employers often retain the services of medical professionals to act on their behalf.  These professionals typically (1) take custody of medical information received pursuant to a release and share it with management as permitted by the medical release and on a need to know basis, (2) evaluate and make objective recommendations to the employer about the sufficiency of information provided and (where it is sufficient) about eligibility for paid or unpaid leave, accommodation plans and return-to-work and (3) act as the employer’s liaison (and advocate) with the treating physician.

The medical adviser does not have independent legal or professional duties to the employee.  He or she acts as the employer and shares the employer’s section 49 duty.  Does he or she nonetheless play an important role in medical confidentiality?  Yes.  The medical adviser role helps create a confidentiality screen.  By taking immediate custody of the medical information on behalf of the employer, he or she is the means by which the “need to know” rule is given effect.  This is a difficult role, and sometimes out of a sense that he or she has an independent duty of confidentiality to the employee, the medical adviser takes a position at odds with the employer.  This type of conflict can generally be avoided by establishing reasonable and PHIPA-compliant policy to guide the internal distribution of medical information received pursuant to a medical release.

The advisory model described above is common, but there are other models by which employers seek and obtain medical information they need to make employment-related decisions.  In the Ontario Bar Association’s latest Eye on Privacy, I wrote an article called, “Understanding Church and State – The Occupational Health and Safety Department and PHIPA” I elaborated on Relationship “C” and briefly discussed how the legal duties change when an employer actually provides health care to its employees.  I missed an opportunity to draw diagrams in that article, but if you’re interested in this topic you may nonetheless find them helpful.

Leave a Reply

Please log in using one of these methods to post your comment: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.