On August 20th, the Alberta Office of the Information and Privacy Commissioner dismissed a complaint in which an employee alleged an invasion of privacy because his employer reported his medical restrictions to the Alberta Infrastructure and Transportation’s Driver Fitness and Monitoring Branch.
The employee, who was required to drive as part of his job, submitted a letter from his psychologist in support of a leave request. The letter indicated he was unsafe to drive and included detailed information about his mental condition. The employer granted the leave and asked the psychologist whether he had reported the employee’s restriction to the province. When the doctor declined to answer the employer’s request for information, the employer reported the restriction itself and included a copy of the psychologist’s letter. The province ended up placing several monitoring conditions on the employee’s license.
In deciding that the report complied with both the Alberta Personal Information Protection Act and the Alberta Freedom of Information and Protection of Privacy Act, the IPC made several findings of technical significance. For example, it read the exception in section 20(c) of PIPA broadly in finding the employer’s non-consensual disclosure was permissible. Of broader significance, however, are the IPC’s obiter comments on the employer’s collection of diagnostic information. While implying that diagnostic information may sometimes be needed by an employer or insurer to support decision-making, it endorsed the use of medical advisers as playing a role in protecting employee privacy:
Diagnostic information should only be provided directly to the employer’s group insurer who is responsible for evaluating an employee’s eligibility for any benefits where applicable. An exception to this practice would be organizations with in-house health units staffed by qualified medical practitioners, who may reasonably receive this information provided it is kept in strict confidence. These units manage workplace injuries, accidents and safety which are governed by workers’ compensation and occupational health and safety requirements. In such cases, collection of diagnostic information by an employer may be reasonable.
It is true that employer medical advisers play an important role in employee privacy. By taking custody of medical information on behalf of employers, they are the means by which employers ensure proper, limited use of the information. For more about an adviser’s role and some thoughts on reconciling this role with the adviser’s contractual duty to the employer, see my earlier post, Medical information management for employers.