Privacy Reports

INVESTIGATION REPORT

 

 

INVESTIGATION I93-052P

 

 

MINISTRY OF HEALTH

INTRODUCTION

 

 

Background of the Complaint

 

This investigation was initiated as a result of a complaint concerning one of the Ministry of Health's psychiatric hospitals (the Hospital).

 

The complainant, an employee of the Hospital, had been required to provide a medical certificate to the Hospital after being absent from work for one day.  The medical certificate was then disclosed to the Hospital's Assistant Administrator, Patient Services (the Assistant Administrator); Regional Human Resources Administrator (the HR Administrator); and one of the Ministry's legal counsels (the Legal Counsel).

 

The complainant stated that the disclosure of her personal information in the medical certificate to these individuals was contrary to the Freedom of Information and Protection of Privacy Act (the Act).

 

Issues Arising from the Investigation

 

The following issues were identified as arising from the investigation:

 

(A)       Was the information in question "personal information", as defined in section 2(1) of the Act? If yes,

 

(B)       Were the disclosures of the personal information to the Assistant Administrator, the HR Administrator, and the Legal Counsel, in accordance with section 42 of the Act?

 

 

RESULTS OF THE INVESTIGATION

 

Issue A:          Was the information in question "personal information", as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part:

 

"personal information" means recorded information about an identifiable individual, including,

 

(h)        the individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

 

 

The complainant provided a copy of the medical certificate in question.  It contained the complainant's name, the name and address of her physician, the date she had been absent from work, and the fact that she had been absent from work for a "medical reason".

It is our view that the information contained in the medical certificate met the requirements in paragraph (h) of the definition of personal information in section 2(1) of the Act.

 

            Conclusion:    The information in question was "personal information" as defined in section 2(1) of the Act.

 

 

Issue B:           Were the disclosures of the personal information to the Assistant Administrator, the HR Administrator, and the Legal Counsel, in accordance with section 42 of the Act?

 

In support of her complaint, the complainant provided a policy dated 91/10/31 from the Hospital's Policy and Procedure Manual (the Policy).  The subject of the Policy was "Confidentiality of Employee Health Records".  The Purpose of the Policy was to safeguard the privacy of all employees of the Hospital, and to ensure that all individuals using Employee Health Services were protected from unauthorized or inappropriate disclosure of occupational health information.

 

Point 3.3 of the Policy states:

 

Information released to management shall be limited to the worker's fitness/unfitness to work, or restrictions on the worker's ability to perform all aspects of the job (Appendix 2).  When an employee is absent from work due to injury or illness, the original copy of a doctor's certificate should be submitted to Employee Health Services.  The information regarding the probable date of return and the prognosis will be relayed to the supervisor or manager concerned on a need-to-know basis only.  No diagnosis or details of treatment are to be disclosed to management.

 

The complainant stated that she had provided the medical certificate to her supervisor, upon request by the Assistant Administrator.  When it was received, it was reviewed by the Assistant Administrator and the HR Administrator and discussed with Legal Counsel.  The complainant submitted that, based upon the Hospital's Policy, the actual medical certificate should not have been disclosed by her supervisor to these individuals but should have gone directly to Employee Health Services where any relevant information would have been relayed to management on a need to know basis.

 

Under the Act, personal information in the custody or control of an institution cannot be disclosed except in the specific circumstances outlined in section 42.

 

 

 

With regard to the disclosure of the personal information in the medical certificate, the Ministry has relied upon section 42(d) of the Act, stating that the medical certificate was disclosed to the Assistant Administrator, the HR Administrator, and the Legal Counsel for justifiable, organizational reasons. 

 

Section 42(d) of the Act states:

 

An institution shall not disclose personal information in its custody or under its control except,

 

(d)       where disclosure is made to an officer or employee of the institution who needs the record in the performance of his or her duties and where disclosure is necessary and proper in the discharge of the institution's functions;

 

In our view, verifying an employee's absence from work by requesting an employee's medical certificate is an administrative function of the Hospital.

 

The Assistant Administrator is the Chief Nursing Officer responsible for the entire administrative operation of the Patient Services Department.  The HR Administrator is responsible for assisting the Assistant Administrator in ensuring that policies and procedures are interpreted correctly and uniformly across the Department and Hospital.  In the circumstances of this case, the Assistant Administrator and the HR Administrator were involved in a legal matter between a group of employees, including the complainant, and the Hospital.  The legal matter arose from an order made under the Occupational Health and Safety Act regarding minimum staffing requirements at the Hospital.  The matter was dealt with at a hearing by the Ministry of Labour.

 

The Assistant Administrator and the HR Administrator thought that there may have been a potential overlap between the absence of the complainant from work and the cancellation of the second day of the hearing with the Ministry of Labour, which the complainant had been scheduled to attend.  The Hospital asked for a medical certificate from the complainant in order to verify the reason for her absence from work.  In our view, and in accordance with the Policy, the Assistant Administrator and the HR Administrator needed the complainant's name and the date and reason she was absent from work, ie. "medical", in the performance of their duties of verifying the reason for the complainant's absence.  In our view, the description of "medical reason" on the medical certificate did not reveal information about the complainant's diagnosis or details of treatment.

 

In our view, the disclosure of the complainant's name and the date and reason she was absent from work, to both the Assistant Administrator and the HR Administrator was a disclosure to officers who needed the information in the performance of their duties, and the disclosure was necessary and proper in the discharge of one of the Hospital's functions.  Therefore, the disclosure was in accordance with section 42(d) of the Act.

 

The Hospital stated that, like the Assistant Administrator and the HR Administrator, the Legal Counsel also needed the complainant's name and the date and reason for her absence, in the performance of her duties, in accordance with section 42(d) of the Act.  In our draft report, we stated that it was our view that in the circumstances of this case and at the time of the actual disclosure, the Legal Counsel's duties were limited to representing the Hospital at the hearing held by the Ministry of Labour regarding the occupational health and safety matter.  Verifying the reason for the complainant's absence was a separate matter which was not the responsibility of the Legal Counsel and was not relevant to her responsibility of representing the Hospital in the legal matter.  Given this, it was our view that the Legal Counsel did not need the complainant's personal information in the performance of her duties.

 

In its comments on our draft report, the Ministry stated that the Legal Counsel's responsibility was not limited to representing the Ministry regarding the occupational health and safety matter.  She was asked by the Hospital for her legal advice as to whether or not, under the terms of the Collective Agreement, the Hospital could or should request a medical certificate from the complainant.  She was also consulted regarding the adequacy of the medical certificate provided by the complainant, and she was consulted on the basis that, should a grievance result, she would be acting as counsel on behalf of the Hospital at the grievance hearing.  Consequently, the Legal Counsel's role in this matter and the disclosure of the personal information to her was not solely on the basis that she had been representing the Hospital in the occupational health and safety matter.

 

While the Legal Counsel was asked to provide advice for the reasons identified above, it is our view that at the time of the disclosure, the complainant's personal information in the medical certificate was not needed by the Legal Counsel in the performance of her duties.  It is our view that the Legal Counsel could have given her advice without the complainant's identity being disclosed to her.

 

Therefore, our view remains that the disclosure of the complainant's name together with the date and reason for her absence to the Legal Counsel was not in accordance with section 42(d) of the Act.  It is also our view that no other provisions in section 42 applied to this disclosure.

 

The complainant's medical certificate also included her personal physician's name and address.  Although the Hospital submitted that the Assistant Administrator, the HR Administrator, and the Legal Counsel needed this particular information in the performance of their duties, the Hospital's Policy does not identify an employee's physician's name and address as information from a medical certificate about which management would need to know.  It is our view that the Hospital, in drafting its Policy, would have given careful consideration to identifying the specific information that management would require from an employee's medical certificate.  Given this, and considering the relevance of this information to the legal matter the Hospital and complainant were involved in, it is our view that the Assistant Administrator, the HR Administrator, and Legal Counsel did not need the physician's name and address in the performance of their duties.

 

 

Therefore, in our view, the disclosure of the complainant's physician's name and address was not in accordance with section 42(d) of the Act.  It is also our view that no other provisions in section 42 applied to this disclosure.

 

            Conclusion:    The disclosure of the complainant's name together with the date and reason for her absence, to the Assistant Administrator and the HR Administrator was in accordance with section 42 of the Act.  The disclosure of the same information to the Legal Counsel was not.

 

                                    The disclosure of the complainant's physician's name and address was not in accordance with section 42 of the Act.

 

 

Other Matters

 

The Hospital informed us that it is involved in rewriting the Policy so that the Hospital's "Occupational Health Services" will be the first recipient of a medical note or certificate.  The Hospital stated that an employee's supervisor will not receive a medical certificate from the employee.  The certificate will be delivered directly to the Occupational Health Nurse.  If the note is needed for administrative reasons, the personal medical information will be severed by the Occupational Health Nurse.  The revised draft policy clearly identifies the information that may be relayed to management on a need to know basis.  It also states that:

 

All managers should be familiar with this policy.  Managers should ensure that their staff are aware of the policy and should direct employees to submit medical certificates to Occupational Health Services.

 

 

 

SUMMARY OF CONCLUSIONS

 

●         The information in question was "personal information" as defined in section 2(1) of the Act.

 

●         The disclosure of the complainant's name together with the date and reason for her absence, to the Assistant Administrator and the HR Administrator was in accordance with section 42 of the Act.  The disclosure of the same information to the Legal Counsel was not.

 

●         The disclosure of the complainant's physician's name and address was not in accordance with section 42 of the Act.

 

 

 

 

RECOMMENDATIONS

 

We recommend that:

 

1)         the Ministry take steps to ensure that all Hospital Staff are aware of the limited purposes for which the disclosure of personal information is permitted under section 42 of the Act; and,

 

2)         the Ministry take steps to ensure that all Hospital Staff, including management, are aware of the circumstances under which personal information contained in an employee's medical certificate may be released, further to the final revised Policy.

 

Within six months of receiving this report, the Ministry should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendations.

 

 

 

 

 

 

 

Original signed by:                                                      December 16, 1993                          

Susan Anthistle                                                           Date

Compliance Review Officer

 

 

 

 

****