INVESTIGATION REPORT

 

 

 

INVESTIGATION I94-001M

 

 

A SEPARATE SCHOOL BOARD

 

 

 

 

 

September 14, 1994

INTRODUCTION

 

 

Background of the Complaint

 

This investigation was initiated as a result of a complaint concerning a named separate school board (the Board).

 

The complainant, a teacher with the Board, said that after an incident at the school, she went on sick leave.  While on sick leave, the Board sent her two forms for her signature.  One form (form A) required the complainant to authorize the collection of her medical information from her own physician, including "any and all medical information, documents, records or history" which might be required by the Board's physician.  The other form (form B) authorized the Board's physician to disclose his report based on his medical examination of the complainant to the Board's Superintendent of Education, Personnel Services (Superintendent) or to her designate, the Assistant Superintendent.  The Board advised the complainant that these were standard consent forms.

 

The complainant was reluctant to sign the consent forms which she considered to be invasive and in contravention of the Municipal Freedom of Information and Protection of Privacy Act (the Act).  However, she received a letter from the Superintendent stating that she could not return to work until the Board's physician had received the completed consent forms and had sent his report to the Board (i.e., to the Assistant Superintendent).

 

The complainant signed form B but revised form A, narrowing it to make it specific to the medical information related to the incident which had precipitated her sick leave.  The Board accepted the complainant's revised form (form C).  The complainant stated that she had signed forms B and C, thereby giving her consent to the collection and disclosure of her medical information, only "under coercion" -- in order that she could return to work. 

 

 

Issues Arising from the Investigation

 

The following issues were identified as arising from the investigation:

 

(A)       Was the information in question "personal information" as defined in section 2(1) of the Act?  If yes,

 

(B)       Was the Board's proposed collection of personal information through form A in compliance with section 28(2) of the Act?

 

(C)       Was the Board's collection of personal information through form C in compliance with section 28(2) of the Act?

 

(D)       Was the Board's indirect collection of personal information in compliance with section 29(1) of the Act?

 

(E)       Was the disclosure of personal information by the Board's physician to the Assistant Superintendent in compliance with section 32 of the Act?

 

 

RESULTS OF THE INVESTIGATION

 

Issue A:          Was the information in question "personal information" as defined in section 2(1) of the Act?

 

Section 2(1) of the Act defines "personal information", in part, as:

 

recorded information about an identifiable individual, including,

 

(b)        information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

 

(g)        the views or opinions of another individual about the individual, and

 

(h)        the individual's name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual; 

 

The medical report completed by the Board's physician contained the complainant's name and a description of her physical and emotional state, as well as the physician's opinion that she was physically able to return to her teaching duties.

 

In our view, the personal information in the medical report met the requirements of paragraphs (g) and (h) of the definition of "personal information" in section 2(1) of the Act. 

 

The information obtained by the Board through form C was medical information relating to the specific incident which resulted in the complainant's leave of absence.  This information met the requirements of paragraph (h) of the definition of "personal information" in section 2(1) of the Act.

 

The information that the Board had intended to obtain through form A was "any and all medical information, documents, records of history" in the possession of the complainant's doctor relating to the complainant, as required by the Board's physician for the purpose of completing his examination and writing his report.  It is our view that this information would have met the requirements of paragraphs (b), (g), and (h) of the definition of "personal information" in section 2(1) of the Act.

 

Conclusion:    The information in question was "personal information" as defined in    section 2(1) of the Act.

 

Issue B:           Was the Board's proposed collection of personal information through form A in compliance with section 28(2) of the Act?

 

While no personal information was actually collected through form A, the Board nonetheless intended (and normally collected) personal information using this form.  In asking the complainant to sign it, the Board was seeking her consent to collect "any and all medical information, documents, records or history" relating to her as required by the Board's physician.  Therefore, we examined whether the Board's intended collection of the complainant's personal information through form A would have been in compliance with section 28(2) of the Act.

 

Section 28(2) of the Act states:

 

(2)  No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity. (emphasis added)

 

The Board cited section 171(1) of the Education Act, which states in part that a Board may:

 

appoint and remove such teachers, as it considers expedient, determine the terms on which such officers, servants and teachers are to be employed, prescribe their duties and fix their salaries.

 

The Board advised that it administered and funded employee sick leave benefits.  The Board stated that its collection of the complainant's medical information was necessary to the proper administration of a lawfully authorized activity, i.e. the administration of these employee benefits.  It is our view that the Board's administration of employee benefits as part of its management of human resources was a lawfully authorized activity.

 

However, it is also our view that the extremely broad wording contained in form A could have led to the collection of medical information that would not have been specifically related to the incident precipitating the complainant's sick leave, and for which sick benefits were being received.  In this particular case, the Board accepted a narrower, more privacy-protective version of form A (form C) from the complainant, which only collected information related to the precipitating incident.  The Board considered this to be sufficient.  Had the Board collected all the personal information set out in form A, some of which would not have been specifically related to the precipitating incident, we do not believe the Board's collection would have been restricted to what was  truly "necessary" to the proper adminstration of a lawfully authorized activity.  Accordingly, the collection of the broad spectrum of medical information required through form A ("any and all medical information, documents, records or history") would not have been in compliance with section 28(2) of the Act.

 

Conclusion:    The Board's proposed collection of the complainant's personal information through form A would not have been in compliance with section 28(2) of the Act.

 

Issue C:          Was the Board's collection of personal information through form C in compliance with section 28(2) of the Act?

 

The Board collected the complainant's medical information through her revised form C. This information was related to the incident which had directly resulted in her leave of absence.

 

As previously stated, it is our view that the Board's administration of employee benefits as part of its management of human resources was a lawfully authorized activity.  It is also our view that the collection of medical information relating to the incident which precipitated the complainant's sick leave was necessary to the proper administration of this lawfully authorized activity, in order to determine the appropriate benefits.  Therefore, the Board's collection of the complainant's personal information through form C was in compliance with section 28(2) of the Act.

 

Conclusion:    The Board's collection of the complainant's personal information through form C was in compliance with section 28(2) of the Act.

 

 

Issue D:          Was the Board's indirect collection of personal information in compliance with section 29(1) of the Act?

 

Section 29(1)(a) of the Act states:

 

An institution shall collect personal information only directly from the individual to whom the information relates unless,

 

(a)        the individual authorizes another manner of collection.

 

The complainant said that she had not wanted to sign the consent forms but felt she had been given no choice: she said she signed the consent forms "under coercion".  She had been informed in the letter from the Board's Superintendent that she could not return to work unless the forms were signed.  The Board also confirmed that employees were required to sign the forms before receiving or continuing to receive sick leave benefits, or being permitted to return to work.

 

For the purpose of comparison, we contacted another separate school board to determine if its policies regarding the collection of employee medical information were the same.  We were told that for short term illness, employees may be asked to obtain a medical certificate from their doctor.  For long term illness, "an extended sick leave claim" form and an attending physician's statement are sent to the employee.  Both forms require administrative details, but with a minimum of medical information.  The attending physician's statement requires the attending physician to complete the statement and give it directly to the patient.  The patient then returns both the sick leave claim form and the physician's statement to the school board. 

 

It is our view that had the complainant been allowed to obtain the required medical information directly from her doctor to pass on to the Board, she would have been in a better position to protect her privacy, with no detriment to the fulfilment of the Board's legitimate need for this information.  She would have had the opportunity to discuss the need for any medical information unrelated to the precipitating incident, with her own physician prior to forwarding the report to the Board.

 

For consent to be truly meaningful, that consent must be given on an informed basis and must be given voluntarily.  This is the hallmark of consent -- that it be voluntary in nature.  If consent is not both informed and voluntary, its value is diminished so greatly that, in our view, it may be rendered meaningless.

 

In the circumstances of this particular case, the complainant signed Form C, a narrowed version of Form A, which the complainant had refused to sign in its entirety.  The complainant herself revised Form A (presumably, to her satisfaction), transforming it into Form C.  By signing Form C, however, the complainant in effect authorized the Board's indirect collection of her medical information from her physician.  Under the pressured circumstances faced by the complainant, we question just how "voluntarily" consent was actually given.  However, the signed Form C enabled the Board to collect the complainant's personal information, in technical compliance with section 29(1)(a), i.e., where the individual authorizes another manner of collection.  Nonetheless, we find this approach to obtaining authorization to be objectionable, and not in keeping with the spirit of the Act.

 

Conclusion:  The Board's indirect collection of the complainant's personal information                   was in technical compliance with section 29(1) of the Act. 

           

 

Issue E:           Was the disclosure of personal information by the Board's physician to the Assistant Superintendent, in compliance with section 32 of the Act?

 

Under the Act, an institution may not disclose information in its custody or under its control except in the specific circumstances outlined in section 32.

 

Section 32(c) of the Act states:

 

An institution shall not disclose personal information in its custody or under its control except,

 

(c)        for the purpose for which it was obtained or compiled or for a consistent purpose;

 

The Board stated that one of the terms of employment with the Board requires a teacher to be examined by a Board physician at any time before an allowance for sick leave or benefits are given.  The Board advised that section 23.04(c) of the Collective Agreement between the teachers' union and the Board stated:

 

The Board may require the teacher to be examined by a medical or dental practitioner of the Board's own choice at any time before any allowance for sick leave is given or while benefits from the plan are being received.

 

The complainant was examined by the Board's physician, whose report was then disclosed to the Assistant Superintendent. 

 

It is our view that one of the purposes for which the Board's physician had obtained the complainant's medical information (contained in his report) was to determine whether the complainant was physically and mentally ready to return to work, or whether she should remain on sick leave and in receipt of benefits.   The Board's physician then disclosed his report to the Assistant Superintendent to inform her that in his view, the complainant was ready to return to work.  Since the Board's physician disclosed the complainant's medical information for the same purpose for which he had obtained it, we view his disclosure as being in compliance with section 32(c) of the Act.

 

Conclusion:    The disclosure of the complainant's personal information by the Board's physician to the Assistant Superintendent was in compliance with section 32 of the Act.

 

 

Other Matters

 

Access and Retention of Personal Information

 

During the course of our investigation, the complainant also raised several concerns about who would have access to her official personnel file and how long the medical report would be retained in the file. 

 

The Board provided us with the following information:

 

Access to Personnel Files:

 

Staff who have access to personnel files include the Superintendent of Education, Personnel Services; the Assistant Superintendent of Education, Personnel Services; personnel staff who deal with the specific category of employee in question; the appropriate support staff in Personnel, i.e. Personnel Records Officer, Secretary to the Superintendent; and upon request, the Superintendent of Education, Schools, who is responsible for the school in which the teacher is assigned.

 

Section 4(2) of Regulation 823 under the Act provides that "Every head shall ensure that only those individuals who need a record for the performance of their duties shall have access to it."

 

It is our view that the above personnel may require access to the complainant's personnel file from time to time, for the performance of their duties.  In particular, those staff who were involved in the administration of her medical benefits would need access to the medical report in her file.  However, we would ask the Board to ensure that only those individuals who specifically need to access an employee's medical information, be permitted to do so.  

 

Retention of Personal Information:

 

Employee records are retained permanently on microfilm.  Employees' active hard copy files, including medical records or consent forms, are retained in Personnel Services until their employment with the Board terminates.  The Board sent us a copy of their retention schedule.

 

Section 5 of Regulation 823 states that personal information that has been used by an institution "shall be retained by the institution for the shorter of one year after use or the period set out in a by-law or resolution made by the institution or made by another institution affecting the institution, unless the individual to whom the information relates consents to its earlier disposal". 

While the Regulation provides for a minimum retention period, there are no restrictions on the length of retention periods.  Therefore, the Board's retention of an employee's records until the termination of his/her employment would not be an infringement of this Regulation.

 

 

SUMMARY OF CONCLUSIONS

 

●         The information in question was "personal information" as defined in section 2(1) of the Act.

 

●         The Board's proposed collection of the complainant's personal information through form A would not have been in compliance with section 28(2) of the Act.

 

●         The Board's collection of the complainant's personal information through form C was in compliance with section 28(2) of the Act.

 

●         The Board's indirect collection of the complainant's personal information was in technical compliance with section 29(1) of the Act.

 

●         The disclosure of the complainant's personal information by the Board's physician to the Assistant Superintendent was in compliance with section 32 of the Act.

 

 

 

RECOMMENDATIONS

 

We believe that the Board could have better protected the complainant's privacy if: a) the complainant had been allowed to collect the medical information directly from her physician and submit it to the Board's physician herself; and b) if she had been allowed to review and comment upon the Board's physician's report before it was sent to the Assistant Superintendent.   The complainant would have thus been able to object to the disclosure of any medical information she felt was not relevant under the circumstances.  

 

Therefore, we recommend that the Board amend its policies and procedures as follows: 

 

1.         The Board's physician should not collect medical information directly from an employee's physician.  The employee involved should be permitted to obtain the medical information from his/her own physician, to submit directly to the Board's physician.  (This would also eliminate the need for a consent form for this collection).

 

2.         The Board should allow the employee involved to review and comment on the Board's physician's medical report, prior to sending it to Personnel Services. 

 

 

Within six months of receiving this report, the Board should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendations.

 

 

 

 

 

 

 

 

Original signed by:                                                      September 14, 1994                 

Ann Cavoukian, Ph.D.                                               Date

Assistant Commissioner                                                   

 

 

 

 

****