Employer’s Disclosure of Employee Medical Information Constitutes Invasion of Privacy and Harassment

OVERVIEW:

In St. Patrick’s Home of Ottawa Inc. v. Canadian Union of Public Employees, Local 2437, [2016] O.L.A.A. No. 93, 126 C.L.A.S. 110, CanLII 10432 (ON LA), decided February 16, 2016, arbitrator Paula Knopf found the employer, St. Patrick’s Home of Ottawa Inc. (“St. Pat’s”), was liable for disclosing an employee’s medical note to another employer.

FACTS:

The Employer (“St. Pat’s”) operated a long term care facility for adults who require 24-hour care. The Employee (whose name was omitted from the decision for privacy reasons) worked for St. Pat’s as a part-time dietary aid, working 15 hours per week. The Employee also worked at West End Villa, a different long term care facility, as a part-time dietary aid/dishwasher.

The Employee did not make a request for accommodations at St. Pat’s and provided a medical note proving she could do the work. The medical note simply stated “pt is able to perform the duties of Dietary Aid at St. Pat’s home”. As such, the Employee continued her work at St. Pat’s without accommodation.

The other employer, West End Villa, became suspicious about the Employee’s claimed medical restrictions and accommodation requests. An administrator at West End Villa contacted the St. Pat’s and requested information about the Employee. In response to these requests St. Pat’s, through a contractor performing its management functions, confirmed that the Employee was not being accommodated, had no work restrictions and was working her scheduled shifts. West End Villa was also given a copy of the Employee’s medical note (even though the note was not specifically requested by West End Villa).

West End Villa terminated the Employee. Through a different arbitration proceeding, the termination was upheld on the basis that the medical information provided to West End Villa revealed the Employee could not be accommodated without undue hardship.

In the current case, the Union filed a grievance on the Employee’s behalf, arguing the release of medical information to another employer without the Employee’s consent was a breach of the Collective Agreement’s harassment provision, a breach of the Employer’s Confidentiality Policy, a breach of the Occupational Health and Safety Act (“OHSA”) and a violation of the tort of invasion of privacy (i.e. intrusion upon seclusion).

The Employer acknowledged that the release of the Employee’s medical information was inappropriate. However, it argued that since the manager who released the medical note was a contractor (rather than an employee of St. Pat’s) he had not been required to sign the company’s Confidentiality Agreement. The Employer further argued the medical note did not contain any medical diagnosis, health restrictions or personal information

DECISION:

The arbitrator began by considering two sections of the OHSA.

Section 63(1)(f) states “no person shall disclose any information obtained in any medical examination, test or x-ray of a worker made or taken under this Act except in a form calculated to prevent the information from being identified with a particular person or case.”

Section 63(2) states “no employer shall seek to gain access, except by an order of the court or other tribunal or in order to comply with another statute, to a health record concerning a worker without the worker’s written consent.”

The medical note contained medical information and identified the Employee. The Employee gave no consent to release to medical note and West End Villa did not have any legal authorization to receive it. As such, the arbitrator found there was a clear violation of the OHSA.

The arbitrator considered whether release of the medical note constituted harassment. Under the Collective Agreement, harassment was defined as behaviour that is “offensive, embarrassing and humiliating” to any individual. The arbitrator took a firm stance on this issue and stated at pages 14-15 of her decision:

“The release of medical information about one’s personal health, regardless of the contents of the note,

is objectively offensive and embarrassing. It can also cause humiliation. It is not sufficient for this

Employer [St. Pat’s] to say that the contents of the note in question do not disclose any medical conditions

that would stigmatize or cause embarrassment to a reasonable person. Any medical information is personal,

private and must remain confidential. The nature and extent  of information that may be revealed in a medical

note may have a bearing on the remedy available when there has been improper disclosure, but the disclosure

of personal medical information of any kind is very disrespectful and offensive and therefore amounts to

harassment as defined by these parties in this Collective Agreement.”

Finally, the arbitrator spoke to the tort of invasion of privacy (defined as “intrusion upon seclusion” in Ontario). The elements of the tort are as follows:

1. The defendant’s conduct must be intentional (which includes reckless behaviour);

2. The defendant must have invaded, without lawful justification, the plaintiff’s private affairs or concerns; and

3. A reasonable person would regard the invasion as highly offensive causing distress, humiliation or anguish.

The arbitrator found that all three elements had been satisfied. The disclosure was done deliberately, without legal advice and without regard for the Employer’s confidentiality policy. It did not matter that the parties involved had an honest belief that they were acting appropriately. The release of the medical note was an intrusion into the Employee’s private medical affairs. Additionally, any “reasonable person would be offended by such conduct and would suffer distress as a result”.

Upon finding the Employer liable, the arbitrator considered five factors to determine the appropriate remedy:

1. The Nature of the Wrong Done to the Grievor – The arbitrator found that the Employer should have taken better steps to prevent this situation.

2. The Effect of the Wrong of the Grievor’s Health, Welfare, Social, Business or Financial Position – The Employee was embarrassed and humiliated by this breach, but there was no financial loss. The Employee did not lose her job at West End Villa because of the disclosure of the medical note. Any loss in her job was dealt with in a separate arbitration and as such there was no liability for economic loss against St. Pat’s.

3. The Relationship Between the Grievor and the Employer – The arbitrator noted that an employment relationship requires mutual respect and trust and an employee does not lose their right to privacy. As such, the employment relationship between the Employee and Employer meant the Employer was to keep safe medical information it had received.

4. The Distress, Annoyance or Embarrassment Suffered by the Grievor – The arbitrator attributed significant responsibility to the Employee. The fact that she worked for two employers doing similar jobs and provided conflicting medical information meant that the situation could not be solely attributed to St. Pat’s. 5. The Conduct of the Parties – While the arbitrator acknowledged the Employer’s apology, the arbitrator gave it very little weight as the Employer had waited almost three years to apologize. Also, the Employer had still not done anything to ensure its contractors complied with a privacy policy.

AWARD:

Arbitrator Knopf allowed the grievance and found for the Union. Given that the Employer did not comply with its own Confidentiality Policy and did not seem to have taken any steps to ensure compliance by its contractors, declaratory relief was not enough. Although finding that declaratory relief would not be enough in this case, the arbitrator recognized that in most cases “breaches of confidential information, including medical information, trigger only “modest” monetary recovery unless there are exceptional circumstances”. Since no such exceptional circumstances were present in this case, and because the disclosure did not reveal any stigmatizing medical condition, a nominal amount of $1000 damages was awarded.

Additionally, the arbitrator ordered a declaration that St. Pat’s employees must abide by its Confidentiality Policy and sign its Confidentiality Agreement in the future. The arbitrator noted the fact that the medical note did not reveal a medical condition was a mitigating factor.

IMPACT:

Overall, employers must be cautious regarding the disclosure of an employee’s private information. Consent should always be obtained from the employee. In regards to medical information, even if medical documentation does not specify a condition or limitation, it is still considered to be private information. Even a single instance of disclosure may result in a finding of harassment, intrusion upon seclusion, and liability imposed on the employer. Staff, contractors and even third parties should be made aware of confidentiality obligations related to employee information and employee medical records.