Company included details of previous unrelated visit and personal information with assessment results
An employee health solutions company in Western Canada sent too much of a worker’s personal information to his employer but did properly safeguard the information, Alberta’s privacy commissioner has ruled.
Vancouver-based Wilson Banwell Human Resource Solutions Inc. offers an employee and family assistance program which provides counselling and assessment services to employees of various companies. In June 2005, an employer referred an employee to Wilson Banwell’s Edmonton office for a return-to-work assessment by a psychologist after he was involved in an accident at work and subsequently tested positive for marijuana.
The employee signed an authorization form guaranteeing confidentiality of his information as well as a release form which allowed Wilson Banwell to give the results of his assessment to his employer. However, after the assessment was completed, Wilson Banwell sent more than just the assessment results. It also sent a report from the employee’s previous visit not associated with his employer which included personal information about his wife and details of the visit. The full report was also sent to the employee’s union. It was sent by a fax transmission, which the employee complained exposed it to unauthorized access.
Jill Clayton, a senior portfolio officer for the Alberta privacy commissioner, agreed that including information about the employee’s wife was a violation of the province’s Personal Information Protection Act (PIPA). “The information contained in the psychologist’s report is information about the (employee) and his wife, and is clearly personal information under the act,” Clayton said.
Releasing details about the employee’s previous unrelated visit to the employer was also a violation, according to the privacy officer. The employer confirmed that the only information it needed was the psychologist’s report determining whether he was fit to return to work. The employee had signed the authorization forms believing they referred only to the current assessment. By including information about the employee’s previous visit, Wilson Banwell sent information which “does not qualify as personal employee information under PIPA” but rather personal information unrelated to the employer. “None of this information was necessary to facilitate the (employee’s) return to the workplace,” Clayton said.
Clayton found that transmitting the information via fax did not expose the information. Both the employer and the union noted the faxes were clearly marked as confidential and were sent to secure fax machines with access by authorized personnel only. Wilson Banwell had ensured this was the case according to its security standards and did not violate the employee’s privacy under PIPA.
Though using a fax as a means of transmitting a full report on the employee’s assessment with details from his previous visit was not in itself a privacy violation, Wilson Banwell did violate his privacy with the content of the report. All that was required were the results of his psychological assessment in order to determine whether he was fit to return to work. Instead, Wilson Banwell sent the assessment results along with details of a previous unrelated evaluation plus personal information about the employee’s wife to both the employer and the employee’s union. The privacy commissioner’s office recommended Wilson Banwell clarify its release form and remind its staff to “disclose only the least amount of information necessary for reasonable purposes.”
For more information see:
•Alberta Information and Privacy Commissioner Investigation Report #P2007-IR-001. Jill Clayton—Senior Portfolio Officer, dated Feb. 12, 2007.
Related article
An employer’s right to seek medical information
When an employee goes off on sickness or disability leave, to what extent can the employer request medical information to validate the absence? Some people feel an employer has no right to ask for any medical information.
Vancouver-based Wilson Banwell Human Resource Solutions Inc. offers an employee and family assistance program which provides counselling and assessment services to employees of various companies. In June 2005, an employer referred an employee to Wilson Banwell’s Edmonton office for a return-to-work assessment by a psychologist after he was involved in an accident at work and subsequently tested positive for marijuana.
The employee signed an authorization form guaranteeing confidentiality of his information as well as a release form which allowed Wilson Banwell to give the results of his assessment to his employer. However, after the assessment was completed, Wilson Banwell sent more than just the assessment results. It also sent a report from the employee’s previous visit not associated with his employer which included personal information about his wife and details of the visit. The full report was also sent to the employee’s union. It was sent by a fax transmission, which the employee complained exposed it to unauthorized access.
Jill Clayton, a senior portfolio officer for the Alberta privacy commissioner, agreed that including information about the employee’s wife was a violation of the province’s Personal Information Protection Act (PIPA). “The information contained in the psychologist’s report is information about the (employee) and his wife, and is clearly personal information under the act,” Clayton said.
Releasing details about the employee’s previous unrelated visit to the employer was also a violation, according to the privacy officer. The employer confirmed that the only information it needed was the psychologist’s report determining whether he was fit to return to work. The employee had signed the authorization forms believing they referred only to the current assessment. By including information about the employee’s previous visit, Wilson Banwell sent information which “does not qualify as personal employee information under PIPA” but rather personal information unrelated to the employer. “None of this information was necessary to facilitate the (employee’s) return to the workplace,” Clayton said.
Clayton found that transmitting the information via fax did not expose the information. Both the employer and the union noted the faxes were clearly marked as confidential and were sent to secure fax machines with access by authorized personnel only. Wilson Banwell had ensured this was the case according to its security standards and did not violate the employee’s privacy under PIPA.
Though using a fax as a means of transmitting a full report on the employee’s assessment with details from his previous visit was not in itself a privacy violation, Wilson Banwell did violate his privacy with the content of the report. All that was required were the results of his psychological assessment in order to determine whether he was fit to return to work. Instead, Wilson Banwell sent the assessment results along with details of a previous unrelated evaluation plus personal information about the employee’s wife to both the employer and the employee’s union. The privacy commissioner’s office recommended Wilson Banwell clarify its release form and remind its staff to “disclose only the least amount of information necessary for reasonable purposes.”
For more information see:
•Alberta Information and Privacy Commissioner Investigation Report #P2007-IR-001. Jill Clayton—Senior Portfolio Officer, dated Feb. 12, 2007.
Related article
An employer’s right to seek medical information
When an employee goes off on sickness or disability leave, to what extent can the employer request medical information to validate the absence? Some people feel an employer has no right to ask for any medical information.
