Personal medical data confidentiality breached by employer

[Inertia Creeps]

Hi there

I will try to keep this as brief as possible.

I was off sick from work and visited the company Doctor.

I was then emailed the report as was my employing manager. It stated the letter was private and confidential and at the bottom of the email it stated it was restricted.

 

This email has now been used in a potential disciplinary investigation against myself. I received the disciplinary papers with this email included, yet some of it had been redacted although not very well as you could still see certain parts of the email, however the nature of my illness had not been redacted at all.

 

I have also been told that the other person involved in the disciplinary has been given the exact same pack that I have which means that they have not only access to my medical papers but also my home address. I work for a well known large company.

 

I believe there is potential for two issues here. Any advice is gratefully received.

[Sidewinder]

There are indeed two aspects to this, however both relate to the Data Protection Act

 

Health information is classed as sensitive personal data under the Act, and as such there is clear guidance on how this should be used. The employer must have your informed consent before processing the data - and should have explained the purpose for requesting the medical information and in what way the data was to be used. It would not be unreasonable that the information should be shared with appropriate people within the organisation - personnel for example, or other senior managers with whom you have day to day dealings and where the information is relevant and where the sharing is in line with the consent that you gave.

 

I do not believe that the sharing of your data as outlined in your OP falls within the scope of what is reasonable. Whilst it might be appropriate to consider the information in the context of a disciplinary hearing, it should not have been shared outside of appropriate management without your express consent. As for sharing your home address, that is irrelevant and should not have been shared.

 

You should be raising a grievance about the misuse of your confidential sensitive personal data, outlining that your agreement was not given for it to be shared amongst a wider audience, the purpose of obtaining the information had not been outlined to you and that your address has been included in addition to the medical information given to third parties.

 

I wouldn't threaten the ICO - yet - but this would also be a course of action open to you

[Inertia Creeps]

Hi Sidewinder, thanks for your reply.

 

I only gave my employer permission to contact my doctor and nothing else. Interestingly, each time they want to contact my doctor, I have to give written permission for this. I agree that certain information needs to be shared with other managers from time to time however due to the sensitive nature of this particular email, it was not necessary for other manager's to know and certainly not my work colleagues.

[Emmzzi]

Is it a disciplinary or an attendance hearing? (some companies call them the same thing)

 

Was the suspected behaviour which is the subject of the disciplinary made worse by your condition?

 

In terms of remedy - you can't put the lid back on pandra's box. best you can hope for is an apology and a promise it won't happen again.

[Inertia Creeps]

 

Was the suspected behaviour which is the subject of the disciplinary made worse by your condition?

 

No Emmzzi, but I believe my employing manager is trying to insinuate that it was because I was sick for 4 weeks with the condition in the email and a lung infection. The email itself carries guidance at the bottom to say that it is not to be forwarded or re-printed or disciplinary procedures will be followed. And quite clearly it has been re-printed to be passed onto another manager who in turn has re-printed and passed that information to 2 other people.

[Emmzzi]

I'd think about what you want to acheive with greivance; you cannot make people "unsee" things. A change in process so it doesn't happen to others perhaps?

 

Try not to get paranid, too.

[king12345]

Sharing your address is worse than sharing your medical record imo.

A couple of years ago one of our manager was moved to another location and given 12 months warning for emailing personal info including address of an employee to a list of people, many of whom didn't even know the employee and had nothing to do with him.

This manager considered himself lucky to keep his job for the seriousness of this matter.