Personal Information Protection during a Public Health Crisis
We have been receiving inquiries this week regarding what types of personal health information employees need to disclose to their employers during a Public Health Emergency. As organizations are working to establish new tools, protocols, procedures and processes for the crisis while in the midst of it, it is important to know how to balance the rights of individuals with the information requirements of the organization to better equip their response plan.
What are individuals rights?
Individuals as employees have the right to keep their medical information private. However, in order to be accommodated in the workplace, they are required to provide relevant medical information. Employers have a duty to accommodate employees to the point of undue hardship, therefore they have a right to request medical information when necessary.
As the pandemic reaches towards its peak, employers have a duty to protect their employees as well as the public.
What can employers ask?
Employers may seek medical information in a variety of circumstances, including to support:
- And to protect other employees and the public (in the case of a Public Health Crisis);
- a request for short-term sick leave;
- extended sick leave, or partial medical leave;
- an application for benefits;
- a request to return to work; or
- a request for accommodation
- For example: Employers can ask if their employees have experienced symptoms of the virus. They can ask if they have recently travelled and if so, where. They may also ask if their employees have been in contact with anyone identified as a confirmed case.
What employers canNOT ask:
- Their employees self-identify any range of pre-existing medical conditions such as Asthma, COPD, Immune Deficiencies, diabetes, cardiac issues, etc.
- Their employees identify the people they live with over the age of 60 and name any children with vulnerable medical conditions.
- Their employees to identify and make a statement if you do NOT have any of these medical conditions or living conditions and are in good general health
What does the OIPC say?
‘Declaration of a Public Health Emergency: Privacy legislation would not impede the work of public health officials if a public health emergency is declared.
If an outbreak is declared to be a public emergency, the powers to collect, use and disclose personal or health information to protect the public health may be very broad.
In the event that a public health or general emergency is declared, orders issued under public health legislation could require the collection, use and disclosure of certain personal information relating to employees and customers.
If you need to collect, use or disclose employee personal information in an emergency, you should communicate to your employees the specific legislative authority that is engaged to do so.’
Souce: https://www.oipc.ab.ca/resources/privacy-in-a-pandemic-advisory.aspx
Personal Information Protection Act (PIPA)
PIPA applies to personal information collected, used and disclosed by private sector organizations.
Organizations are required by PIPA to collect, use and disclose personal information only for purposes that are reasonable (sections 11, 16 and 19). The term “reasonable” means “what a reasonable person would consider appropriate in the circumstances” (section 2).
Except in limited, specific circumstances, PIPA requires organization have the individual’s consent when collecting, using or disclosing personal information about that individual (section 7). Some of the circumstances where consent is not required include:
- if the collection, use or disclosure is authorized by an enactment of Alberta or Canada, including a bylaw (sections 14 (b), 17(b) and 20(b))
- a reasonable person would consider that the collection, use or disclosure of the information is clearly in the interests of the individual and consent of the individual cannot be obtained in a timely way or the individual would not reasonably be expected to withhold consent (sections 14(a), 17(a) and 20(a))
- the use or disclosure of the information is necessary to respond to an emergency that threatens the life, health or security of an individual or the public (sections 17(i) and 20(g))
- the disclosure is for the purposes of contacting the next of kin or a friend of an injured, ill or deceased individual (section 20(h))
