A recent Ontario grievance arbitration decision, St. Patrick’s Home of Ottawa Inc. v Canadian Union of Public Employees, Local 2437, reminds employers how very careful they must be to not disclose an employee’s confidential personal medical information without consent, or to permit such disclosure through a contractor acting on their behalf.
The employee in question worked for two long-term care facilities. When one employer became suspicious of the employee’s claimed medical restrictions and accommodation requests, it reached out to the other employer and requested certain information. This included a request as to whether the employee had worked her regularly scheduled shifts, whether she had requested any workplace accommodations or provided any work related restrictions, what her hours of work and length of shifts were and whether she had in fact been accommodated.
In response to these requests, the second employer, through a contractor performing its management function, confirmed that the employee was not currently being accommodated, had no work-related restrictions and that she was working her regularly scheduled shifts. It also provided a copy of a medical note the employee had previous provided, which stated: “pt is able to perform the duties of Dietary Aid at St Pat’s home”.
Although at the time of the disclosure the employer believed that it had acted appropriately, as it did not believe it disclosed any medical condition or limitations. However, by the time the matter had wound its way through the grievance procedure to a labour arbitration, the employer had acknowledged that such information should not have been disclosed without the employee’s consent. The employer apologized for any stress that the employee may have suffered as a result, although it only did so years after the breach close to the hearing of the matter by the arbitrator.
However, the employer argued that at most there should be a declaration that its confidentiality policy had been breached or, in the alternative, only nominal damages should be awarded. The employer disputed the union’s claims that the disclosure amounted to harassment under the Collective Agreement, a violation of the Occupational Health and Safety Act’s confidentiality requirements or commission of the tort of “intrusion upon seclusion” developed by the Court of Appeal for Ontario in Jones v. Tsige.
The arbitrator found for the union on all of these issues. Taking a particularly strict stance on the issue of harassment under the Collective Agreement, the arbitrator wrote:
“The release of medical information about one’s personal health, regardless of the contents of the note, is objectively offensive and embarrassing. It can also cause humiliation. It is not sufficient for this Employer to say that the contents of the note in question do not disclose any medical conditions that would stigmatize or cause embarrassment to a reasonable person. Any medical information is personal, private and must remain confidential. The nature and extent of information that may be revealed in a medical note may have a bearing on the remedy available when there has been improper disclosure, but the disclosure of personal medical information of any kind is very disrespectful and offensive and therefore amounts to harassment as defined by these parties in this Collective Agreement.”
Having found that the employer had violated the employee’s privacy rights under a number of heads of responsibility, the arbitrator assessed damages, taking into account notably:
- The employee’s statement that she felt offended, embarrassed, humiliated and disrespected;
- The employer had not complied with its own Confidentiality Policy;
- The employer had not taken any steps to ensure compliance by its contractors;
- The delay in the employer’s apology, even though the breach of the Confidentiality Policy was apparent from the outset.
Although finding that mere declaratory relief would not be sufficient, the arbitrator recognized that in most cases “breaches of confidential information, including medical information, trigger only “modest” monetary recovery unless there are exceptional circumstances”. Since no such exceptional circumstances were present in this case, and because the disclosure did not reveal any stigmatizing medical condition, a nominal amount of $1000 damages was awarded.
The employer was also ordered to comply with, and to require compliance with, its Confidentiality Policy. In particular, it was ordered “to require any of its contractors or agents that have any interaction with residents or staff to abide by its Confidentiality Policy and to sign its Confidentiality Agreement”.
Although this decision did not result in a significant damages award, it is significant in a number of respects, most notably, the finding that the single instance of disclosure amounted to harassment, the tort of “intrusion upon seclusion”, a violation of the OHSA and that liability for these could be imposed on the employer for the acts of its contractors.
In a different case, with more sympathetic facts, the liabilities could have been much higher. Although as of the time of writing I am unaware of any OHSA prosecutions for disclosure of confidential medical information, such a prosecution is possible and, in that event, potential fines under the OHSA can range from $25,000 (for an individual offender) to $500,000 (for a corporate offender) per count.
Although arbitration decisions like this do not create binding precedents they are considered by other arbitrators in future cases. Employers will do well therefore to consider the outcome in this case and ensure that their internal confidentiality policies are followed not only by staff but by contractors as well. Provision should be made for adequate training for both staff and contractors in this respect and due diligence should be shown, and documented, in terms of ongoing monitoring to ensure compliance with confidentiality obligations respecting employee medical records.