Sharing of medical info not privacy violation

Sharing of medical information for administering STD legitimate use of management rights.
|Canadian HR Reporter|Last Updated: 03/06/2011

Concerned about the security of its members’ medical information, the union grieved the employer’s practice of sharing employee medical information with a third-party insurance provider.

The union accepted that employees would be required to authorize sharing their medical information with the employer’s third-party insurance provider to support claims for long-term disability.

However, the union objected to the employer’s practice of sharing employee medical information with the same provider to support claims for short-term disability. The employer was self-insured for short-term disability and it bore the responsibility for determining eligibility and payouts for short-term claims.

While the employer was self-insured for short-term claims, it maintained an Administrative Services Only (ASO) arrangement with the third-party provider to assist with the processing and assessment of short-term claims. Employees were required to assent to the release of their medical information as part of this process. Employees who refused to give their consent faced the prospect that their claims would be rejected.

The employer maintained a health centre with nursing and medical services. It was trusted by employees and capable of managing sensitive employee medical information, the union said.

Consent more like “blackmail”

The employee’s consent to release this information was not really consent at all but more like “blackmail,” the union said, as giving consent was a pre-condition for any income protection.

There was nothing in the collective agreement to permit this encroachment into employee privacy and the release of this information amounted to a violation of the Personal Health Information Act, the union said.

The employer acknowledged the union’s legitimate concern about the security of employee medical information.

However, the employer claimed that it had sound reasons for opting for an ASO arrangement to assist with the management of short-term disability claims.

First, the employer wanted to protect the reputation of the Health Centre, which was viewed by employees as a trusted advisor and helper. To that end, the employer chose to insulate the Health Centre from the decision-making loop on short-term disability claims and keep it completely separate from the company’s human resources section, which was responsible for administering short-term claims.

Second, cost considerations warranted subbing out the evaluation, adjudication and assessment of sick leave claims.

Third, the third-party provider had the expertise to evaluate the medical information along with a comprehensive policy on the protection of medical information.

The Arbitrator sided with the employer.

The issue was narrow. Statutory protections were in place to protect employee health information and there was no suggestion that the employer had ever released employee information without specific consents, the Arbitrator said.

The key question concerned the quality of consent and whether or not the employer could require consent and then refuse benefits if consent was not given.

Legitimate use of management’s rights

Certainly, the employer was within its rights to ask for consent. “[T]he requirement to provide the release of medical information is a well-recognized and legitimate exercise of management’s right to administer income protection benefits,” the Arbitrator said.

“Therefore, requiring an employee to consent to the release of relevant medical information in the context of a claim for Sick Leave pay is entirely appropriate and justified. Nothing in this Collective Agreement limits or curtails that right.”

The remaining question was whether or not the employer had the right to release medical information to a third party with which it had an established ASO relationship. The Arbitrator said it did.

The Arbitrator outlined the employer’s stated reasons for its choice and noted that the union had no problem with the third party’s handling of employee information for the purposes of long-term claims.

Taken together, all the factors “lead to the conclusion that there is nothing to suggest that there is anything wrong with the way [the insurer] is receiving or storing the information and that there are rational operational reasons for it being retained by an organization outside of the bargaining unit.”

Moreover, the Arbitrator disagreed with the union’s assertion that explicit language in the collective agreement was necessary in order to support such an arrangement.

The employer had the right and responsibility to administer the Collective Agreement, including short-term disability benefits, with a view to maintaining “order and efficiency” and there was nothing in the language of the contract to limit that right, the Arbitrator said.

“Since it is accepted that appropriate information is being requested for the administration of the Collective Agreement and since there is no evidence or suggestion that there is any demonstrable reason to be concerned about bargaining unit members’ privacy or confidentiality, it must be concluded that the Union has failed to establish any contractual or statutory violations.”

The grievance was dismissed.


Sanofi Pasteur and Communications, Energy and Paperworkers Union of Canada, Local 1701. Paula Knopf — Sole Arbitrator. William Phelps for the Employer and Michael McCreary for the Union. December 30, 2010. 13 pp.

Add Comment

  • *
  • *
  • *
  • *