Employee looking for addiction treatment worked for health service providing the treatment
An Alberta public health organization violated an employee’s privacy when it collected and used information on the employee’s addiction under the auspices of treatment but used it for disciplinary reasons, a privacy adjudicator has ruled.
The complainant was an employee of Alberta Health Services (AHS), the province’s public health authority. The employee sought help for an addiction from a psychiatrist in June 2009. The psychiatrist referred him to addiction counselling services, which were provided by the AHS Addiction and Mental Health Services, which was under the umbrella of his employer, AHS.
When the employee attended counselling sessions, his counsellor informed him that because he worked for AHS, his condition had to be reported to the organization under the AHS code of conduct. The employee was then asked to sign a consent form allowing the counsellor to disclose his health information and to contact his doctor. The consent form stipulated that his information was being collected in order to allow AHS to “provide me with continuous care, treatment planning and treatment services.” The counsellor contacted the doctor and gathered more details about the employee’s addiction.
An AHS manager for addiction counselling spoke to the doctor and learned the employee had told him he had stolen medication at work for his personal use. The manager passed this information on to the AHS HR department, which resulted in an investigation that led to the employee being suspended.
The employee filed a privacy complaint, claiming AHS Addiction and Mental Health Services had disclosed his personal health information without his consent and contrary to Alberta’s privacy legislation.
The adjudicator found the information collected by the counsellor — from the employee and his doctor — was collected for the purpose of providing rehabilitation from the employee’s addiction. However, the information collected from the doctor by the manager was for a different purpose — to determine if the employee had stolen and used medication and to conduct an investigation. Though the release form allowed AHS to collect the employee’s information for treatment purposes, it did not allow for other reasons, said the adjudicator.
“In essence, the (employee’s) health information was initially collected for the purpose of providing treatment, but once he revealed that he was an employee of AHS, subsequent health information was collected for a human resources management purpose,” said the adjudicator. “I do not believe the (employee) gave his consent to collection of his health information for human resources purposes, as the consent form he signed qualified that he was consenting only to collection of his health information for treatment purposes.”
Though AHS had reasonable concerns regarding the employee’s theft of medication, it didn’t have the right to collect his health information without his consent, said the adjudicator.
“There is nothing in the HIA that suggests patients who are also health services providers should have less protection in relation to their health information than anyone else seeking health services has,” said the adjudicator.
