Adjudicator rules EAP provider didn’t have consent or justification to give full details of employee’s voluntary treatment to employer’s health service
An Alberta company and its employee assistance plan provider didn’t have proper consent to collect and disclose an employee’s personal employee information in relation to his medical leave for treatment of an alcohol problem, according to an adjudicator from the office of the Alberta privacy commissioner.
On April 18, 2006, an employee of TransAlta, a power generation company in Alberta, received a medical opinion that he needed a three-month leave from work. He provided a doctor’s note and was referred to TransAlta’s occupational health nurse. The nurse referred the employee to Kelly, Lutmer and Associates (KLA), TransAlta’s provider of employee and family assistance program (EFAP), where he entered a voluntary drug and alcohol program. KLA also administered TransAlta’s occupational health and safety (OHS) program.
The employee understood his use of the EFAP would remain confidential since he entered voluntarily. His doctor recommended a three-month medical leave during treatment and he gave consent for KLA’s OHS program to collect necessary information from his doctor. He went on medical leave from May 8 to Aug. 15, 2006.
During the employee’s leave, his union president asked KLA about TransAlta’s disability management processes. Though he didn’t mention or ask for any specific names, a KLA nurse handling TransAlta’s OHS program responded in an e-mail also sent to a senior advisor in HR that named the employee and the details of his rehabilitation, counselling and treatment. The employee learned of the e-mail and sent a letter to KLA revoking “any and all consents for release of information.” However, a few days later, the KLA nurse sent an e-mail to the same people about the employee’s follow-up care.
Two weeks later, the HR advisor sent the employee a letter telling him he wasn’t compliant with TransAlta’s policies and KLA had documents on his continuing care while on short-term disability (STD) benefits. This letter was copied to the union president, the employee’s supervisor and manager, the director of TransAlta’s disability management, TransAlta’s director of operations, the KLA nurse and TransAlta’s production manager.
A few days later, the employee signed an action plan and consent for KLA’s EFAP department to disclose his personal information. However, the employee said he was threatened with termination if he didn’t sign. He filed a complaint with Alberta’s information and privacy commissioner, claiming TransAlta had collected more personal information and KLA disclosed more than he consented to.
First, the adjudicator determined the personal information obtained from the employee’s doctor pertained to his medical leave and qualified as personal employee information, which was reasonable for the OHS program to collect and disclose to TransAlta to manage the medical leave.
“Given the (employee) was proposing to take a three-month medical leave of absence from work, it would be reasonable for TransAlta, through its contracted OHS provider, to require some personal information to verify that he was participating in a treatment program and eventually to verify his return to work,” the adjudicator said.
However, Alberta’s Personal Information Protection Act (PIPA) requires an employee to be given advance notice if his personal employee information is going to be disclosed without consent, and this was not the case with this employee.
The information on the employee’s treatment through the EFAP, however, was a different story. The employee had entered a voluntary treatment program and was told it would be kept confidential, the adjudicator said. TransAlta also had a drug and alcohol policy that indicated treatment programs were confidential when entered into voluntarily and signed consent would be required for any personal information to be released, including to the company’s OHS provider.
The adjudicator found the employee had consented to information collected by his doctor related to his fitness for work and eligibility for short-term disability benefits, but not relating to his treatment in the EFAP. The action plan and consent to disclose information by the EFAP program showed the EFAP at that point considered the treatment as part of a formal referral from TransAlta, instead of voluntarily. As a result, the employee continued to show reluctance at signing any consent form and the EFAP program was not authorized to use his personal employee information without consent.
The e-mails from KLA’s OHS nurse contained information related to his work status, the adjudicator found, but sending it to TransAlta management wasn’t necessary as the company didn’t need to know the details about his treatment.
The HR advisor’s letter regarding the employee’s non-compliance with company policy also violated his privacy rights under PIPA, the adjudicator said. His direct and indirect supervisors needed to know certain details about his suitability to return to work, but not “all of these individuals reasonably required all of this information.” Therefore, the extent of information in the letter wasn’t reasonably necessary.
For not properly collecting and using the employee’s information, the adjudicator recommended TransAlta review and change its disability management policies so employees know exactly what information will be used and disclosed and its procedures regarding use of EFAP programs. KLA was also told to review its policies and distinguish between its EFAP and OHS services and the disclosure practices for each of them.
“This case points to a need for organizations to carefully consider and set out how they will collect, use and disclose personal information and personal employee information,” the adjudicator said. “In particular, it is important for organizations to identify the roles and responsibilities of various parties in the process, and the nature and extent of information that will be collected, used and possibly disclosed at various stages of that process.
For more information see:
•Alberta Office of the Information and Privacy Commissioner Investigation Report P2008-IR-003 (April 10, 2008), Jill Clayton-Adjudicator.
On April 18, 2006, an employee of TransAlta, a power generation company in Alberta, received a medical opinion that he needed a three-month leave from work. He provided a doctor’s note and was referred to TransAlta’s occupational health nurse. The nurse referred the employee to Kelly, Lutmer and Associates (KLA), TransAlta’s provider of employee and family assistance program (EFAP), where he entered a voluntary drug and alcohol program. KLA also administered TransAlta’s occupational health and safety (OHS) program.
The employee understood his use of the EFAP would remain confidential since he entered voluntarily. His doctor recommended a three-month medical leave during treatment and he gave consent for KLA’s OHS program to collect necessary information from his doctor. He went on medical leave from May 8 to Aug. 15, 2006.
During the employee’s leave, his union president asked KLA about TransAlta’s disability management processes. Though he didn’t mention or ask for any specific names, a KLA nurse handling TransAlta’s OHS program responded in an e-mail also sent to a senior advisor in HR that named the employee and the details of his rehabilitation, counselling and treatment. The employee learned of the e-mail and sent a letter to KLA revoking “any and all consents for release of information.” However, a few days later, the KLA nurse sent an e-mail to the same people about the employee’s follow-up care.
Two weeks later, the HR advisor sent the employee a letter telling him he wasn’t compliant with TransAlta’s policies and KLA had documents on his continuing care while on short-term disability (STD) benefits. This letter was copied to the union president, the employee’s supervisor and manager, the director of TransAlta’s disability management, TransAlta’s director of operations, the KLA nurse and TransAlta’s production manager.
A few days later, the employee signed an action plan and consent for KLA’s EFAP department to disclose his personal information. However, the employee said he was threatened with termination if he didn’t sign. He filed a complaint with Alberta’s information and privacy commissioner, claiming TransAlta had collected more personal information and KLA disclosed more than he consented to.
First, the adjudicator determined the personal information obtained from the employee’s doctor pertained to his medical leave and qualified as personal employee information, which was reasonable for the OHS program to collect and disclose to TransAlta to manage the medical leave.
“Given the (employee) was proposing to take a three-month medical leave of absence from work, it would be reasonable for TransAlta, through its contracted OHS provider, to require some personal information to verify that he was participating in a treatment program and eventually to verify his return to work,” the adjudicator said.
However, Alberta’s Personal Information Protection Act (PIPA) requires an employee to be given advance notice if his personal employee information is going to be disclosed without consent, and this was not the case with this employee.
The information on the employee’s treatment through the EFAP, however, was a different story. The employee had entered a voluntary treatment program and was told it would be kept confidential, the adjudicator said. TransAlta also had a drug and alcohol policy that indicated treatment programs were confidential when entered into voluntarily and signed consent would be required for any personal information to be released, including to the company’s OHS provider.
The adjudicator found the employee had consented to information collected by his doctor related to his fitness for work and eligibility for short-term disability benefits, but not relating to his treatment in the EFAP. The action plan and consent to disclose information by the EFAP program showed the EFAP at that point considered the treatment as part of a formal referral from TransAlta, instead of voluntarily. As a result, the employee continued to show reluctance at signing any consent form and the EFAP program was not authorized to use his personal employee information without consent.
The e-mails from KLA’s OHS nurse contained information related to his work status, the adjudicator found, but sending it to TransAlta management wasn’t necessary as the company didn’t need to know the details about his treatment.
The HR advisor’s letter regarding the employee’s non-compliance with company policy also violated his privacy rights under PIPA, the adjudicator said. His direct and indirect supervisors needed to know certain details about his suitability to return to work, but not “all of these individuals reasonably required all of this information.” Therefore, the extent of information in the letter wasn’t reasonably necessary.
For not properly collecting and using the employee’s information, the adjudicator recommended TransAlta review and change its disability management policies so employees know exactly what information will be used and disclosed and its procedures regarding use of EFAP programs. KLA was also told to review its policies and distinguish between its EFAP and OHS services and the disclosure practices for each of them.
“This case points to a need for organizations to carefully consider and set out how they will collect, use and disclose personal information and personal employee information,” the adjudicator said. “In particular, it is important for organizations to identify the roles and responsibilities of various parties in the process, and the nature and extent of information that will be collected, used and possibly disclosed at various stages of that process.
For more information see:
•Alberta Office of the Information and Privacy Commissioner Investigation Report P2008-IR-003 (April 10, 2008), Jill Clayton-Adjudicator.
