Request for medical information deemed reasonable, but consent procedures not properly followed

PIPEDA Case Summary #2005-287

(Principles 4.3 and 4.4.1, and subsection 5(3))

Complaint

An employee of a transportation company made two allegations against his employer: (1) that his employer was requiring him to provide more medical information than necessary and would not allow him to return to his position until he supplied the information; and (2) that the company obtained medical information about him from his doctor without his consent.

Summary of Investigation

After recuperating from a serious illness, the complainant returned to his previous position with his employer. This position was deemed safety sensitive by the company because of its possible impact on the safety of the person in the position or other employees in the company. Before being assigned to a safety sensitive position, an employee must undergo a medical examination to ensure that he/she is fit for duty.

When the complainant returned to work, he was considered fit for light work only. He was informed at the time that an annual review would be required to verify his continuing ability to perform the duties of the position. The company stated to the Office that if it becomes aware of a new medical condition for an employee already in a safety sensitive position, the company will evaluate the case and determine what type of follow-up is appropriate to ensure that the employee is fit for duty.

The company's medical fitness for duty guidelines outlined the company's commitment to the health and safety of its employees. Its medical guidelines for the employment of individuals in safety sensitive positions govern all medical assessments of fitness for duty for such employees.

One year after the complainant had returned to work, the company informed him that because of the position he occupied, he was required to provide medical information that guaranteed that he was not a risk of sudden incapacity. The Office reviewed the documentation sent to the complainant and his physician and established the following:

• The company asked the complainant to have his doctor complete two forms updating his medical condition.
• Both forms were completed by the complainant's family doctor. The consent clause on the top of the two forms was not signed by the complainant.
• No results of a particular test related to the complainant's condition were attached to the form, as required.
• The company sent the complainant a letter, asking him to request that his doctor forward a copy of the test results in question. The complainant stated that he did not forward this request to any doctor.
• Two months later, the complainant's specialist sent the company a narrative analysis of the requested test. The letter from the specialist opened with a comment to the effect that the patient (the complainant) had requested that a copy of the test be forwarded to the company.
• A company doctor contacted the specialist directly by phone to get a copy of the test itself. The company admitted that, typically, it would have requested the test through the employee; however, in this instance, it contacted the specialist directly in order to expedite the process.
• After receiving the test, the company sent the specialist a facsimile of supplementary questions related to the complainant's condition. The specialist never answered these because the complainant requested that the specialist not communicate his personal information anymore.

The complainant had signed a consent form, giving his specialist permission to release information to his employer. This consent was valid for 90 days, but had expired long before the events noted above occurred.

The complainant was told that if he did not provide the requested information, he would be restricted from performing the duties of his position. As he did not give his employer the information, he was placed on leave without pay for five months. He eventually provided a note from his new specialist, indicating that he was fit to work. The company was not satisfied with this response, and restricted the employee to working in non-safety sensitive positions only until he could demonstrate that he was fit to carry out his duties in his regular position.

Findings

Issued January 5, 2005

Application: Principle 4.3, which states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate; Principle 4.4.1, which stipulates that organizations shall not collect personal information indiscriminately. Both the amount and the type of information collected shall be limited to that which is necessary to fulfil the purposes identified; and subsection 5(3), which establishes that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.

In making her determinations, the Assistant Privacy Commissioner deliberated as follows:

• With respect to the allegation that the employer was requiring the complainant to provide excessive personal information, the Assistant Commissioner noted that the company's purpose for collecting this information was to ensure the safety of the complainant and other workers.
• The company determined that the complainant should be required to provide some follow-up information given the health problems he had suffered and the fact that he occupied a safety sensitive position.
• The Assistant Commissioner determined that such a purpose would likely be considered appropriate in the circumstances, and therefore in compliance with subsection 5(3).
• The Assistant Commissioner was also of the view that the company was limiting its collection to what was necessary to fulfil this purpose, in keeping with Principle 4.4.1.
• However, she considered the allegation that the company had collected medical information about the complainant without his consent to have merit.
• The investigation established that the complainant was given two forms to have his physician fill out and return. Although the complainant did not sign them, his family doctor filled them out and sent them back. When the company determined that information was missing, it wrote to the complainant and asked for the information.
• The Assistant Commissioner was of the view that when the company received a letter from the complainant's specialist, noting that the complainant had requested that a copy of the test be forwarded to the company, it was reasonable for the company to believe that the specialist was acting at the complainant's behest because of the earlier letter the company had sent to the complainant.
• The problem, however, occurred when the company had still more questions for the specialist and contacted him directly. By its own admission, and in keeping with its procedures, the company should have requested this information of the complainant, not directly from the specialist as it did not have a valid signed consent form from the complainant permitting the company to speak to the specialist.
• The Assistant Commissioner determined that the company collected some medical information about the complainant without his consent and was in contravention of Principle 4.3.

The Assistant Commissioner thus concluded that the allegation that the company was requiring the complainant to provide excessive medical information was not well-founded, while the allegation that the company collected personal information without consent was well-founded.