COVID-19 and Employee Privacy
COVID-19 and Employee Privacy
Posted on November 24, 2020
While the main thought on every manufacturers mind about COVID-19 is rightfully the health and safety of their employees, we must be mindful of the importance of privacy as well.
We’d like to thank Kristin Kersey and Megan Smith of Thompson Dorfman Sweatman (TDS) for supplying the COVID Employee Privacy Issues tip sheet, a concise and resourceful document on how to protect the health and privacy of your employees once one is diagnosed with COVID-19. CME appreciates their legal expertise on a critical issue that is sometimes overlooked.
To help manufacturers navigate privacy concerns, Made Safe has pulled excerpts from the TDS tip sheet into this blog post. For a complete review, please access the source document here or contact the legal experts at TDS for guidance.
Unlike some provinces, Manitoba has not subjected businesses to provincial privacy legislation regarding collection, dissemination, and disclosure of their employees’ personal information. Despite this, it is crucial to protect the privacy of workers during this pandemic, especially those who test positive for COVID-19.
A positive COVID-19 diagnosis is private health information that must be kept confidential whenever possible. However, employers are also obligated to take reasonable steps to provide a safe workplace for their employees. Evaluating the proper use and disclosure of employee personal health information involves a balancing of an individual employee’s right to privacy with the employer’s obligation to protect its workforce. The employer’s goal should be to disclose enough information to make other employees aware of a possible exposure, but to give as little information as possible regarding the identity of the employee who has tested positive, and his or her condition
Employers need to be aware of what privacy legislation may apply to them, and how that may affect the way they use and disclose personal health information of their employees. In Manitoba, there are a number of privacy laws, such as the Privacy Act, which may or may not be applicable depending on the nature of the business. Furthermore, an employee may have the option to file a human rights complaint if they feel that discrimination or harassment has occurred.
Respect for employee privacy and privacy legislation matters. Failure to comply with this legislation can result in hefty fines. Even those employers who are not subject to specific privacy legislation may be sued or find themselves subject to a complaint or grievance. Therefore, it is important to consider what steps can (and cannot) be taken where an employee tests positive.
As a first step, the employer should determine when the affected employee was on the employer’s premises, and when possible transmission to other employees could have occurred. The employer is generally entitled to send a notification to employees informing them that an employee has tested positive for COVID-19. This notice can typically specify the times and general locations where the employee was present in order to allow other employees to determine whether or not they may have been exposed and monitor for symptoms.
Except in rare situations, this notice should not reveal the identity of the employee in question, and employers should be careful not to reveal information that identifies the specific employee, such as the employee’s specific workstation. If the employee voluntarily gives express permission to be identified, the employer may identify the employee. Still, the employer must be careful to ensure that he or she does not pressure the employee to grant such permission. The employer should also identify specific individuals who are likely to have come into close contact with the COVID-19 positive employee, and to notify those employees that they may have been in contact with a colleague who tested positive.
There may be situations where notifying an employee that they have been in close contact will effectively identify the COVID-19 positive employee, e.g., where two employees work closely together but have limited exposure to other employees. In such cases, employers should act with caution if they do not have consent to identify the employee.
Depending on the circumstances, the employer may wish to ask exposed employees to work from home (if possible) or take other measures in order to isolate and monitor for symptoms. Employers should also ensure that all health information provided by employees is stored securely and can only be accessed by managers and human resources personnel who require the information. This may require storing employee health information in a secure location that is separate from regular employee personnel files.
Given the potential consequences for employers, it is imperative that they be mindful of the above principles while managing any situation involving a COVID-19 positive employee. If the employer is subject to specific privacy legislation, the employer should also consult that legislation to ensure that they are compliant with all legislative requirements.
Ultimately, employers must carefully secure all personal health information, disclose the minimum amount of information necessary, obtain consent prior to disclosure whenever possible, and comply with any applicable legislation when an employee tests positive.
To access the comprehensive guidelines, please refer to the TDS guidelines document here.