Sharing Sickness Report.

S

Shaunac

Registered User
Messages
3
My employer requested me to attend a private medical assessment which I did. The report was sent to my line manager naming all my conditions without my consent. He then sent it to a Consultancy company for some clarifications. Is the usual practice.

Thanks
 
Not an expert in this field; but I don't believe your medical information should have been shared with your line manager; having said that, the recommendations would have been.

What do you mean by consultancy company? And who forwarded the report to them?
 
Shaunac said:
My employer requested me to attend a private medical assessment which I did. The report was sent to my line manager naming all my conditions without my consent. He then sent it to a Consultancy company for some clarifications. Is the usual practice.

Thanks
Click to expand...
No. Sounds like a GDPR breach
 
The line manager / management would need to know implications of your condition as to how it would affect your ability to work ... unsure what issue is .. did you just want line manager to know only that you were ‘sick’ ?
 
cmalone said:
The line manager / management would need to know implications of your condition as to how it would affect your ability to work ... unsure what issue is .. did you just want line manager to know only that you were ‘sick’ ?
Click to expand...
That’s not correct. The manager is entitled to know that the person is not available for work and for how long. Whether iirs because of a sore foot or depression is not his concern.
 
Well if it affects their ability to do the job - it’s the manager’s right. The employer can refuse to allow the person back to the job if they are unable to undertake duties. Example - lifting and the worker has a back injury. Similarly if they have a mental health issue that might need attention
 
The doctor is informed of the job when evaluating fitness to work. This is standard GDPR compliance territory, data minimisation. Plus the op has a concern about further data sharing which you haven’t addressed.
 
cmalone said:
Well if it affects their ability to do the job - it’s the manager’s right. The employer can refuse to allow the person back to the job if they are unable to undertake duties. Example - lifting and the worker has a back injury. Similarly if they have a mental health issue that might need attention
Click to expand...

How is the manager qualified to make that decision from a list of medical conditions? That's that the medical \ occupational health specialist is for. The medical report should have clarified what duties could and could not be performed.
 
the supervisor / manager does not make a medical determination. The supervisor will need to know what the medical condition is and how it might affect work duties or if any accommodation or assistance should be provided to the worker... in some cases a member of staff can be facilitated to return to work for ‘light duties’ etc
 
Last edited by a moderator:
What does your contract say about the process? Did you see a copy of the report that was provided to the line manager?

Where a company refers an employee for such an assessment, it is generally to ensure the employee is fit to work and determine any accommodations required to work practices to ensure that the employee's health or well-being are not negatively impacted. Of course they also do it to cover themselves and satisfy the requirements of their insurance.

It would be normal for the line manager to see a summary of the assessment. The report they see may include some pertinent medical details, but will mainly focus on the employee's fitness to work in the role, and detail any changes or supports that might be required in order to protect their health. Even pre-GDPR, these reports didn't go into detailed medical histories.
 
The doctor should not have shared a report giving your medical details. That was completely unethical and they should be reported to their professional body.
Your line manager should not have read the report and certainly should not have shared it. That was also wrong and a breach of GDPR.

The doctor should have given you the report and sent a letter/email to your employer stating whether you were fit or unfit to work and if you were unfit to work they should have said for how long etc. Under no circumstances should they have shared your medical details.
 
Did you outline your medical history to the doctor doing the medical assessment? If you did and he shared this with your line manager, then I would suggest that you have a very strong case to complain. Even without GDPR. The fact that the manager then shared your data would set off red flags for me. Your company should have a policy as to how it deals with health information such as what can requested, how it will be used and how it will be secured. There is a reason why company's use Occupational Health professionals. Also worth remembering that under GDPR, just because you consented to the medical examination, the employer can not use that consent to use that health information as they see fit. Relying on general consent clauses in employment contracts won't work because GDPR recognises the imbalance of power between employer and employee. So companies need to be very very careful about how they use this data.

First step, I would suggest asking to see your company's data protection policy in relation to health records.
 
Shaunac said:
My employer requested me to attend a private medical assessment which I did. The report was sent to my line manager naming all my conditions without my consent. He then sent it to a Consultancy company for some clarifications. Is the usual practice.

Thanks
Click to expand...

Totally out of order on the part of your company and line manager. The company must have been aware of what was happening when they engaged the services of another company to assess the report.

An Occupational Health Physician would need your written consent to forward your details to another medical specialist never mind anyone else.

You are entitled to a copy of any report issued about you to anyone. Request copies of same and based on that decide how you wish to proceed as you have a very strong case.
 
Thank you all for your replies and I will follow up the advice given. The Occupational Health Company that carried out my assessment clearly states that they will send the report to 'my employer' and that I should request a copy of the report from them or in writing from the Occupational Health Company. I did sign a form to agree to the examination but I was assured that it was confidential and I am writing to them today for clarification. It will take me some time to get working on it but again thanks you for your help.
 
Ask for a copy of the report and see what is included. Occupational Health Specialists are usually very careful with the reports and the data they share so I would be surprised if they included medical details that weren't relevant or went into detail about medical conditions. If they did, you have a complaint against them as well as the employer.

Just because you signed consent for the examination does not mean you consented to that data being used or shared incorrectly. Even if you consented for them to share it, it wouldn't matter unless the company could prove is was for a lawful and acceptable reason and only necessary information was shared. If the occupational health company or your employer shared the data or used the data in an inappropriate manner, they are in breach of GDPR. So you need to find out what information was shared and with whom.

Going by your posts here, the company is exposed.
 
Might the job you do have a bearing on what information needs to be known by managers, supervisors, other workers, etc? To suggest the Co was out of order based on the little information given seems a little simplistic.
 
noproblem said:
Might the job you do have a bearing on what information needs to be known by managers, supervisors, other workers, etc? To suggest the Co was out of order based on the little information given seems a little simplistic.
Click to expand...
Details of medical conditions can only be shared with the specific consent of the employee and only if specifically relevant to the job they carry out. The report sent to employer should contain as assessment of their ability to carry out their duties. It should not contain specifics of any medical condition.
The OP stated that;
Shaunac said:
The report was sent to my line manager naming all my conditions without my consent.
Click to expand...
That's a clear breach of confidentiality and sharing the report within the employers organisation is a clear breach of data protection.
 
noproblem said:
Might the job you do have a bearing on what information needs to be known by managers, supervisors, other workers, etc? To suggest the Co was out of order based on the little information given seems a little simplistic.
Click to expand...

It doesn't matter. Managers are not entitled to detailed medical history. Nobody is. Certainly not other workers. That is why company's use occupational health specialists. They are there to decide what is relevant to be shared with employers. Any medical report should only contain enough details so the employer can fulfil its legal obligations i.e. if there is a disability, if it will impact the ability perform a role and if certain steps need to be taken to protect the employee. Revealing that the employee suffers back pain so needs an adjustable chair is fine. Revealing that an employee spent three months on anti-depressants after giving birth isn't. If the occupational therapist listed the OP's conditions that were not relevant to the job, there is a problem on that end but I would be surprised if that was actually the case. Even allowing for that, the fact the manager then shared the information is a complete breach of GDPR. Even if the OP gave consent, it would unlikely to be sufficient due to employer/employee relationship.
 
Sunny said:
Even if the OP gave consent, it would unlikely to be sufficient due to employer/employee relationship.
Click to expand...
This is an important point; since the employer/employee relationship is not a coequal one it is not possible for an employee to give consent to their employer to divulge their personal data to a 3rd party. There must be another reason which make such a divulgence necessary.
 
Have you any conditions that affect your ability to do the actual job you are employed for - unsure regarding the context. Have you been off work ? Why would employer want you to attend the assessment ?
 
You must log in or register to reply here.
Back
Top