Occupational health practitioners must make themselves aware of specific legislation that covers employee rights when dealing with patient data. Jonathan Exten-Wright explains.
Occupational health advisers are required to keep a range of records in order to:
- provide a baseline for the health status of staff and identify those with special health needs;
- provide an effective workplace health surveillance system;
- identify patterns of ill health and work areas with specific risk;
- help management in its responsibility for the notification of accidents and ill health, as well as for medical examinations required by law;
- report on staff health problems; and
- monitor the use and effectiveness of the occupational health service.
The role of the occupational health service and the nature of the information held mean that there are extensive legal obligations surrounding the collection, use, disclosure and retention of records.
There are two main components to occupational health records: transferable information and the confidential clinical record. Transferable information will generally be accessible to the employee, management, enforcing authorities (such as the Health and Safety Executive) and safety representatives. It will include basic information relating to employment, any history of reported exposure to hazards and other relevant information – particularly that relating to types and dates of immunisation, diagnostic tests and accidents at work, and environmental monitoring data.
The confidential clinical record is personal to the employee and keeps information about the health of a member of staff during employment, including:
- an occupational health questionnaire completed by the employee concerned;
- any subsequent clinical information;
- details of any biological monitoring or clinical examinations; and
- relevant correspondence and details of any health surveillance carried out, or personal monitoring stemming from environmental factors.
The clinical record will be “sensitive personal data” for the purposes of the Data Protection Act 1998 (DPA) and as such cannot be processed without the consent of the employee.
No confidential information from the clinical record should be passed to any other person outside the occupational health services without the written consent of the employee concerned, unless the disclosure is a requirement:
- imposed by a judge or court of law;
- to satisfy specific legislative requirements; or
- due to someone exercising statutory powers that enable him or her to receive such information.
Occupational health records should be stored in a secure system and the confidential information should only be accessible by staff within the occupational health department.
An employee can make a data subject access request (DSAR) in order to obtain personal data held about them by their employer under s.7 of the DPA, which can include data relating to their health or medical records. However, an employer will not be required to disclose such data in response to a DSAR if disclosure would be likely to cause serious harm to the physical or mental health of the employee or any other person.
Retention of records
Occupational health records may be crucial in legal proceedings, which can take place years after the employee has left the company. Health and safety legislation emphasises the importance of retaining OH records for as long as possible, with the transferable information being kept for a minimum of 40 years after the date of the last entry, or longer if required by law. There are, for example, specific requirements under the Control of Asbestos at Work Regulations 1987 and the Control of Substances Hazardous to Health Regulations 1988.
Access to Medical Reports Act
An employer may wish to obtain a medical report in respect of an employee or prospective employee for a variety of purposes, including a general pre-employment check, as a prerequisite to membership of any benefit schemes, in the context of absence management, or to help determine if there are any reasonable adjustments that might help a disabled employee to do their job or avoid workplace disadvantages.
If OH needs to get a report from an employee’s GP or specialist, it is necessary to get the consent of the employee. The Access to Medical Reports Act 1988 (AMRA) provides individuals in some circumstances with a right to see a copy of a medical report produced in connection with employment or insurance purposes, as well as a right to prevent its disclosure to the employer or insurer.
AMRA sets out procedural safeguards to protect the employee:
- The employer must give the employee a statement of their rights.
- The employee must provide written consent to the examination and preparation of the report.
- The employee must have the opportunity to see the report before the employer.
- The employee may request changes to the report but may not insist on them.
- The employee may refuse to allow the report to be disclosed to the employer.
Sign up to our weekly round-up of HR news and guidance
Receive the Personnel Today Direct e-newsletter every Wednesday
Employers should ensure that any request for a medical report is focused and limited to that directly relevant to the particular purposes for which it is obtained. Overly intrusive questioning or requests for irrelevant information run the risk of breaching the employee’s right to privacy or the DPA or being discriminatory under the Equality Act 2010.
Jonathan Exten-Wright is a partner in the employment, pensions and benefits team at DLA Piper
