Employee consent and health information: Who needs to know?


Occupational health adviser Lorraine Warren looks at the sometimes difficult issue of when to divulge patient information.

Consent is a fundamental part of any interaction between the occupational health (OH) adviser and an employee. It is important that the consent process is appropriately carried out and correctly recorded. In the OH setting, the OH adviser may have a number of roles pertinent to the consent process, including access to medical records from GPs and consent to send a report to management.

The issue of employee consent to disclosure of health information will increasingly impinge more directly on OH practice. This review of the literature related to consent in OH discusses the relevant law as well as the values and opinions of OH practitioners, and asks whether OH practice needs to change to be in the best interests of the employee.

An online survey tool was used to analyse the opinions of external OH advisers (67 respondents) around the issue of disclosing a worker’s health conditions. Results indicated that 94% felt that some level of disclosure of an employee’s health condition is useful when writing a report to management.

A vast amount of writing and legal guidance is relevant to confidentiality, consent and disclosure. This article concentrates on two areas.

The first is a selective review of literature relating to confidentiality, consent and disclosure, which explores the rationale and requirement for obtaining informed consent from an employee by the OH adviser. This is concerned with the release of health details by the OH adviser to management and HR where an opinion on fitness for work is requested and an OH report required. The second focus is to comment on current views, as expressed in seminal texts from OH and employment law literature.

Defining confidentiality, consent and disclosure

It is important to clarify what is meant by confidentiality, consent and disclosure, as the terms encompass many concepts. The aim of this review is not to contest views on disclosure to management and HR, controversial as this issue may be. It is to establish the principle that if any justification for disclosure does exist, it is limited to specific cases where there is a need to know and only with the informed consent of the employee.

The Nursing and Midwifery Council (NMC) code states that a nurse must respect people’s rights to confidentiality and that information must not be disclosed about a person without their consent. Protecting patient confidentiality is a key factor in obtaining and retaining trust, protecting the patient and maintaining professionalism at all times. The principle of confidentiality is founded in the patient’s right to privacy and the preservation of the nurse-patient relationship (NMC, 2008).

Concerns over conflict of interest for OH

It is accepted that OH professionals have to perform a constant balancing act in respect of their duty to both the employee and their employer. Thornbory (2008) points out that confidentiality is the most frequent topic of concern among OH advisers who contact the Royal College of Nursing (RCN).

In 2005, the RCN produced a document – Confidentiality – for OH advisers, recognising the need to work in collaboration with both the employer and the employee. This guidance is useful as it recognises the challenges faced by OH advisers when dealing with confidential information, and the potential for conflict of interest due to the OH adviser’s allegiance to the employee and loyalty to the employer. It also recognises the complex practice-based ethical decisions faced regularly by the OH adviser.

An appreciation of ethics and the ability to engage in ethical analysis are essential when the OH adviser is faced with the question: is the legal disclosure of confidential information morally permissible if it will help others?

HR demands for more information

Empirical knowledge suggests that managers and HR prefer more detailed health information when managing an employee, irrespective of OH advisers’ duty of confidentiality and the potential for professional misconduct. Thornbory (2012) argues that not all HR professionals appreciate that the OH adviser has a duty of confidentiality or that a breach of confidence risks the loss of their licence to practice. Everton (2012) states that OH reports are a good example of where HR believes that they have the right to view employee medical information.

Advising managers and HR on employees’ fitness for work is essential to a productive collaboration between the business and the OH department. However, Harper (2013) points out that OH communication to management can reveal both a lack of clarity and that the OH professional is not adequately addressing questions raised by the manager. Everton agrees that the OH report is an integral element of OH practice, but it is not always well executed.

Furthermore, Lewis and Thornbory (2010) propose that confidentiality issues can affect stakeholder satisfaction with the effectiveness of the OH department. In a peer review qualitative study in 2012, Lalloo, Ghafur and MacDonald studied 215 OH reports over a three-month period. This study identified that one-third of the reports did not respond to the referral questions being asked by management and had vague content and uncertain review arrangements.

Lewis and Thornbory state that it is not uncommon for the OH adviser to encounter disputes between the employer and the employee and their representative. Harper agrees that conflict with management and HR arises over what can and cannot be divulged about employees and causes unnecessary stress for the OH adviser.

Confusion over who can access information

HR professionals have a code of practice through their professional body, the CIPD, where members must respect confidentiality. However, Thornbory suggests that HR may wrongfully interpret this code as allowing them the right to access the employee’s confidential information, defined as “sensitive information” in the Data Protection Act. In 2012, an article for CIPD members – “Protecting confidentiality in occupational health services: understanding consent and keeping records safe” (Iley, 2012) – explains the law and guidance relating to confidentiality for an OH department. It is, however, important to note that the scope of this is limited, because not all HR professionals are members of the CIPD.

Traditionally, OH advisers have been concerned with the maintenance and promotion of confidentiality and the NMC code of conduct, and interpreted this as requiring that the OH report should not disclose any medical details of an employee’s health condition or their treatment, even if the employee has consented. Thornbory refutes this, stating that OH professionals sometimes believe wrongly that no one has a right to the information, even with the employee’s consent. Everton concurs that advice given to the employer will not normally refer to any clinical details, as a resolution may normally be achieved with the employer not knowing these.

Troubled relationships

Tehrani (2006) attempted to explore the relationship between OH and HR through a qualitative study. She controversially states that, despite numerous claims by the OH profession that disclosure of health information to HR does not happen, there is evidence from her study to support that OH advisers are happy to provide the most complex information on medical procedures, when what is really needed is information to help manage a return to work. Tehrani’s article indicates that OH advisers may be breaching patient confidentiality, as she does not state if the OH advisers sought informed consent.

Ballard and Kloss (2012) point out there is an ongoing debate relating to whether or not information given to an OH professional is deemed in legal terms to be “constructive knowledge” by the business – implying that an employer is presumed by law to have knowledge of the information, regardless of whether or not they actually do – despite OH professionals upholding their duty of confidentiality.

Harper refers to recent case law where an OH department had knowledge of an employee’s confidential condition and did not disclose it to HR or line managers despite the employee giving consent, resulting in penalties for the employer. In other words, if an OH adviser has knowledge of an employee’s confidential medical condition, this can be taken as constructive knowledge by the employer.

Relevant information

Ballard and Kloss (2012) recognise that there is increasing pressure on OH professionals to disclose health details because of employment tribunal decisions that show a readiness to assume an employer had knowledge of an employee’s disability (Harper, 2013). This may result in increasing pressure on a business to understand an employee’s health condition.

It is important to take into account that an OH adviser’s cooperation with others does not mean breaching confidentiality, and that a way forward must be found that is suitable for all involved (Thornbory, 2008). This does not mean that all clinical details are disclosed in the OH report to management and HR. Everton argues that the OH adviser should respond only to questions raised by management or HR, in order for them to make adjustments, but that the OH adviser is not required to reveal health or medical details without patient consent or where it is not needed.

It is important also that the information disclosed is relevant to both the purpose for which it is intended and to those who have a genuine need to know (RCN, 2005; Harper, 2013). Thornbory and Lewis, and Harper, advocate that the employee can also make the disclosure him or herself, and there are occasions when the employee should be encouraged to do so if it is the best way to resolve an issue between the employee and their manager. In addition, the OH adviser will establish from management and HR what they already know about an employee.

Seven situations where disclosure of confidential information is justified

  1. With the consent of the client.
  2. If disclosure is clearly in the patient’s interest, but it is not possible to or it is undesirable to seek consent.
  3. If it is required by law.
  4. If it is unequivocally in the public interest.
  5. If it is necessary to safeguard national security or to prevent a serious crime.
  6. If it will prevent a serious risk to public health.
  7. In certain circumstances for the purposes of medical research.

Source: Royal College of Nursing.

Legal and ethical duty

The OH adviser has a legal and ethical duty to maintain confidentiality of health information given to them, and must preserve trust and confidence between the individual and the OH adviser within the organisation. Consequently, there are ethical issues relating to confidentiality and consent that the OH adviser must consider before disclosing an employee’s health information to the employer. Thornbory and Harper point out that disclosure is ethical and lawful if the person has given consent and the information being passed on has been freely and fully given. Lewis and Thornbory agree that the OH adviser must ensure that any form of disclosure is possible by working within established ethical, professional and legal standards.

The RCN guidance identifies seven situations where confidential information may lawfully be disclosed. These seven situations are quoted as generally reflecting those described in the General Medical Council (GMC) guidance Confidentiality, protecting and providing information published in 2000 and the NMC code of conduct. Guidance from both the NMC and GMC has been updated since the RCN guidance. However, the principles of the document remain applicable.

Howard (2005) considers that failure in this ethical duty may deter individuals from being open and honest when seeking support from the OH department, particularly if they feel there is a lack of confidentiality or where there may be a tendency to disclose information to management. It is essential that employees understand their right to expect confidentiality from an OH professional and that, ultimately, disclosure in this context is their decision.

Discussing consent

The most common way for health information to be disclosed by the OH adviser to the business is by informed consent. The OH adviser must decide the information that should be disclosed and then discuss their choices with the employee. In accordance with s.2 of the Data Protection Act 1998, Howard cites that consent must be freely given. The OH adviser must ensure that the employee understands that they have a choice to consent or not, and that there will be no resulting consequent judgment or punishment if consent is withheld. Harper expands upon this point, emphasising that consent should be discussed “without coercion”.

In these circumstances, Harper advocates that, where possible, workers should sign a suitable “consent for disclosure” statement and that the OH department should have a suitable form to accommodate this. However, this should not obscure the important fact that the form itself is not the “consent”. The explanation given by the OH adviser and the dialogue with the employee about the proposed disclosure are the significant elements of the consent process. The consent-for-disclosure form is simply evidentiary, written confirmation that explanations were given and the employee agreed to what was proposed.

Consent form

Lewis and Thornbory propose that a template form is used when obtaining consent and where disclosure is advised; Thornbory reiterates this in her 2012 publication. Despite much of the literature advising that consent must be obtained, Lewis and Thornbory are the only authors to suggest a format for a form. Harper proposes that the form must request the health information that the employee “does not wish” to be disclosed to management. In contrast, Lewis and Thornbory suggest that the form asks the employee to provide details of their medical condition that “they wish” to disclose.

There are, however, cases where the employee will be unable to sign the form – for example, where telephone case management has been undertaken. Harper suggests that verbal consent is obtained in these cases, as long as it is also documented contemporaneously in the employee’s health record.

The stance of much of the literature on consent and disclosure is shifting OH to a new way of reporting to a business. Certainly, there is no shortage of disagreement within the legal profession on the issue. This discussion begs the question: if the employee gives informed consent, why does the OH adviser struggle with disclosing health information?


Ballard J, Kloss D (2008). “Discrimination law and occupational health practice”. The At Work Partnership Ltd, London.

Everton S (2012). “A guide to report writing”. The Association of Occupational Health Nurse Practitioners (UK).

Harper P (2013). “Essential legal skills for occupational health professionals”. London: Legal Experience Training.

Howard G (2005). “In confidence”. Occupational Health; vol.57, issue 6, pp.17-20.

Iley S (2012). “Protecting confidentiality in occupational health services: understanding consent and keeping records safe”. London: CIPD.

Lalloo D, Ghafur I, MacDonald EB (2012). “Audit or assessment tools for occupational health letters or reports”. Occupational Medicine; vol.62, issue 6, pp.469-470.

Lewis J, Thornbory G (2010). “Employment law and occupational health: a practical handbook”. 2nd ed. Oxford: Wiley-Blackwell.

Nursing and Midwifery Council (2008). “The code – standards of conduct, performance and ethics for nurses and midwives”. London.

Royal College of Nursing (2005). “Confidentiality – RCN guidance for occupational health nurses” (2nd ed). London.

Tehrani N (2006). The occupational health and human resources partnership: On different planets? Personnel Today.

Thornbory G (2008). Confidentiality and occupational health: Your secret’s safe with OH. Personnel Today.

Thornbory G (2012). “A guide to confidentiality”. The Association of Occupational Health Nurse Practitioners.

Lorraine Warren is senior occupational health adviser at Occupational Health, Airbus Defence and Space.


About Lorraine Warren

Lorraine Warren is senior occupational health adviser at Airbus Defence and Space.
Comments are closed.