Workers' health information and data protection law

You need to know that your employees are in good health. You would like them to be happy, no doubt. So what health information can you collect and what can you use it for while still respecting their right to privacy?

It seems straightforward enough to ask job candidates to fill in a health questionnaire. But do you really need to know these very personal details? They are regarded as sensitive information under the Data Protection Act (DPA). Do you make sure the health details you collect are transmitted and stored securely? If not, the workers concerned have the right to compensation.

Needs must

The Information Commissioner's latest guidance, the DPA Employment Practices Code, covers the thorny issue of workers' health details in depth. A special small business guide is also available.

The words of warning are that

• Collect and hold workers' health details only if it brings real business benefits - and be absolutely clear what they are (see below).
• Gather only the information you need, eg information in a medical report on a sick employee should be limited to information required to establish fitness to work.
• Make it clear to the person why you want these details.
• Ask for the person's consent, which must be freely given - a blanket consent given by a worker at the beginning of employment is not always sufficient. If applying for a report from a worker's GP, get the worker's specific consent to your application.
• Use the data only for the purpose given to the person.
• Make the person aware that they have right of access to their details which you hold.
• Ensure the data is transmitted and stored securely, usually separately from other personnel records.
• Ensure personnel authorising collection of, or handling, the data are authorised to do so by the business, and aware of Data Protection rules, including the fact that interpretation of medical information should only be carried out by a suitably qualified health professional.
• Make sure managers only have access to health information the extent necessary to carry out their management responsibilities, and the information given to them should be limited to those details necessary to establish fitness to work.
• Keep the details only for as long as you need them.

There are special rules for workers in occupational health schemes. Particularly, workers giving information to health professionals under the scheme are entitled to confidentiality. This means that, for example, if you monitor workers' email or telephone conversations, it should be made clear that they should not use work email or telephone to contact the service. You may wish to give them access to an alternative, unmonitored email system or telephone line. Take advice.

Solid reasons

Employers must have good reason to ask for health details and the details requested should relate to the worker's job and the work environment. Main reasons would be health and safety at work, to satisfy other legal obligations (eg suitability to join an occupational pension or health insurance scheme), and for the employer to avoid liability for unfair dismissal under discrimination law. For example, under the Disability Discrimination Act, the employer can fall foul of discrimination claims if he does not know that the worker is disabled and therefore fails to consider 'reasonable adjustments' that ensure the disabled applicant is on an equal footing with other applicants.

Be discreet

The means of gathering the information should be as non-intrusive as possible. For example, information should only be collected at the stage when there is a good chance of an applicant being offered a job; and a health questionnaire is less intrusive than a medical test.

Information and testing

Unless you are collecting information as part of an occupational health and safety programme that the workers have volunteered for, information asked for, or any medical test, should be limited to that required to:

• Establish the worker is fit to carry out the job.
• Avoid significant risks to the health and safety of other workers.
• Decide whether a worker is fit to return to work after being off sick, or entitled to sick pay (or other health-related benefits).
• Stop discrimination or decide whether there is a need to make 'reasonable adjustments'.

Only a very physically demanding job or a particular work situation should require a medical test. Alcohol or drug testing would have to be warranted by extreme circumstances. And you would also consider following up with a disciplinary process.

Information collected for one purpose cannot be used for another purpose without the worker's consent.

Keeping records

Whatever the information you collect, or testing you carry out, keep a record of the business purpose justifying the testing, and write down:

• Who will be tested.
• What they will be tested for.
• How often.
• What will happen as a result of the testing, whether results are positive or negative.

Any information that is obtained that is not relevant to the purpose for which information is being gathered, or testing carried out, must be permanently deleted, whether it is irrelevant a the time, or becomes irrelevant subsequently. Health information should therefore be periodically reviewed.

If in doubt, take legal advice.