Employers’ obligations surrounding storage of information around staff medical condition

Information about a medical condition may be collected through a number of means, including, sickness absence records, reports from the employee’s practitioner, accident at work reports, or through direct disclosure by the employee at the outset of or during employment.

It need hardly be said that disclosure of an employee’s medical condition within or outside the organisation, whether deliberate or not, could cause enormous distress and embarrassment and jeopardise an employee’s prospects for promotion or employment elsewhere. This can be particularly the case where information concerning mental issues are disclosed, due to the prejudice that remains associated with these conditions.

An employee suffering from mental health issues may well be protected under the Equality Act 2010. If an employer was to refuse to employ or promote a person because it knew he or she suffered from a mental health condition then it could find itself liable to pay substantial compensation for direct disability discrimination.

Aside from protection from discrimination, an employee has a right to privacy in relation to any medical information about themselves and there are statutory obligations upon employers as to how they handle and store what can clearly be very personal and sensitive information about their employees.

Medical information about an employee is “sensitive personal data” under the Data Protection Act 1998 (DPA), and employers have a responsibility to ensure such data is collected and used in accordance the DPA’s requirements.

An employer can only disclose information about an employee’s illness or medical condition in certain limited circumstances, such as where:

• the employee has given their explicit consent;
• it is necessary to exercise or perform any legal obligation imposed on the employer in connection with the employment;  or
• it is necessary in connection with legal proceedings or to obtain legal advice.

Where an employer is considering collecting information about an employee’s health or medical condition, it should always consider why it wants that information and whether it is proportionate and justified to collect the information for that purpose.

For example, it may be reasonable to make enquiries to establish whether an employee is able to carry out a particular job, where it is necessary to determine eligibility for cover under an insurance scheme, or to determine if reasonable adjustments need to be made to assist an employee in carrying out their role.

Find out how aggrieved employees can claim compensation for damage or distress

Share this story