How Can You Ask for Your Employees’ Medical Records Under Gdpr

By Vicki Field, HR Director, and Daniel Fenton, Clinical Director, at Private London GP, London Doctors Clinic.

It’s essential to have a medical report for an employee if you’re considering dismissing for capability reasons or looking at whether an employee has any medical issues which may constitute a disability, and as a result require reasonable adjustments at work.

Medical reports can be obtained from a doctor, or from Occupational Health, but clearly, it’s a very sensitive piece of information so how can an employer lawfully access these reports?

GDPR provides more protections for data, and in particular, sensitive data. Obtaining a report amounts to processing personal data under the GDPR, and according to the regulations, there must be lawful grounds for processing the information.

So what constitutes lawful grounds?

Article 6(1) identifies six lawful grounds for processing personal data:

• Consent
• Contract
• Legal obligation
• Vital interests
• Public interest task
• Legitimate interests

Consent may be the lawful ground to depend upon when asking an employee to allow access to a medical report. Consent requires a positive opt-in, which means that the employee cannot be sent a pre-ticked form presuming consent. Obviously, you can’t force an employee to see a doctor, so regardless of the GDPR, obtaining consent is key!

Generally, a doctor would provide a report to the patient and this is only released to employers with explicit consent. It is key to note that patients are in control of all and any information that is released to an employer, and they have the right to review and ask for changes before it is submitted to an employer.

So, consent is key – both to see a doctor, and then for the doctor to release the report. Even then it gets more complicated for “special categories”, as the employer has to have a valid reason for processing the data, and also has to satisfy an additional condition under Article 9.

What is Article 9?

The GDPR accepts that not all data is the same, and so gives extra protection to ‘special categories’ which are generally those categories which could be used to discriminate unlawfully against an employee. As a result, the employer needs to give a specific reason for processing the data. In GDPR terms, one given reason may be that “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment”.

In more simple terms, it can be justified by stating that it meets the employer’s legal obligations not to unfairly dismiss, not to discriminate against a disabled employee, to identify reasonable adjustments where applicable and to ensure they are fit to return to work.

Using a pre-employment questionnaire to determine whether or not to employ someone would contravene the Equality Act 2010 as well as GDPR as it is discriminatory and there is, therefore, no valid reason to process the data. The pre-employment questionnaire can be used to identify any potential issues, and allow the doctor to suggest reasonable adjustments and this is a valid reason for processing the data under GDPR.

Confused yet?

Let’s simplify: you need to identify the reason for processing the data (i.e. consent to acquire a medical report), and you also need to be able to demonstrate that there is a requirement to process the data (i.e. use the data in the medical report to ensure that you are not discriminating against a disabled employee).

What information can be requested?

The GDPR holds various principles which the medical report needs to align to, including Data Minimisation. Again, breaking this down, it means that the information is:

• adequate – sufficient to properly fulfil your stated purpose;
• relevant – has a rational link to that purpose; and
• limited to what is necessary – you do not hold more than you need for that purpose

Therefore, a medical report should contain only the information required for the employer to fulfil their legal responsibilities. If the employee has any health condition, the employer may only need to know:

1. Whether it constitutes a disability,
2. Will it impact the ability to perform a defined role

• If reasonable adjustments at work need to be made.

For example, details of a chest infection at the time of assessment would be irrelevant to undertaking an office-based role. However, it would be reasonable to disclose information about a chronic back pain, such that an adequate chair and desk assessment can be made before commencing the role. However, not all of this information would necessarily be provided to the employer if it was not relevant.

So what does an HR team need to do?

HR is responsible for ensuring that the medical report is necessary, that the questions asked (and answered) in the medical report are relevant, and being aware that the employee needs to give consent to the medical report. HR also needs to track and monitor the justification for the processing the data.

By Vicki Field, HR Director, and Daniel Fenton, Clinical Director, at Private London GP, London Doctors Clinic.

It’s essential to have a medical report for an employee if you’re considering dismissing for capability reasons or looking at whether an employee has any medical issues which may constitute a disability, and as a result require reasonable adjustments at work.

Medical reports can be obtained from a doctor, or from Occupational Health, but clearly, it’s a very sensitive piece of information so how can an employer lawfully access these reports?

GDPR provides more protections for data, and in particular, sensitive data. Obtaining a report amounts to processing personal data under the GDPR, and according to the regulations, there must be lawful grounds for processing the information.

So what constitutes lawful grounds?

Article 6(1) identifies six lawful grounds for processing personal data:

• Consent
• Contract
• Legal obligation
• Vital interests
• Public interest task
• Legitimate interests

Consent may be the lawful ground to depend upon when asking an employee to allow access to a medical report. Consent requires a positive opt-in, which means that the employee cannot be sent a pre-ticked form presuming consent. Obviously, you can’t force an employee to see a doctor, so regardless of the GDPR, obtaining consent is key!

Generally, a doctor would provide a report to the patient and this is only released to employers with explicit consent. It is key to note that patients are in control of all and any information that is released to an employer, and they have the right to review and ask for changes before it is submitted to an employer.

So, consent is key – both to see a doctor, and then for the doctor to release the report. Even then it gets more complicated for “special categories”, as the employer has to have a valid reason for processing the data, and also has to satisfy an additional condition under Article 9.

What is Article 9?

The GDPR accepts that not all data is the same, and so gives extra protection to ‘special categories’ which are generally those categories which could be used to discriminate unlawfully against an employee. As a result, the employer needs to give a specific reason for processing the data. In GDPR terms, one given reason may be that “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment”.

In more simple terms, it can be justified by stating that it meets the employer’s legal obligations not to unfairly dismiss, not to discriminate against a disabled employee, to identify reasonable adjustments where applicable and to ensure they are fit to return to work.

Using a pre-employment questionnaire to determine whether or not to employ someone would contravene the Equality Act 2010 as well as GDPR as it is discriminatory and there is, therefore, no valid reason to process the data. The pre-employment questionnaire can be used to identify any potential issues, and allow the doctor to suggest reasonable adjustments and this is a valid reason for processing the data under GDPR.

Confused yet?

Let’s simplify: you need to identify the reason for processing the data (i.e. consent to acquire a medical report), and you also need to be able to demonstrate that there is a requirement to process the data (i.e. use the data in the medical report to ensure that you are not discriminating against a disabled employee).

What information can be requested?

The GDPR holds various principles which the medical report needs to align to, including Data Minimisation. Again, breaking this down, it means that the information is:

• adequate – sufficient to properly fulfil your stated purpose;
• relevant – has a rational link to that purpose; and
• limited to what is necessary – you do not hold more than you need for that purpose

Therefore, a medical report should contain only the information required for the employer to fulfil their legal responsibilities. If the employee has any health condition, the employer may only need to know:

1. Whether it constitutes a disability,
2. Will it impact the ability to perform a defined role

• If reasonable adjustments at work need to be made.

For example, details of a chest infection at the time of assessment would be irrelevant to undertaking an office-based role. However, it would be reasonable to disclose information about a chronic back pain, such that an adequate chair and desk assessment can be made before commencing the role. However, not all of this information would necessarily be provided to the employer if it was not relevant.

So what does an HR team need to do?

HR is responsible for ensuring that the medical report is necessary, that the questions asked (and answered) in the medical report are relevant, and being aware that the employee needs to give consent to the medical report. HR also needs to track and monitor the justification for the processing the data.