Ruth Carey, Barrister & Solicitor Executive Director, HIV & AIDS Legal Clinic (Ontario)

Privacy Rights & HIV Disclosure in the WorkplaceAIDS Committee of Durham “Social Determinants of Health” Conference 2005 Ruth Carey, Barrister & Solicitor Executive Director, HIV & AIDS Legal Clinic (Ontario) April 27, 2005

Agenda • Introduction • The Importance of Protecting Privacy in the Context of work for PHAs • Privacy Legislation & Employment - Who’s Covered by What? • Workers’ rights under the federal Personal Information and Protection of Electronic Documents Act • Workers’ rights under the provincial Personal Health Information Protection Act • Common Issues with Disclosure & HIV at Work • HIV as a Barrier to Employment • Job Applications • Insurance Forms at Work • Requesting Accommodation

Introduction “Unemployment, underemployment and stressful work are associated with poorer health. People who have more control over their work circumstances…are often healthier and live longer than those in more stressful…work.” - OACHA, “A Proposed HIV/AIDS Strategy for Ontario to 2008”

Introduction “...there is often stigma associated with having any disease, particularly a life-threatening, communicable disease. Since HIV infection is often associated with particular sexual and drug-related activities, stigmatization of PHAs is common. Disclosure can expose PHAs directly or indirectly to discrimination or rejection by family, friends and community.”

Introduction “A recent survey in Canada found that a quarter of the respondents had a low level of comfort in associating with people with HIV/AIDS and that forty percent had only a moderate level of comfort…”

Introduction “...Almost half of the respondents said that people with HIV/AIDS should not be allowed to serve the public as, for example, dentists or cooks…”

Introduction “...And while over three-quarters of respondents do not believe that people infected with HIV through sex or drug use have gotten what they deserve, one in ten Canadians still hold this view.” – EKOS Research Associates, HIV/AIDS – An Attitudinal Survey

Introduction The EKOS attitudinal study involved 2004 interviews with Canadians over 15 years old across the country. It is available on-line at: http://www.phac-aspc.gc.ca/aids-sida/hiv_aids/attitudinal_survey/

Introduction • So if we want healthy PHAs to stay healthy, they need access to employment. • And they need employment that feels safe. • Given public attitudes and stigma towards HIV, it is important that PHAs be able to control knowledge of their HIV status within their workplace.

Privacy Legislation & Employment - Who’s Covered by What? Quiz Question # 1: The federal privacy legislation prevents disclosure of an employee’s HIV status by the employer without consent in which of the following jobs? • Bank teller • Bell employee • Nurse in a hospital • All of the above

Privacy Legislation & Employment - Who’s Covered by What? • The federal privacy legislation, the Personal Information Protection and Electronic Documents Act [“PIPEDA”], only applies to employee information where the employer is a federally regulated business.

PIPEDA • This continued to be true even after January 2004 when PIPEDA was extended to regulate provincial businesses in provinces that do not have substantially similar legislation. • Employee records in provincially regulated industries are not covered by PIPEDA.

Examples of federally regulated industries covered by PIPEDA include: Telecommunications and Broadcasting Interprovincial or international trucking, shipping, railways, or other transportation Aviation Banking Nuclear energy Activities related to maritime navigation and shipping Businesses in Yukon, Nunavut, and the Territories (where all private sector activity is in federal jurisdiction), and Federal Crown corporations bound by order under the Act. PIPEDA

PIPEDA • So let’s say you’re an inter-provincial truck driver, which means you’re covered by PIPEDA... • What rights do you have with respect to your information?

PIPEDA • Like most legislation dealing with this topic, PIPEDA isn’t just about disclosure and privacy. It’s also about: • limits on collection of information • the storage of information • the use of your information • correction of errors • your rights of access, and • the destruction of your records

PIPEDA Quiz Question # 2: The trucking company you work for requires employees applying for LTD to send their application for LTD, including medical information, directly to the employer for processing rather than to the insurer. Is this contrary to PIPEDA? • Yes, this is contrary to PIPEDA • No, it is not

PIPEDA • Section 5(3) states that an organization may collect personal information only for purposes that a reasonable person would consider appropriate in the circumstances. (See case summary # 226.)

PIPEDA • Quiz Question # 3: When you cannot work because you are sick, the trucking company says you have to fax a doctor’s note to the dispatching office right away, and that the note must state what’s wrong with you. Which is true? • This is okay under PIPEDA • This is not okay under PIPEDA

PIPEDA • In PIPEDA Case # 226 the Privacy Commissioner ruled that: • it is not appropriate for a company to make a practice of receiving employee medical reports by fax, and • any organization that collects medical diagnoses about employees for any purpose must only do so with strict safeguards in place, that is, shared only among qualified medical practitioners

PIPEDA • PIPEDA incorporates 10 privacy principles. • The privacy principles are based on the Canadian Standards Association’s Model Code for the Protection of Personal Information, recognised as a national standard in 1996.

PIPEDA • Principle # 1: Accountability: An organisation is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organisation's compliance with the principles.

PIPEDA • Principle # 2: Identifying Purposes: The purposes for which personal information is collected shall be identified by the organisation at or before the time the information is collected.

PIPEDA • Principle # 3: Consent: The knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except when inappropriate.

PIPEDA • Principle # 4: Limiting Collection: The collection of personal information shall be limited to that which is necessary for the purposes identified by the organisation. Information shall be collected by fair and lawful means.

PIPEDA • Principle # 6: Accuracy: Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used. • Principle # 7: Safeguards: Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.

PIPEDA • Principle # 8: Openness: An organisation shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.

PIPEDA • Principle # 9: Individual Access: Upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

PIPEDA • Principle # 10: Challenging Compliance: An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals for the organisation's compliance.

PIPEDA • Although PIPEDA provides important protections for those employees covered by it, the vast majority of employers are not federally regulated. • This means that for most PHAs, PIPEDA does not apply.

Privacy Legislation & Employment - Who’s Covered by What? • Quiz Question # 4: So I’m a nurse working in a hospital. If PIPEDA doesn’t protect my employee records, there must be a provincial equivalent right? • Yes there is • No there isn’t

PHIPA • Effective November 1, 2004 Ontario has a new piece of privacy legislation: the Personal Health Information Protection Act [“PHIPA”].

PHIPA • Despite its name, PHIPA, is not primarily about protecting the privacy of health information. • Rather it is about regulating how the health industry collects, uses and discloses patients’ health information.

PHIPA • So PHIPA does not apply to employee records except in the unusual circumstance where the employee record in question was created for the purpose of providing health care by a health professional AND...

PHIPA • Quiz Question # 5: So my boss insisted that my doctor send him a letter saying I was unable to work one day last week. My doctor wrote to him directly saying I had been seen in his office that day. He set out my symptoms and explained why they prevented me from working. My boss then called up my father (a friend of his) and discussed my symptoms with my dad, because he was “concerned” about me… • …continued

PHIPA • …so are you saying PHIPA doesn’t apply to this situation? • Sorry PHIPA doesn’t apply here • PHIPA does apply here

PHIPA • There is one provision in PHIPA (s. 49) that applies where the personal health information is provided directly by a health information custodian (like a doctor) to someone who is not a health care provider (like the employer).

PHIPA • The general rule is that a recipient of health information who gets it directly from the doctor, or “health information custodian”, can only use the information for the purpose for which it was collected. If the same letter is provided directly by the employee to the employer, PHIPA does not apply at all.

HIV as a Barrier to Employment • Quiz Question # 6: There is at least one job in Ontario that the law actually states cannot be done by a person with AIDS. Is it a: • surgeon • surgical scrub nurse • paramedic • child care provider, or • nonsense- there is no such job

HIV as a Barrier to Employment • The regulations under the Ambulance Act state that paramedics must “be free from all communicable diseases” as set out in the “Ambulance Service Communicable Disease Standards”, published by the Ministry.

HIV as a Barrier to Employment • “AIDS” is included as a communicable disease that a paramedic is not permitted to have. • As a result, applicants for EMS jobs are routinely asked if they are HIV positive. • No one appears to have challenged this regulation under the Human Rights Code or the Charter of Rights and Freedoms.

HIV as a Barrier to Employment • Quiz Question # 7: So an HIV+ dentist who cuts himself and bleeds into an open wound of a patient has no obligation to disclose? • No, he doesn’t • Yes, he does

HIV as a Barrier to Employment • The barrier to employment as a paramedic is unusual in the health professions in the context of HIV. Being HIV+ is not a barrier to being a nurse, personal care worker, dentist, or doctor for example, and there is no legal obligation for health care workers to inform their employers they are positive.

Ruth Carey, Barrister & Solicitor Executive Director, HIV & AIDS Legal Clinic (Ontario)