Confidentiality at work

[KnackeredCow]

Looking for some advice from those with HR expertise, please.

I recently had 14 days off work for gynae surgery, which was quite distressing. My sick cert was written immediately post-surgery so I could take it home with me later same day. Although I was scheduled for a one-hour procedure, including anaesthetic, I was only scheduled to be a day case. The surgery did take two hours and there were post-operative complications.

Post surgery, I developed acute urinary retention (bladder didn't work), which isn't uncommon, apparently. I was admitted to hospital to be catheterised (sorry TMI) until it resolved. Then discharged but developed a surgical site infection, which ended up in readmission. DH is a GP and at end of two weeks, told me to go back to see GP and have sick cert. extended because I was still exhausted and in quite a bit of pain. I decided (against his better judgment) to go back to work, but because I was still taking codeine for the pain and discomfort, asked my boss if I could have a phased return, and work the first two days back from home on reduced hours. The codeine made me too drowsy to drive. I thought it was better to return and do a bit of work than none. He agreed.

So far, so good. Should have gone back on a Thursday, but did Thursday and Friday (5 hours a day) from home, and physically returned to my desk on the Monday when I was off the pain killers. I did six hours a day until the following Thursday, when I was advised to take flexi-time if I wanted to work reduced hours. No problem there. I thought that was fair.

However, I am a departmental manager, and today I received my department's sick records for April to end October from our Finance Manager. As well as detailing sick for everybody in the department, she stated reasons. The data is also shared with the Board of Trustees (I work for a charity).

I'm really upset about this. Although I do return to work interviews for my staff, I give their self / doctor's certs to our HR representative in the belief they are confidential. I thought that the Finance manager should only get to know whether the self / doctor's cert. has been completed, but shouldn't be privy to the reasons for absence. Perhaps I am wrong. When I received today's report, I was listed as having 10 days' certified sick for gynae surgery (I didn't want her to know) and then two days without any sort of certification (although I agreed 2 days' on reduced hours with my boss) for post-operative complications. I feel quite emotional about the surgery I've had, and I'm pretty shocked to find that the reason for my absence has been shared with the Finance Manager (same grade as me) and has been reported back. I'm also really angry that she's assumed that because I couldn't come in to the office on the Thursday and Friday after my sick cert expired that I was absent without authorisation.

However, (sorry for being so long-winded) does she have a right to know why I was off in this level of detail? I thought it would be confidential. I'm also really upset to find that the report goes to the Board. Obviously, I fully understand and appreciate that they have to receive data and statistics on staff absence, but do they really need more than a broad reason (eg medical / special leave etc) and confirmation that a member of staff has either self-certified or been certified. Do the other senior managers (on the same grade as me) and the Board of Trustees really need to know exactly why I've been off when I have NOT consented for this information to be shared?

Gosh - sorry for the essay. Just really very upset at the moment (perhaps unfairly?)

You need to speak to your boss and say that you are unhappy with the amount of personal information being shared and the inaccuracy in the recording of the information regarding your phased return. Give him the examples you've described here.

Keep it factual, unemotional (hard I know when you're feeling vulnerable) and ask what will be done to resolve the issue. If you think you may be unable to keep it together send a brief email.

You have the right to have your information kept confidential under the terms of the Data Protection Act 1998 and medical records count as sensitive personal data so are subject to additional restrictions. There is a specific code produced by the Information Commissioner's Office that is for employers. It can be downloaded from here: www.ico.gov.uk/for_organisations/data_protection/topic_guides/employment.aspx but the bit you want specifically is Part 4 of the code.

I suspect it is a case of someone somewhere not thinking this through properly and that once you bring it to your manager's attention it will be fixed quite quickly. Certainly I can see no reason why the Finance Manager or even the Board need to know the specifics of every single person's sickness record. That's why you often find when filling out sick forms/online records there's a code to be ticked/entered. This allows the easy sorting of information for legitimate organisational management purposes (eg they might need to know if an absence is pregnancy related so it can be disregarded for redundancy or appraisal purposes or want to know how many working days are lost to minor ailments or how many are lost for back problems so they can assess how well absence management or health and safety procedures are working).

You may want to copy in the person who is the Data Controller for your organisation as they have responsibility for ensure all data is handled in accordance with the Act.

I would be upset too.

Thank you for really thorough advice. I'll have a chat with my boss today. I suspect you are right about somebody not thinking it through and hopefully they can put it right now.

I agree with KM in that this is probably just a lapse in joined-up thinking, but you may not be able to stop it happening. Data can be shared for genuine business reasons. many of which could apply in this instance.

EG If the Finance Manager is responsible for payroll and SSP and if contractually they are able to withhold full pay when no GP note is provided, then the Finance mgr would have a right to much of the the information. He may also be expected to monitor such data as part of regular management information reporting packs. I have often worked in organisations where such information is collated. If, for example, a Finance manager provides a monthly report on the business which includes an analysis of absence due to accidents at work, or stress (or any criteria relevant to the industry) then it could make sense for him to collect the raw data rather than ask the HR person to forward a summary.

Likewise, as a trustee myself, we ask for information on absence amongst staff (although in our case we get it anonymised) - we need that info to make sure we are fulfilling our own obligations as trustees. In practice we use the info to ask if Occ Health need to be involved in cases, and to monitor levels of sick leave in general, and sick leave due to stress. Spikes in leave where more than one or two people are out at the same time are often the first indicator that we have management problems in departments (the correllation can be quite striking) - we need the detailed reasons of absence so we can strip out the 'broken legs' from the data in order to spot such spikes.

Best practice is of course to stick to the bare minimum and have everything anonymous by the time it leaves HR, so you should have a word, but to pass such info upwards (or sideways) for genuine business purposes is not in itself necessarily a breach of confidentiality (although having that person then pass it on or discuss it could be)

The specific reasons for an individual's absence shouldn't be shared. Each absence can easily be categorised into broad groups, eg colds/cough/flu or pregnancy related.

I recently left the MOD, and our sick recording had 17 very broad groupings covering all forms of sickness, and as the line manager had to enter it online initially, there was even a group for "not known" and the employee would have to update the sick report on return.

The Op's gynae surgery would never have been specifically mentioned in any report.

This is shocking. I'm still in MOD and, as said above, we have general categories.
I've just had 4 weeks off with pneumonia and gave sick notes to LM but I would be well within my right to just send to our centralised HR people and tick "colds & flu" box on the bit LM sees.
Only HR has a right to the detail. LM can if you agree. Finance (my department) have no right what so ever.

Where I work we do most of our work under a Local Authority Contract. In the swne flu days we were required to send them the names of staff who were off sick and the reasons, as they were doing some monitoring comparing swine flu sickness rates with ordinary sick leave. I contacted teh Data Protection agency as I felt this was wrong, and they confirmed that this information was confidential and should only be ashred on a need to know basis. Hope this helps