What an employer can and cannot see of health data

Why health data has extra protection

Health information is special category data under the UK GDPR, which means the law treats it as more sensitive and gives it extra protection. The Information Commissioner’s Office defines data concerning health as personal data related to the physical or mental health of a person [1].

An employer that handles its people’s health information needs a lawful basis under Article 6 and a separate condition for processing under Article 9 [2]. It must tell people that the information is being collected and why, and must not collect more than it needs for the stated purpose [2].

What an employer can see

An employer can see reporting on how the plan is used across the company, with every figure grouped and anonymised. A useful report shows how many people used the plan, which kinds of service they used, how quickly they were seen and how satisfied they were, by office or region, with no name attached.

Small groups are left out of every report because they can point to a person. The regulator notes that removing names may not be enough when other details remain, and that information can sometimes be linked with other sources to identify someone [3]. It describes generalisation as a way to reduce the risk of people being singled out, because more of them share the same values [4].

In practice that means a team of four in one city never appears as its own line. Its figures join a larger group until no one can be recognised from them.

What an employer cannot see

Through a health plan, an employer cannot see a member’s diagnoses, test results, prescriptions or notes from a consultation. People are entitled to assume that what they tell a doctor, nurse or other health professional will be treated in confidence, and the regulator says that releasing such information to non-medical staff generally needs explicit consent [5].

Even where an employer runs an occupational health service, the regulator expects the health professional to hold the medical detail and to tell the manager only the result of an assessment. It advises employers not to ask people to consent to the disclosure of their entire medical record, and says they are highly unlikely to need it [5].

As far as possible, access to information on medical conditions should be limited to health professionals, and health information can be kept on a separate system [2].

What a member’s doctor shares, and when

A member’s doctor shares nothing with the employer unless the member agrees. Under the Access to Medical Reports Act 1988, an employer may ask a doctor for a medical report about a person for employment purposes only after telling the person and receiving their consent [6].

The person can also ask to see the report before it is sent. In that case the doctor may not supply it until the person has had access, or until 21 days have passed from the application without them arranging access [7].

Within the plan, the doctor works for the member. A member who wants their employer to know something, such as the need for a change at work, decides what is said and to whom.

The paperwork that protects your people

Two documents keep health data where it belongs, a data protection impact assessment and a data processing agreement. The regulator says an employer should carry out an impact assessment given the sensitive and potentially intrusive nature of workers’ health information [2]. Article 35 requires one for processing special category data on a large scale, and the regulator recommends doing one whenever there is doubt [8].

Where a provider processes data on the company’s behalf, Article 28 sets out what the contract must contain. The provider may act only on the company’s documented instructions, must bind its staff to confidentiality, must secure the data, needs written authorisation for any sub-processor, must delete or return the data at the end, and must allow audits [9].

Questions to ask any health provider about data

Your data protection lead can use these in the first conversation.

• Who is the controller of each kind of data, the provider or the company?
• What exactly appears in the reports the company receives?
• How large must a group be before it appears in a report?
• Will the provider sign a data processing agreement that meets Article 28?
• Has the provider completed its own impact assessment, and will it share a summary?
• Where is health data stored, and who on the provider’s side can see it?
• How does a member find out what is held about them and ask for a copy?

What The Wellness for teams does

The Wellness for teams is one membership for the whole firm, its leaders and their families, with inpatient, outpatient and dental care, diagnostics and health programmes in 13 cities and a concierge who arranges everything. Doctors are GMC registered, and care is given through registered partner clinics and accredited laboratories.

The company receives anonymised reporting only, with small groups left out, under a data processing agreement, and one invoice renewed once a year. Leaders can start in one morning and the firm within 10 days.