Ask a Lawyer: COVID-19 Considerations for Occupational Health Nurses: Disclosure of vaccination status (Ontario)

Question 1:

Are there specific privacy and confidentiality considerations an Occupational Health Nurse (OHN) practicing in Ontario should contemplate before disclosing a COVID-19 vaccination status?

Answer 1:

Health-care professionals are very familiar with the professional and ethical obligations that require them to maintain patient confidentiality. An individual’s personal health information (PHI) is also subject to governing privacy law. In Ontario, the Personal Health Information Protection Act (PHIPA) is the health-specific privacy legislation that governs health information custodians’ management of PHI.1

Under PHIPA, PHI includes “identifying information […] that relates to the physical or mental health of the individual” or “the providing of health care to the individual”. As such, as a general rule, a patient’s vaccination status should be kept confidential. There may, however, be exceptions to the duty to maintain confidentiality, for instance where child protection legislation, public health and communicable disease legislation (such as during the COVID-19 pandemic), or other mandatory-reporting legislation requires it.2

OHNs are custodians of PHI under PHIPA. Accordingly, in the workplace, it remains the OHN’s responsibility to safeguard the privacy and confidentiality of the employee’s vaccination status documentation. Some ways to protect this information include:

• Collecting only the necessary information, to the extent possible. For instance, some organizations have found it sufficient to collect only the employee’s name and date of vaccination for each dose.3
• Keeping employee vaccination information separate from personnel files.
• Limiting access to vaccination information only to those with a “need to know”.

It is important that PHI or vaccination information is kept secure and used only for the purpose for which it was collected.4

Question 2:

Can an employer access specific information pertaining to an employee’s vaccination status?

Answer 2:

In most provinces and territories, an employer may collect, use or disclose PHI with the employee’s consent for reasonable purposes. If requiring COVID-19 vaccination as a condition of work, an employer would typically gather specific information regarding vaccination status, which qualifies as the collection of PHI.

If the employer can demonstrate that this information is required for a reasonable purpose, an OHN would be obliged, upon the request of the employer, to release certain health information, but only to the extent required to advise the employer whether the employee is fit, unfit, or fit within limitations, to perform a particular activity. This could for instance apply to working in the office. Many professions have imposed vaccination requirements to mitigate the risks of COVID-19, which would generally qualify as a reasonable purpose. For example, the Government of Ontario has implemented mandatory vaccination policies for high-risk settings such as long-term care homes and healthcare settings, as the risk of transmission is higher in healthcare.5

When an employer asks for confidential health information about an employee beyond what is required to determine their ability to work, a conflict may arise between the obligation to maintain confidentiality and the duty of loyalty to the employer. If this conflict arises, the legal and professional duty to maintain employee confidentiality and to safeguard the personal health information typically prevails.

Question 3:

How can an OHN best address questions from employees or employers regarding the disclosure of a vaccination status? 

Answer 3:

An OHN may be faced with employees who do not agree with the OHN’s decision to disclose the employee’s vaccination status to their employer.

Employers have a duty to provide a safe workplace for all employees, which may include collecting the vaccination status of their employees. OHNs can reassure employees that employers do not have the right to disclose personal health information unless necessary, and that they collect the least amount of information that is necessary for the policy to be effective. Typically, an OHN can tell their employer whether employees have or have not complied with the vaccination policy, without providing the employer with the employee’s personal health information such as proof of vaccination.

Conversely, if faced with a request for access to more employee PHI than what the OHN deems to be necessary, it may be appropriate for the nurse to gently remind the employer of the importance of proper disclosure, and the risks associated with a disclosure that does not respect privacy laws and public health guidelines. In fact, there are a number of possible consequences to the employer in the case of an improper release of personal information or personal health information:

• An employee may commence legal proceedings for negligence, breach of confidentiality or privacy, or defamation.
• A health regulator may institute disciplinary proceedings against regulated health professionals.
• The provincial or territorial privacy commissioner may investigate a complaint.

It would be prudent to become familiar with the applicable legislation and sources of legal, professional and ethical obligations to maintain the confidentiality of PHI at all times. Being equipped with this information could help the OHN be seen as a valuable resource when advising with respect to the extent of PHI disclosure.

The foregoing is an outline of the general principles. Understanding that circumstances can vary significantly with each case, we encourage CNPS beneficiaries to contact CNPS legal counsel for personalized advice if they have any related questions arising in the context of the provision of professional nursing services. 

COVID-19 Considerations for Occupational Health Nurses: vaccination policy 

Question 4:

I have been asked to draft a COVID-19 vaccination policy, where do I start?

Answer 4:

Should an OHN be involved in developing a vaccination policy for staff in their workplace, it is important to be aware that there are certain components that should be included in the policy. Due to the significant privacy risks involved, when creating such a policy, an OHN will want to exercise prudence and care when collecting, sharing, storing or disposing any information about an employee’s vaccination status. If possible or available, an OHN should consider using the support of their privacy officer and/or legal counsel in preparing the policy. The federal, provincial and territorial privacy commissioners also have released statements regarding the privacy implications of vaccine passports that could be applied to vaccine policies. They explain that the necessity, effectiveness, and proportionality of the vaccine passports have to be established for each specific context6:

1. Necessity: the policy must be necessary and evidence-based to achieve the public health purpose, and there is no less privacy-intrusive measure available or as effective;
2. Effectiveness: the policy should achieve its specific purpose from the outset until it is no longer required, or it is not considered “effective”;
3. Proportionality: the privacy risks must be proportionate to the public health purposes the policy will address.7

When drafting the relevant policy, the OHN may wish to consider the following components:

• The purpose of the policy: this might include setting out the risks of COVID-19 and why vaccination is currently one of the best ways to prevent transmission. The purpose should explain why the policy is necessary, likely to be effective, and proportionate.
• To whom the policy will apply, for instance: all employees, volunteers, students, only employees who work onsite, customers, etc.8
• A description of the information that employees will have to provide: As employers are required to collect the least information possible, information collected is typically limited to whether the employee has received a vaccine (including the number of doses), the dates of vaccination, and the type of vaccine.
• A description of the means by which an employee can comply with the policy:
  • It may include providing their proof of full vaccination, as outlined by the applicable provincial or territorial guideline, or a written medical exemption provided by an approved practitioner.
  • It may also include a declaration that an individual requires an accommodation under the human rights code of their jurisdiction, if they are unable to obtain a COVID-19 vaccine.
  • It may include providing the results of a rapid antigen test, if appropriate in the circumstances.
• Any alternatives for unvaccinated workers, including working from home, continuous use of personal protective equipment such as masks, routine testing, etc.
• Consequences of non-compliance, i.e. what steps employers will have to take if an employee does not comply with the policy.
• How privacy will be protected, and how the information will be stored, secured, and destroyed if necessary. Further, ensure that the least information necessary will be stored and shared in order to protect the privacy of an employee’s PHI.

There may be circumstances in which a court or a tribunal would find the collection of PHI more reasonable than others, depending on the nature of the workplace. Factors that could be considered in determining whether a vaccination policy is reasonable include but are not limited to:

• • the degree of risk of COVID-19 transmission in the workplace;
  • whether workers are in contact with vulnerable populations (such as elderly or immunocompromised individuals, or children that cannot be vaccinated); and
  • the availability and effectiveness of less intrusive measures (such as whether workers can stay two meters apart, whether masks have to be removed in order to perform the job, whether employees are working from home, etc.)

Note also, that due to the changing nature of the pandemic, what is considered to be reasonable may change in the future. It would therefore be prudent to consult the latest guidance from your privacy and nursing regulators on a regular basis.

CNPS beneficiaries can contact CNPS at 1-800-267-3390 with specific questions related to their practice to speak with a member of CNPS legal counsel. All calls are confidential.

January 24, 2022.

In light of the fast-paced and constantly evolving nature of this pandemic and the continual flow of new information, it is important for nurses to consult reliable sources, such as their local government websites, their local public health departments, and their nursing regulatory bodies, frequently to ensure that they are practicing with the most updated information. As such, the information in this article is only current up to the date of publication.

1.  Information and Privacy Commissioner of Ontario, Your health privacy rights in Ontario: https://www.ipc.on.ca/health-individuals/file-a-health-privacy-complaint/your-health-privacy-rights-in-ontario/
2. Ibid; In terms of communicable disease disclosure, the Ontario legislation explains that physicians and practitioners (including members of the College of Nurses of Ontario), “who, while providing professional services to a person who is not a patient in or an out-patient of a hospital, forms the opinion that the person has or may have a disease of public health significance shall, as soon as possible after forming the opinion, report thereon to the medical officer of health of the health unit in which the professional services are provided.”^[2] The communicable diseases may vary depending on the jurisdiction, but typically include the like of coronavirus, hepatitis, rabies, or measles (Health Protection and Promotion Act, R.S.O. 1990, c. H.7, section 25.).
3. Eastern Ontario Health Unit, Recommendations for Workplace COVID-19 Vaccination Policies: Information for Employers
4. The Personal Health Information Protection Act of Ontario states that “a health information custodian may use personal health information about an individual, (a)  for the purpose for which the information was collected or created and for all the functions reasonably necessary for carrying out that purpose, but not if the information was collected with the consent of the individual or under clause 36 (1) (b) and the individual expressly instructs otherwise“;
5. Government of Ontario, Ontario Makes COVID-19 Vaccination Policies Mandatory for High-Risk Settings | Ontario Newsroom, August 2021.
6. Office of the Privacy Commissioner of Canada, Privacy and COVID-19 Vaccine Passports: Joint Statement by Federal, Provincial and Territorial Privacy Commissioners, May 19, 2021
7. Ibid.
8. This is an important distinction as this determination will impact which privacy, employment, or other legislation applies to the policy.

THIS PUBLICATION IS FOR INFORMATION PURPOSES ONLY. NOTHING IN THIS PUBLICATION SHOULD BE CONSTRUED AS LEGAL ADVICE FROM ANY LAWYER, CONTRIBUTOR OR THE CNPS. READERS SHOULD CONSULT LEGAL COUNSEL FOR SPECIFIC ADVICE.