The requirement to provide consent to release a report
We are commonly asked why an employee is required to provide consent/approval to release their occupational health report when they have already given consent at an earlier stage to undergo an occupational health assessment.
The short answer to this is to protect the legal rights of the employee, and therefore ensure that the employer is also acting lawfully – thereby protecting them in the event of an employment dispute or tribunal.
There are several bases to this requirement, including both pre and post GDPR guidance. Either way remember that in order for consent to the processing of data to be valid, it must be explicit and informed. In this context, an employee cannot be informed about what data is being sent to their employer until they receive a copy of it themselves, and are therefore aware of what they are consenting to.
This approach considers several laws. The UK GDPR and Data Protection Act provide guidance on this, however there are also other considerations including the Human Rights Act (1998) and common law (decisions made by judges that set a precedent for future activity). Guidance from clinical regulatory bodies such as the General Medical Council (GMC) and the NMC (Nursing and Midwifery Council) also need to be considered because this is what gives the medical professionals the ability to practice in the UK. GMC guidance can be read here.
The Faculty of Occupational Medicine explains ‘the most transparent method of avoiding surprises is to explain the content of the report during a consultation and to offer to show the worker a copy before sending it to the recipient’.
Having taken legal advice on the matter, the only conclusion that we can come to that affords our clients the protection they need is to ask an employee for approval or consent to release the report when they are sent a copy of it.
The following is an article written by occupational health barrister Diana Kloss, in which she discusses the topic, including guidance from the General Medical Council (GMC).
Consent to occupational health reports | Occupational Medicine | Oxford Academic (oup.com)
The following are key sections from the article:
As regards OH reports requested by a manager, guidance from the GMC on confidentiality is based on the legal doctrine that consent to be valid must be informed… You cannot give true consent to an operation or disclosure of confidential information unless you know what is involved. Thus, only when the employee is told what is in the OH report can he give valid consent to its disclosure to his employer.
Although employers may express irritation that OH has permitted an employee to thwart management’s need for advice about an employee’s fitness for work, they may be reassured that courts regularly hold that an employer, who has tried to obtain a medical assessment but has been prevented by the employee’s refusal to consent to a report from his GP or OH, is entitled to rely on the evidence he has.
It is ethically justified if the employee has a free choice between an OH report, the contents of which he is completely aware, and the consequences of that report not being given to management. He lacks that choice if he is not informed of the contents of the report before it is sent and allowed at that stage to veto it.
The following case law is discussed in the article, and provides legal support to this approach: