Covid-19 test results disclosed to employers ‘breach of confidentiality’

The chief medical officer said that employers receiving Covid-19 test results before their staff is a “breach of confidentiality”.

It has emerged that some test results of individuals who had tested positive for Covid-19 have been disclosed to their employers.

It is understood these testings relate to widespread screening of large workforces.

Speaking at the special Covid-19 committee in the Dail, Dr Tony Holohan said: “We have had some reports of employers receiving results in respect of individual patients – that’s a breach of confidentiality. Full stop.”

The Data Protection Commission (DPC) said it does know whether the HSE, based on public health advice, is mandating the testing of all staff in certain aggregate settings or “merely making testing available as a facility”.

The DPC also said it is unclear whether aggregate setting employers assert an obligation to mandatorily test staff based under Health and Safety legislation and employment law.

Deputy Commissioner Graham Doyle said: “Further, it is not known how the HSE is communicating about testing to such employers and management and consequently what information is being provided in advance of testing to staff members.

“In any case and subject to obtaining further information on the end-to-end process, the administration of the PCR test would appear to involve the processing of both personal data and special category personal data for the purposes of the GDPR and the individual retains rights in respect of their personal data.

“From this remove, the DPC cannot see how it can be legitimised that medical test results of this nature would not be communicated in the first instance directly to each individual staff member whether by sms text or phone call.

“While it may be necessary for the HSE to inform management and employers of positive results after the staff member has received those results in the context of the tracing of close contacts in the aggregate setting, this does not negate the need to communicate with the individual about their personal data.

“The DPC is in receipt of queries and complaints from individuals who have expressed shock and upset at receiving results via their manager in aggregate settings and while we are still examining those complaints, it appears to be the case that at a minimum communication has been unclear to the affected staff members in terms of how the process is being managed.

“Given that public health authorities clearly want to maintain the trust of the public in the testing and tracing system and keep people engaging with that system, it is important these issues are clarified and rectified.”