Information that reveals details such as an employee’s illness or disability are sensitive information in the sense meant in the Personal Data Act. Such health information must not be handled at the workplace except with the explicit consent of the employee concerned.
The employer is only allowed to collect health information on employees that is of direct relevance to the employment relationship. Information must not be collected and handled contrary to the law, not even with the consent of the employee.
The employer must not collect a register of any employee’s medical details. Only a health care operator, such as the occupational health care service provider, may keep such a register.
The occupational health care service may not give the employer a summary of an employee’s medical record. The occupational health care service may only inform the employer as to whether the employee is suitable for a particular job or whether there are limitations.
Only designated persons may handle health information
At the workplace, employees' health information may only be handled on a strictly need-to-know basis. Employees allowed to handle the health information of other employees in the course of their work must be specifically designated at the workplace. They may not disclose any of that information during or after their employment relationship. Health information must be kept separate from all other information, and it must be destroyed once it is no longer needed.
It is only permissible to handle health information at the workplace if it is relevant for a special risk of illness related to the work. If an employee goes to work for another employer where a similar special risk of illness exists, the occupational health care service may disclose the related health information to the occupational health care service of the new employer.
Information on sickness absences may be recorded
The employer is allowed to register information on the times of an employee’s sickness absences for instance for the payroll system. The employer may not, however, register the diagnoses entered on the medical certificates presented for those sickness absences.
The employer may deliver a medical certificate received from an employee to the occupational health care service, unless the employee specifically forbids it. In any case, the employer may inform the occupational health care service about the times and durations of an employee’s sickness absences.
Handling health information in occupational health care three-way meetings
The employer is entitled to send an employee to the occupational health care service for a work capacity assessment if the employer has justified reason to suspect that the employee’s work capacity is compromised by a decline in his/her health. Cooperation to provide early support may be agreed on in the occupational health care service plan or a dedicated early-support model drawn up for the workplace.
An early-support three-way meeting is usually attended by the ill employee, the employer’s representative (e.g. the supervisor) and the occupational health care physician or nurse.
Occupational health care professionals may not inform the supervisor at the meeting or indeed any other employer representative about the employee’s illness, but they can describe the impact of that illness on work capacity in general medical terms.
If a diagnosis is required on the medical certificate, the employer will already know what the employee’s illness is. The employee himself/herself may of course share more information about the illness.Often the employee will agree beforehand with the occupational health care service how much to tell the employer about the illness at the meeting. The purpose of the three-way meeting is to agree on job duties suitable for the employee’s work capacity at that time. The occupational health care service may provide its expert opinion regarding the duration of the adjustment of job duties and determine a time for the follow-up meeting.