• All donations and upgrades are manually verified and approved within 24hrs.
  • Upgrades are ongoing. Learn how to save your bookmarked posts.

My HR Shared My Medical Information with Other Staff

Thread starter #1
Hi everyone,

My HR Director forwarded an email that held sensitive medical information that I required a doctor's note to go back to work for to three supervisors (one that I don't even work in the same building at anymore) after I was assured by those supervisors that HR would keep any information confidential but that I needed a doctor's note to come back to work due to some of my symptoms I have every day overlapping with COVID symptoms. I am incredibly upset and was having a lot of trouble regulating this morning.

I contacted the union I am a part of to get an idea of how I should proceed, and they asked me to contact HR back, that my concerns were valid due to (US) HIPAA laws, and then asked what kind of remedy I was looking for. I got stuck there, as I'm not entirely sure what I should be asking for other than to direct those supervisors that my medical information is confidential and that it is not to be shared with others.

Can I ask that they delete record of the email?

I see what the union is saying, as I feel like the damage has been done, and I'm not sure what else to do.

I don't really trust Human Resources in general as I've had bad situations happen with them before but not at this current employer, but I didn't really expect all of my private medical info to just be forwarded to people who have no right to view it.

Any suggestions?
 
#2
Can they recall the message? It might be that the recipients might not have read it yet? (Fingers crossed, they are on holiday or something).
If that is not possible, yes you can ask that they delete it. And also HR could confirm with them the mistake and highlight it is confidential information not to be shared.
You could also ask for an apology from HR.
And assurances about how they will not make that mistake again.

I'm sorry that information was shared. It shouldn't have been and they need to rectify the situation as much as possible.
 
#3
I get how triggering that must be.

Personally, I'd ask HR to give me a written statement that they understand that their action was not in keeping with privacy laws and that they have taken appropriate steps to ensure it won't happen again.

That way you have something in writing, should it ever happen again.

And, they're like "Oh shit... oops" and will be more careful about that stuff.

Cos it sounds like it has happen cos of thoughtlessness rather than out of malice.

And if this ^^ is your response, then I also think you're displaying an (outwardly) calm, mature reaction to a privacy issue, without over-reacting.
 
Thread starter #4
Can they recall the message? It might be that the recipients might not have read it yet?
Unfortunately we use Gmail and I don't think the message can be recalled. I know that the recipients are working now because I work in a school system and all three people are principals, unfortunately, so I assume all three have seen it.

Personally, I'd ask HR to give me a written statement that they understand that their action was not in keeping with privacy laws and that they have taken appropriate steps to ensure it won't happen again.
That sounds like a good idea. I was also thinking of asking something like "I would like it on record that the principals should not have had that information and will in no way act on it. However, now that the principals have my medical information, what will the HR department be doing to make certain I am protected from discrimination on that basis?" or something to that degree?

So in full, I wanted to ask the following:

1. That the principals delete the email containing my medical information
2. That my record reflect that it was not my choice to share that medical information with the principals and an assurance that they will in no way act on it or share it with others.
3. Now that the principals have my confidential medical information, what will the HR department be doing to ensure I am protected from discrimination.
4. I would like an apology and assurance of the steps they will be taking to ensure that my medical information is not shared with parties that I have not consented that my information be shared to.

Does that all seem reasonable?

And if this ^^ is your response, then I also think you're displaying an (outwardly) calm, mature reaction to a privacy issue, without over-reacting.
Thank you, I appreciate that. I cried for about three hours this morning before I had it together enough to create a measured response enough to contact the union. I'm waiting for my union representative to email me back since I asked her if she'd be willing to proof-read my email that they are encouraging that I write to the union.
 
#6
I think I would try and strike a balance between getting an apology/ reassurance and not drawing even more attention to the issue. Chances are that it's just one of 40 or 50 emails those principals will be getting today, and so possibly only paying minor attention to?
I wonder if over-emphasising the privacy aspect will make it a bigger deal than it is right now?
Not knowing the specifics, I can only guess in the vaguest possible way, of course.
Just a thought that it might be a trade off - maybe your union can advise you on it?
 
#7
and then asked what kind of remedy I was looking for. I
I’m going to throw in a vote to at least consult with a lawyer... as this is your livelihood & career on the line, & we’re talking about the law.

Specifically the Human Resources Department breaking the law, in such a way that may effectively end your career / ability to work for this -or any other- district, in any capacity, in the nation. Hence part of why there are laws against this kind of thing, and people lose their jobs, because this sort of thing can and does ruin lives.

And the law’s quirky. 2 nearly identical, and both eminently reasonable statements? Can have drastic and opposite effect... legally speaking. Words that simply LEAP off the page, practically shouting the tremendously different effects they will have on the rest of your life. Words like “and” & “or”. Snort. Yeah. Shrudder.
 
Thread starter #8
Hey all, I opted to talk to the principals today individually and let them know the email they received had medical information I wasn't prepared to share at the level it was shared at. They all said they hadn't scrolled down but they would not be looking for it and they would keep it to themselves if they see anything. All 3 said they were glad I said something to them about it.

Because I am still concerned about how my information was shared I'm still going to draft an email to HR and clear it with my union rep by letting her proofread it first.
 
#9
Hi everyone,

My HR Director forwarded an email that held sensitive medical information that I required a doctor's note to go back to work for to three supervisors (one that I don't even work in the same building at anymore) after I was assured by those supervisors that HR would keep any information confidential but that I needed a doctor's note to come back to work due to some of my symptoms I have every day overlapping with COVID symptoms. I am incredibly upset and was having a lot of trouble regulating this morning.

I contacted the union I am a part of to get an idea of how I should proceed, and they asked me to contact HR back, that my concerns were valid due to (US) HIPAA laws, and then asked what kind of remedy I was looking for. I got stuck there, as I'm not entirely sure what I should be asking for other than to direct those supervisors that my medical information is confidential and that it is not to be shared with others.

Can I ask that they delete record of the email?

I see what the union is saying, as I feel like the damage has been done, and I'm not sure what else to do.

I don't really trust Human Resources in general as I've had bad situations happen with them before but not at this current employer, but I didn't really expect all of my private medical info to just be forwarded to people who have no right to view it.

Any suggestions?
You can request a follow up letter to be sent to all people from HR, to those who received the letter that it was sent inadvertently, and request all copies to supervisors be destroyed. Computers can be checked to insure removal....and the letter to say that you have a right to medical privacy, and the contents of the letter is not to be discussed with others in the building, nor used in any way in the evaluation process. With that said, all communication on a work computer about your health, is owned by them. So, don't write letters to HR or your boss on the work computer.

I'd get guidance from your union, but if anyone who received the mail treats you differently in the evaluation process, any words are used to refer to your condition, then you may have cause for a discrimination claim. But don't look for something that hasn't happened. So, I'd document any unusual interactions with the folks who may know, and if you don't see any , let it go. You'd be surprised what HR has to deal with when it comes to the health of staff....though they screwed up for sure. Do your best, do what you've always done, and hope for the best.
 
#10
Not that this is reassuring, but I too work for a school system that has broken all the laws and neglected to ensure confidentiality regarding my medical condition(s). As many have accurately voiced on this forum, schools- moreso than other employers- should know the laws better than most due to legal mandates that protect confidentiality (iep. 504, etc).

Even if it was an inadvertent violation, it is certainly well within your rights to seek an apology, as well as seek assurance that the info will not be used against you, and to get it in writing.

I too recommend consulting with a lawyer. Maybe the union Lawyer? It is so important to document!
Best of luck. Keep us updated
 
Last edited by a moderator:
Top Bottom