Employees’ personal health information is protected by privacy laws (in Alberta, The Personal Information Protection Act (PIPA)) BUT employers may collect, use and disclose it if:

• The purpose of the collection, disclosure or use is to comply with the law or create, manage or terminate an employment relationship and manage a post-employment relationship
• The collection, disclosure or use is reasonably necessary to carry out the above purpose
• The amount of info collected, disclosed or used is kept to the minimum necessary to accomplish that purpose
• You provide the employee reasonable notice of the personal information you’re collecting/using/disclosing and the purpose of the collection/use/disclosure
• You take appropriate measures to keep the info secure so others can’t use it without authorization

Same basic rules apply in BC, QC and at federally-regulated companies.
Hope that helps. Glenn