With the approach of winter and national measles outbreak, companies should be assigning high priority to infectious disease prevention and response. In so doing, they need to be mindful of privacy risks that come into play when infection control involves the collection, use and disclosure of their employees' personal health information. Here are 7 Best Practices based on guidelines issued by the Privacy Commissioners of Canada, Alberta, and British Columbia that, while created for H1N1, work equally for other infectious diseases. 

Caveat: These Guidelines apply in normal conditions when a public health emergency has not been declared. Employers generally have more leeway during public health emergencies, such as during the COVID pandemic.   

1. IdentifyingEmployees Who May Need Alternative Work Arrangements  

Situation: You're generally not allowed to ask employees who they live with. But gathering this information could become important to infectious disease prevention to the extent it enables employers to determine which employees might need alternative work arrangements. The key is asking for this information in an appropriate way. 

Wrong: Asking "Do you have young children or elderly parents at home that you might have to care for in the event of an outbreak or pandemic?" 

Right: The Guidelines suggest distributing a survey asking employees if they may have to make alternative work arrangements to care for kids or elderly parents. "This way," the Guidelines explain, "employers will be able to estimate how many employees could be absent without collecting detailed personal information." 

1. IdentifyingEmployees Who Might Be Susceptible to Infection 

Situation: You might want to warn any employees that have asthma, immunity deficiencies, or other medical conditions that make them vulnerable to measles, the flu, COVID, RSV, and other illnesses for which vaccinations exist to get vaccinated and take special precautions. But asking about an employee's general medical condition can be a privacy violation. 

Wrong: Asking employees to furnish detailed information about their medical condition, e.g., asking them to tell you if they have asthma.  

Right: The Guidelines advise employers to let all employees know that individuals with certain kinds of conditions are at risk and need to consider taking additional precautions.  

1. Asking Employees If They've Been Vaccinated 

Situation: Employers have an obvious interest in ensuring that their employees get vaccinated. But unlike during the COVID pandemic where a public health emergency was in effect, vaccination status is generally deemed personal information protected by privacy laws. 

Wrong: Asking employees: "Have you and your family gotten your flu [or other illness] vaccine?"   

Right: Encouraging employees to get vaccinated and giving them information about vaccinations, such as vaccination clinic schedules. 

1. Asking Employees for Personal Contact Information 

Situation: Assuming you don't already have this information, employers might want to ask employees for contact information so they can provide them with updates about a pandemic or other public or company health situation. But this is private information that employees might loathe to provide. 

Wrong: Asking, and especially requiring, employees to give you their personal email or phone number. 

Right: The Guidelines recommend asking employees to advise you how they prefer to be contacted and, if possible, give them alternative ways to get information from you without having to disclose their private contact information, such as having the employee agree to call in to the office at agreed-upon intervals.  

1. Asking Employees Who Call in Sick If They Have a Specific Disease 

Situation: Employers might want to keep track of how many employees have been diagnosed with flu, measles, COVID, RSV, or other specific diseases. But asking employees what illness they have crosses the line.  

Wrong: Asking employees who call in sick: "What's wrong with you? Do you have the flu?"   

Right: Asking employees who say they're sick how long they expect to be out and when they plan to return. In short, asking for a prognosis is okay; but asking for a diagnosis is not.  

1. Notifying Other Employees that a Co-Worker Hasa Specific Disease 

Situation: Employers who know what illness a sick employee has may be tempted to advise coworkers and others in the company whom the employee might have exposed, especially if the employee has the measles, flu, or some other infectious illness that's currently prevalent in the local community. 

Wrong: Disclosing an employee's diagnosis to somebody else in the organization is just as impermissible as asking an employee to furnish his diagnosis to begin with. 

Right: Letting others at the company know that the employee isn't available, and if necessary, when the employee is expected to return.  

1. RoutinelyAsking Sick Employees for a Doctor's Note 

Situation: Companies typically require employees who call in sick to furnish a note from a doctor, licensed nurse, or other medical professional (which we'll refer to collectively as "doctor's notes") to prove they were really sick and had to miss work. But employment standards laws in many provinces, including British Columbia, New Brunswick, Newfoundland, Ontario, Prince Edward Island, Québec, and Saskatchewan, now impose restrictions on using doctor notes to verify sick leave or short medical absences.  

Wrong: Routinely requiring employees to provide a doctor's note every time they take a sick day.  

Right: Be aware of the applicable employment standards rules in your jurisdiction, especially those regarding how long a medical absence has to last before you're allowed to ask for a doctor's note. Consider alternative methods of verifying short medical absences, such as requiring employees to sign a form certifying that they really had to miss work due to illness and acknowledge that making a false certification is grounds for discipline, up to and including termination.