Medical access

[AnonymousXYZ]

My employer has opted the entire company into granting them access to personal medical records. They are offering us the ability to opt out but not without an interview with the HR department. Is this legal?

[R0b]

Not entirely sure that is above board, they cannot automatically opt all employees into consenting to their medical records, presumably you mean from the employee's GP. Most if not all of medical record information is classified as sensitive personal data and there is a lot more stringent requirements to process it, namely that the employer should obtain explicit consent and only for the purpose for which it was intended.

There are other conditions but you've not told us the nature of your work as an employee and the industry your employer works in, so there might be some other valid reason for this but I would still think it is pretty dodgy.

Can you explain exactly how your employer has opted their employees into granting it access to everyone's medical records?

[AnonymousXYZ]

Hi,

Low level management called a meeting with each department and informed the staff that due to GDPR law changes, company policy had been amended.

The policy was now all staff have given consent for the company to access colleague personal medical records from their GP, not a company related doctor.

The company has not even issued a written document to sign and all staff that opt out will have to explain their reasoning to HR.

The staff turnover is exceptionally high due to the company treating its staff badly and now they are granting themselves access to personal information without permission.

Thanks for your response btw

[wales01man]

Without your consent how can they access your records?

[AnotherLevel]

If a GP was to release your medical records without your consent, they could end up suspended or struck off.

https://www.gmc-uk.org/ethical-guida...rk#paragraph-9

Unless you give your consent to your GP, there is no way that your employer can legally access your records.

There are certain exemptions (a judge's order or if releasing them will help prevent a serious crime), but these won't apply here.

[Amethyst]

Ula Not sure what GDPR has to do with their "change of policy" - medical records fall under AMRA access to medical records which requires explicit consent - as does DPA 2018 and GDPR. If anything GDPR is far more focussed on Opt In rather than Opt Out so whatever their reasons for the 'policy' change they have got an issue how they're dealing with it. A GP won't disclose the medical records without explicit consent in any event. I've Tagged Ula to look in but do you have your contract or employee handbook and what does that say about medical records access requirements. Does your job have specific health requirements to perform or has there just been a big absence problem ?

[ULA]

Your company is on a very shaky ground with this one, they cannot opt their staff into granting them access to personal medical records. This is absolutely nothing to do with GDPR, in fact GDPR means they have to consider this more carefully since this would be regarded as sensitive personal information.

Anyway as others have said a GP would not provide a report unless they had written and signed confirmation from the employee that they had given consent for a medical record to be provided. Also the individual has the right to see the medical report in advance.

You have very strong ground to push back on your employer.