Privacy-breaching worker wins reinstatement

Privacy issues in employment are gaining more and more attention these days, particularly in the healthcare sector.
 

The importance of privacy for individuals, institutions, and government is reflected in increasing restrictions and regulations on access to information.
 

For example, in late June 2017, the Ontario Government filed O. Reg 224/17 which amends the General Regulation under the Personal Health Information Protection Act to increase the situations when a health care custodian must notify the Information Privacy Commissioner of a possible breach.
 

Despite the increasing legislative scrutiny, enforcement and adherence to privacy restrictions remains a challenge for employers. Employers who are healthcare custodians are increasingly required to make discipline decisions with respect to employees who breach privacy and often those breaches occur out of simple curiosity.
 

Curiosity may have killed the cat, but arbitral case law suggests that curiosity by unionized employees may not kill the employment relationship.
 

In order to uphold the termination of employment for a unionized employee, an arbitrator must be satisfied that not only was there cause for discipline but that the penalty of discharge is appropriate in all the circumstances.
 

Unfortunately for employers trying to uphold their obligations as health care custodians and protectors of privacy, the approach taken by arbitrators might mean that a zero tolerance policy on privacy breaches will be ineffective. Arbitrators regularly look to factors such as remorse, reasons for the breach, and economic hardship to determine if the discharge should be upheld.
 

A recent decision from British Columbia, which was upheld on review, suggests that even if the employee fails to show remorse until the day of the arbitration hearing, this belated remorse may be sufficient to allow an arbitrator to conclude that the employment relationship can be repaired and that reinstatement is appropriate.
 

In this case, a nurse had been terminated from her employment after improperly accessing personal medical records of numerous patients out of curiosity.
 

The union grieved the termination and a hearing was held where the union successfully argued that termination was an inappropriate and excessive penalty. The nurse was reinstated, although without back pay, despite the emphasis on privacy by governments and patients.
 

Arbitrator Brown ordered reinstatement in part because the nurse was discipline-free over eight years, the termination made it difficult to find alternate employment, the nurse was remorseful, and the nurse had taken courses to educate herself on privacy.
 

The employer had the arbitration decision reviewed in part on the basis of the perceived remorse, noting that the nurse never apologized for her misconduct until the day of hearing.
 

On review, the Labour Relations Board upheld the order for reinstatement. The board specifically considered whether it was relevant that the apology did not occur prior to the hearing date, especially since prior to termination the nurse had participated in two investigation meetings and no apology had been forthcoming.
 

It was determined that the nurse was never deceitful in the meetings, as she stated she could not recall certain information, and she did admit to some improper accesses. The board also noted that at the hearing, the nurse explained she felt stressed at the time of the investigative meetings, and although she had not advised the employer at the time of these difficulties, these circumstances supported the reliance on the late apology.
 

Employers who are healthcare custodians should be aware of the risk of reinstatement when terminating employment based on a privacy breach. Employers should assess factors such as economic hardship, mitigating personal circumstances, and past disciplinary record to determine the likelihood of a possible reinstatement order.
 

Employers should also be aware that if proceeding to hearing, additional factors supporting reinstatement, such as an apology, could be significant to an arbitrator’s decision.
 

This outcome is a cautionary case for employers and highlights the risk of reinstatement through an arbitration hearing. CCPartners has experience in navigating terminations in the unionized context including those based on privacy breaches.