Managing staff health data

What is health data?

The DPA defines health data as ‘data concerning health’, which means ‘personal data relating to the physical or mental health of an individual… which reveal information about their health status’. Health data can be about someone’s past, current, or future health status and covers information about medical conditions, medical tests, medical treatments, and any other information about an individual’s health.

As a result, health data encompasses a wide range of personal data, including:

• information about someone’s physical health and physical health conditions (eg diabetes, epilepsy, menopause, or high blood pressure)

• information about someone’s mental health and mental health conditions (eg depression, anxiety, ADHD, or OCD)

• information relating to maternity and children

• medical examination data, medical test results, diagnoses, and treatments

• information about injuries, diseases, disabilities or risks of diseases

• information about someone’s medical history

• identifiers assigned to individuals to identify them for health purposes (eg NHS numbers), if these are combined with information revealing something about the individual’s health

For more information on health data, see the Information Commissioner’s Office’s (ICO’s) guidance on health data.

How is health data relevant for employers?

Employers process staff members’ personal data for various reasons simply by acting as an employer. However, health data is often some of the most sensitive personal data that employers process about their staff members. 

There are various circumstances in which employers may need to process health data. For example, when handling:

• information relating to staff sickness, including records of sickness absence forms (eg Self-certification forms)

• information about disabilities collected to facilitate making reasonable adjustments

• eye-test results for staff members who have been using display screen equipment (DSE)

• results of workplace alcohol or drug tests

• records of vaccination statuses (especially if certain vaccinations are encouraged under a Vaccination policy)

• questionnaires completed by staff members to help detect problems with their health

• information about allergies to help determine what reasonable adjustments can be made regarding service animals

• records relating to staff members’ pregnancies and maternity entitlements 

• records of medical tests (eg blood tests) carried out to ensure staff members have not been exposed to hazardous substances

• the results of any fitness for work assessments carried out to determine whether staff members are fit to return to work after a period of sickness

The GDPR and DPA set out stringent rules on the processing of personal data. This is particularly important when the information in question is special category sensitive data, like information about staff members’ health.

When can employers process health data?

Under the GDPR and DPA, health data can only be processed if the employer has a lawful basis for doing so. As health data is awarded greater protection than other forms of personal data, a special category condition for processing must also be established. The lawful basis and special category condition for processing must both be determined and clearly recorded before an employer processes staff members’ personal data.

Lawful bases for the processing of health data

While the law sets out 6 potential lawful bases for processing personal data, the ones that are most likely applicable to the processing of health data include:

• performance of a contract - for example, if processing is necessary for the performance of a contract formed between the employer and a staff member or because the staff member has asked the employer to take specific steps before entering into a contract. Employers will often rely on this basis for processing where they need to process a staff member’s health data to fulfil obligations under an Employment contract

• legal obligation - this is where the employer needs to process staff members’ health data to comply with an obligation imposed on them by the law. For example, employers must process information about sickness absences to comply with their obligations around statutory sick pay

• legitimate interests - this is where the processing is necessary for the employer’s legitimate interests or the legitimate interests of a third party. A Legitimate interests assessment (LIA) will need to be carried out to determine where such legitimate interests exist. For example, an employer may have a legitimate interest in processing health data when recruiting for a role where fitness is integral to the performance of the role and the job offer is conditional on a candidate passing a medical examination

• vital interests - this is where the processing is necessary to protect the vital interests of the staff member or another person. Vital interest usually applies to matters of life and death. For example, an employer may need to disclose a staff member’s health data in the event of a medical emergency if the staff member’s life is at risk

For more detailed information on these lawful bases, read Processing personal data.

Special category conditions for processing for health data

Due to the sensitive nature of health data, it is insufficient for an employer to have only a lawful basis for processing this data. Employers must also identify a special category condition for processing. While there are 10 potential special category conditions for processing, the ones that are most likely applicable include:

• employment, social security, and social protection law - this can be relied on where the processing is essential for enabling the employer to fulfil their duties and exercise certain rights under employment, social security, and social protection laws. This may be particularly relevant for employers when they are ensuring staff members’ health and safety or maintaining statutory sick pay and maternity pay records

• legal claims or judicial acts - this can be relied on where the processing of health data is necessary to establish, exercise, or defend legal claims. For example, where a former staff member is bringing a legal claim against the employer over an incident that affected their health (eg a workplace injury)

• substantial public interest - this can be relied on where the processing of health data is necessary for one of the substantial public interest conditions, which are set out in UK law. For example, an employer may process staff health data under the substantial public interest condition of statutory and government purposes when monitoring and managing workplace hazards

• vital interests - this can be relied on where the processing of health data is necessary to protect the vital interests of the staff member or another person where the staff member is physically or legally incapable of giving consent. For example, in a medical emergency where the employer needs to disclose a staff member’s medical data (eg allergies) while they are unresponsive

For more information on the special category conditions for processing, read Compliance for DPIAs. Note that an Appropriate policy document (APD) must be completed before relying on some of these conditions. For more information on APDs, read Appropriate policy documents.

What other data protection obligations apply to health data?

In addition to establishing a clear basis and special category condition for processing staff members' health data, employers must comply with all other data protection obligations.

Data protection laws require employers to be fair and transparent in their health data processing. This means that employers must: 

• have a clear and justifiable reason for collecting staff members’ health data before processing any data

• clearly explain why they are collecting the health data (eg to make reasonable adjustments for disabilities, facilitate equal access and equal opportunities, or ensure staff health and safety)

• process health data in ways that staff members would reasonably expect

• not use health data in ways that have unjustified adverse effects on staff members

Employers must also ensure that the health data they collect is proportionate. Due to the sensitive nature of health data, collecting this data may be (highly) intrusive. While staff members can expect to disclose some information about their health to their employer (eg regarding their sickness absences or medical history), employers must only collect and process the necessary information. To determine what is proportionate, employers should consider what data they need and why. Generally speaking, employers should collect as little health information about as few staff members as possible. 

For more information on data protection obligations in general, read Data protection, Data protection principles, and Complying with the GDPR.

What should employers tell staff members when processing their health data?

As part of their transparency obligation, employers must be clear, open and honest with staff members about their health data processing. Employers must inform staff members about: 

• which health data they collect

• why they collect this health data

• who will have access to their health data and in what circumstances

Specific information about health data processing must be provided to staff members. This information must be easily accessible and easy to understand (ie communicated using clear and plain language). How this information is best provided depends on the nature of the employer’s organisation and its needs. For example, the best method could be:

• in a privacy notice (eg an Employee privacy notice or Consultant privacy notice)

• in the employer’s Data protection and data security policy

• in the employer’s Staff handbook

• through other written communications with staff members (eg letters or emails)

• by posting notices on communal notice boards

How long can employers keep staff members’ health data for?

Employers must only keep health data for as long as needed (known as a ‘data retention period’). As a result, employers must carefully consider how long they need their current staff members’ health data for and how long they need their former staff members' health data for. A justification for these data retention periods needs to be provided. 

It’s crucial that employers regularly review the health data they store and either delete or anonymise it when it is no longer needed. Employers should also make sure to record their retention and review periods in a Data retention policy. 

For more information, read Data retention and document destruction.

How should staff members’ health data be stored?

Employers must keep personal data safe and secure. Due to the sensitive nature of health data, employers must have a high level of security (ie information about staff members’ health must be kept particularly secure). Exactly what this means for a given employer depends on the nature of the employer’s organisation. For example, it may be appropriate to store health data on a separate database or system or to have separate access controls for health data (eg only granting access to those who need to see the health data, such as HR managers).

For more information, read Data protection principles.

Do employers need to conduct data protection impact assessments when processing staff members’ health data?

A Data protection impact assessment (DPIA) is a process that helps organisations identify and minimise data protection risks. A DPIA must be carried out whenever the processing of personal data is likely to result in a high risk to the rights and freedoms of individuals. There are also certain additional situations in which a DPIA must always be carried out. Even when a DPIA isn’t mandatory, employers should consider carrying out a DPIA before processing health data due to the sensitive nature of health data. For more information, read Data protection impact assessments.

For more information on processing health data in the workplace, see the ICO’s guidance on data protection and workers’ health information. For more general information on data protection in the workplace, read Data protection and employees.

Do not hesitate to Ask a lawyer if you have any questions or concerns about your data protection obligations. Consider using our GDPR compliance service to ensure your business complies with all applicable data protection laws.