‘Sharing is Caring’…or is it?20 November 2018 | Workers' Compensation
The Workers’ Compensation and Rehabilitation Act 2003 (‘WCRA’) differentiates between the rights and obligations of an insurer on the one hand and an employer on the other, and restricts the sharing of information between them. This can often be a fine line to walk for self-insured employers, however, a separation of function between the two arms of the company is vital to ensure compliance with legislation and the self-insurance licence.
These safeguards are implemented to ensure that workers are not prejudiced in their employment if they have chosen to file a claim for statutory or common law entitlements. Workers also need to be confident that sensitive and confidential information about them, which is obtained during the course of a claim, is confined to use for that purpose.
In this article we will look at what can and cannot be disclosed by the insurer, within a self-insured employer, both internally within the company and externally.
So, what can and can’t be disclosed?
Firstly, we must consider the requirements in the WCRA.
- Documents Requested by Worker
Pursuant to section 572, a claimant or worker is entitled to request documents that relate to their statutory claim or claim for damages (subject to a few exceptions, such as documents protected by legal professional privilege and documents which may alert the claimant or worker to a reasonable suspicion of fraud).
- Employment Purpose
Next, we move onto section 572A. In a nutshell, this provision states that a workers’ compensation document cannot be used or obtained (or attempted to be so) for an employment purpose (be it to select a person for employment, or decide whether that person’s employment is to continue).
This means, for example, that a specialist medical report obtained by the insurer in connection with a claim which identifies a worker’s restrictions cannot be used by the employer as a basis for termination of a worker’s employment. In such circumstances, breach of the section could be alleged against both the insurer and the employer.
This restriction in section 572A will not apply to a workers’ compensation document relating to the worker’s capacity to work if the document is necessary to secure the worker’s rehabilitation or early return to work under Chapter 4 of the WCRA.
- Permissible Disclosure
Section 573 of the WCRA documents the circumstances in which disclosure is permissible. Notably, subsection (4) provides that an insurer may, if asked by another insurer (‘the other insurer’), disclose to the other insurer any information it has that is relevant to a claim against the other insurer.
Self-Insurance Licence Conditions
Self-insurance licences issued under the WCRA commonly contain claims information and confidentiality requirements, and require licensees to comply with the Information Privacy Principles (IPP) contained in Schedule 3 of the Information Privacy Act (‘the IP Act’).
The claims information and confidentiality requirement in the licence will commonly and relevantly require that:
- Workers must be made aware of the purpose for which personal information has been collected, its intended use, to whom it may be disclosed and who may have access to it;
- The personal information must be protected against misuse;
- All necessary authorities for the obtaining or release of personal information must be obtained from the worker; and
- Only authorised personnel, having regard to the purpose for which the personal information was obtained and to be used, have access to a worker’s personal information.
Information Privacy Principles 10 and 11, contained in Schedule 3 of the IP Act, are particularly relevant for self-insurers.
Both principles will apply to the vast majority of documents or information on a worker’s compensation or damages file because most of the information is ‘personal information’ (as defined in the IP Act) and it is obtained for a particular purpose.
- IPP 10 applies to a document containing personal information that was obtained for a particular purpose.
A self-insurance unit must ensure that documents containing information obtained for a particular purpose (that is, the worker’s statutory claim or damages claim) is not used for another purpose unless one of the following exceptions applies:
- the worker has expressly or impliedly agreed to use for another purpose;
- the use of the information is necessary to lessen or prevent a serious threat to the life, safety, health or welfare of the worker or public;
- it is authorised by law; or
- the other purpose is directly related to the purpose for which the information was obtained.
- IPP 11 applies to a document containing an individual’s personal information.
A self-insurance unit must not disclose personal information within a document it controls to an entity unless:
- the worker has expressly or impliedly agreed to the disclosure;
- disclosure is necessary to lessen or prevent a serious threat to the life, safety, health or welfare of the worker or public; or
- it is authorised by law.
Importantly, if personal information in a document is disclosed, it is incumbent upon a self-insurance unit to ensure that the entity does not use or disclose the information for a purpose other than the purpose for which it was originally disclosed to the entity.
What happens if we ‘over-share’?
There are three main (and serious) ramifications for breaching the above disclosure requirements. These are:
These ramifications highlight the importance placed on safeguarding the confidentiality of a worker’s sensitive information.
Takeaways for Self-Insurers
- Be very careful and review obligations before disclosing information, particularly sharing within the business but outside of the workers’ compensation self-insurance unit.
- If someone outside the workers’ compensation unit requests information:
- Ascertain to whom the information will be disclosed;
- Ascertain the purpose for which each will use the information;
- Seek or obtain a specific authority from the worker for the purpose; and
- Set clear directions regarding the purpose.
- Keep written records of everything, particularly when, to whom and for what purpose disclosure is made.
- Do not release information that you know, or suspect, will be used directly or indirectly in connection with a decision regarding a worker’s ongoing employment.
- Bear in mind that sometimes confidentiality obligations will conflict with pressing obligations relating to a worker’s safety in performing their employment duties. In the event of a contradiction between these obligations, the worker’s safety may need to take priority.
 These principles can be read in full here.
 Summarised are the more relevant exceptions in the author's view. There are additional exceptions contained in IPP10
 Summarised are the more relevant exceptions in the author's view. There are additional exceptions contained in IPP11.
 Breach of section 572A WCRA is an offence. A breach of a licence condition is not, in the authors’ view, a breach of the WCRA which could be prosecuted.
 In renewing a self-insurer’s licence, the Regulator is required to be satisfied that the licensee is 'fit and proper to be a self-insurer'.
 The Regulator may take steps to cancel a self-insurer’s licence if a licensee contravenes either the WCRA or a condition of its licence. If the Regulator considers that grounds exist to cancel a licence, it must give the self-insurer notice stating the grounds and basis for the cancellation, and must give the self-insurer at least 20 business days to show why the licence should not be cancelled. If, notwithstanding, the Regulator decides to cancel a self-insurer’s licence, it must provide written notice of the decision and reasons. If the Regulator decides to cancel a licence, the licensee may have grounds to appeal the decision to a court. Any appeal applications must be filed within 20 business days of the Regulator’s decision.