One of the first social media confidentiality cases arose out of a health care employment relationship. In CAW-Canada, Local 127 (J.C.) v Chatham-Kent (Municipality), [2007] OLAA No 135 (QL), the griever was a personal caregiver with eight years of service and some history of discipline. She was discharged after making a number of blog entries and posting photos. Some of the photos she posted were of co-workers and one was of a resident patient. In her blog entries, the griever criticized management decisions, identifying one manager by first name and another by initials. Some comments were derogatory and were laced with coarse language. The griever also complained about several residents using their first names and even revealing one resident’s diagnosis. The employer had a training manual saying that each employee was required to ensure that all information obtained during the course of duty was to be kept from social conversation and to remain confidential. The manual clearly said that discipline, including termination, would follow such disclosure. Arbitrator Williamson recognized that health care sector employees “are held to a high standard in matters of maintaining the confidentiality of personal information” and upheld the discharge.
The facts in Credit Valley Hospital v Canadian Union of Public Employees, Local 3252 (Braithwaite Grievance) (2012), 214 LAC (4d) 227 were tragic. A part-time Environmental Service Representative (non-medical position), with five years of service was discharged when, after assisting in cleaning up a suicide scene, he took two pictures with his cell phone and later posted them on Facebook with the following captions: “Mother pleads with kid not to jump…” and “This is what I have to clean up”. The employer said these actions breached patient, employee and even the hospital confidentiality, relying on an Employee/Volunteer Confidentiality Form that the griever had signed when he was hired. This form said patients and staff members had a reasonable expectation that their personal information would be treated in complete confidence and that confidential information included verbal, written and electronic data concerning patients, staff and hospital business. The policy said that disclosure without authorization would result in disciplinary action up to and including dismissal.
During the hearing, the griever claimed to be unaware that the suicide victim was a patient. Arbitrator Levinson upheld the discharge saying that the griever had “constructive knowledge” that the victim was a patient and that the griever’s actions were culpable. In addition, the arbitrator noted that the griever was not remorseful and did not fully accept responsibility for his misconduct. This undermined positive rehabilitative prospects. Although noting that there might have been some “spur of the moment” lack of judgment on the griever’s part, Arbitrator Levinson found that once the photos were posted on Facebook, they had the “hallmark of premeditation”, given the passage of time between when the pictures were taken and when they were posted, and given the fact that they were posted during the griever’s break.
Social media is here to stay and the Credit Valley Hospital decision confirms that employers in all businesses where information must be treated with confidence must have policies and disciplinary consequences in place to limit their liability and to effectively redress a breach. The employer’s best defence will be to have a confidentiality policy in place as well as a social media policy to drive the point home further. Such a policy should specifically prohibit defamatory postings relating to the employer or a co-worker; insubordinate or insolent comments; or any social media posting that would damage the employer’s reputation.
As with any other policy, a social media policy must be communicated, involve some training and acknowledgement, and must be consistently enforced. A template social media policy can be found in PrivaTech’s Privacy Documentation Suite.