One of the first social media confidentiality cases arose out of a health care employment relationship. In CAW-Canada, Local 127 (J.C.) v Chatham-Kent (Municipality), [2007] OLAA No 135 (QL), the grievor was a personal caregiver with eight years’ service and some history of discipline. She was discharged after making a number of blog entries and posting photos. Some of the photos she posted were of co-workers and one was of a resident patient. In her blog entries, the grievor criticized management decisions, identifying one manager by first name and another by initials. Some comments were derogatory and were laced with coarse language. The grievor also complained about several residents using their first names and even revealing one resident’s diagnosis. The employer had a training manual saying that each employee was required to ensure that all information obtained during the course of duty was to be kept from social conversation and to remain confidential. The manual clearly said that discipline, including termination, would follow such disclosure. Arbitrator Williamson recognized that health care sector employees “are held to a high standard in matters of maintaining the confidentiality of personal information” and upheld the discharge. 

The facts in Credit Valley Hospital v Canadian Union of Public Employees, Local 3252 (Braithwaite Grievance) (2012), 214 LAC (4d) 227 were tragic. A part-time Environmental Service Representative (non-medical position), with five years’ service was discharged when, after assisting in cleaning up a suicide scene, he took two pictures with his cell phone and later posted them on Facebook with the following captions: “Mother pleads with kid not to jump…” and “This is what I have to clean up”. The employer said these actions breached patient, employee and even the hospital confidentiality, relying on an Employee/Volunteer Confidentiality Form that the grievor had signed when he was hired. This form said patients and staff members had a reasonable expectation that their personal information would be treated in complete confidence and that confidential information included verbal, written and electronic data concerning patients, staff and hospital business. The policy said that disclosure without authorization would result in disciplinary action up to and including dismissal. 

During the hearing, the grievor claimed to be unaware that the suicide victim was a patient. Arbitrator Levinson upheld the discharge saying that the grievor had “constructive knowledge” that the victim was a patient and that the grievor’s actions were culpable. In addition, the arbitrator noted that the grievor was not remorseful and did not fully accept responsibility for his misconduct. This undermined positive rehabilitative prospects. Although noting that there might have been some “spur of the moment” lack of judgment on the grievor’s part, Arbitrator Levinson found that once the photos were posted on Facebook, they had the “hallmark of premeditation”, given the passage of time between when the pictures were taken and when they were posted, and given the fact that they were posted during the grievor’s break. Arbitrator Levinson said:  

…By his actions of taking the pictures and posting them on his Facebook page with comments that others viewed, Mr. Brathwaite without any justification has put his own self-interest and feelings ahead of the well-known, the well-understood and the all-encompassing fundamental obligation on employees to maintain the confidentiality of patient information. ...

Social media is here to stay and the Credit Valley Hospital decision confirms that employers in all businesses where information must be treated with confidence must have policies and disciplinary consequences in place to limit their liability and to effectively redress a breach. The employer’s best defence will be to have a confidentiality policy in place as addressed in Tips on what your confidential information policies must have. In addition, employers today should implement a social media policy to drive the point home further. Such a policy should specifically prohibit defamatory postings relating to the employer or a co-worker; insubordinate or insolent comments; or any social media posting that would damage the employer’s reputation. A recent example of co-worker harassment, even though occurring during off-work hours, that resulted in discharge is discussed in our recent blog Keep your Facebook comments to yourself... or better yet, don’t put them out there at all

As with any other policy, a social media policy must be communicated, involve some training and acknowledgement and must be consistently enforced.