Privacy and pandemic planning: a few prudent considerations for organizations

As the international community readies itself for a second wave of the H1N1 flu pandemic, wise organizations are brushing off their business continuity plans (BCPs) and reviewing their applicability to a different kind of threat. Unlike traditional business continuity or disaster recovery planning, pandemic planning requires management for a prolonged but unidentified period of time rather than for the single risk event that traditional business continuity planning tends to focus on. The focus of pandemic planning is on the people within an organization rather than buildings, structures, or environmental. Shifting the focus of your BCP to incorporate the organization’s employees requires a gentle reminder that the privacy of employees must remain paramount, even during business continuity management.

Privacy professionals must remain vigilant in the wake of the H1N1 flu pandemic to ensure the privacy rights of employees remain intact during pandemic response activities. An all-hazards approach to business continuity planning in combination with taking a few common-sense approaches to privacy, will assist in easing the stress of the flu pandemic on organizations.

Privacy professionals need to work with the business continuity planners and human resource departments to clarify any questions regarding the collection, use, and disclosure of personal employee information during the development of organizational BCP plans that include considerations for pandemic planning. The challenge is to balance these needs with the needs of the organization to plan for the potential of prolonged staff shortages caused by employee illness, and, potentially, employees staying home from work to care for loved ones. Due to the way in which the illness spreads, a single department within an organization may be severely affected while other areas are less affected, or not affected at all.

During times of crisis, management organizations may be tempted to collect a variety of information from staff, such as their diagnoses and whether they have received the H1N1 vaccine. Jurisdictional privacy legislation may, however, prevent this collection. In Canada, for example, this is likely not a reasonable collection of information under provincial or federal privacy legislation.

Organizations may be tempted to use personal information contained in HR files, such as the number of dependents within staff members’ households or personal contact information for pandemic planning or response purposes. This may pose a privacy threat to staff and a legislative or policy breach to organizations. Finally, organizations may be tempted to disclose information about staff that they would not normally consider disclosing in non-pandemic situations, such as an employee diagnosis or reason for an emplyee’s absence at work. Privacy professionals can, instead, urge their organizations to consider a twofold approach that focuses on information dissemination and careful preplanning to manage the flu pandemic.

An informed employee has the information he needs to care for himself and his family members. Organiza-tions can provide their staff with information regarding safe hand washing and other basic flu prevention techniques, as well as local government hotlines or other resources to help them understand the best flu prevention methods. If the flu vaccine is available in your area, consider posters in common areas with contact information on how and where they can receive the vaccine. A thorough communication plan will empower employees to manage their own risks, as well as those in their family, and in turn keep everyone healthy and at work.

Empowering employees with critical information regarding the H1N1 flu virus can be combined with the implementation of some basic policies and techniques to be used within the office. Offering hand sanitizer in break and meeting rooms and asking employees

to stay home when they are sick are two simple methods that can be used to further reduce the infection rates in the workplace. Clear communication with employees is a key element in pandemic preparedness.

Perhaps the most important privacy protection during a pandemic is a properly tailored all-hazard business continuity plan that requires little or no additional collection, use, or disclosure of employee information. A holistic approach that identifies potential risks and their impacts to business operations, including the risk of a pandemic, will provide an organization with the tools it needs to respond to such a crisis. Specifically, the plan should consider prolonged staff shortages rather than the traditional disaster planning approaches that tend to focus only on the infrastructure of an organization and its ability to detail a specific timeline for the full resumption of business. Critical process and position identification, properly aligned with well-rounded policies and procedures and an appropriate plan for full or partial plan implementation will best serve an organization during a flu pandemic. Careful pre-planning that is flexible and adaptive will reward employers when faced with a flu pandemic or other unexpected disruption to their business.

Prior to deciding to collect, use, or disclose personal employee information in an attempt to manage a pandemic situation, organizations need to understand the requirements of the privacy legislation by which they are bound. It is advisable to seek the assistance of privacy professionals. Organizations need to carefully plan their response to a pandemic and consider the careful balance between the protection of employee privacy and the continuation of business. Privacy professionals must remain vigilant in their quest to protect personal information and must be prepared to advise their organizations when plans may infringe on the privacy rights of employees.

The federal privacy commissioner of Canada and the information and privacy commissioners of the provinces of Alberta and British Columbia recently released a publication titled “

” to assist organizations in working through some of these issues.