If a staff member discloses private information that requires you to breach an employee’s confidentiality, consider following these steps first.

As an HR leader, you’re often trusted with employees’ private information. 

But what if you learn information about an employee that you think others need to know about? How do you determine whether or not to breach confidentiality?

Lisa Mannering CPHR, employment lawyer and HR Consultant at Langtree Legal, says HR is in a particularly tricky position in this scenario.

“There’s not usually a particular obligation for HR to disclose [employee information], but they do  sit in such a difficult position, as they’re both an employee and supporting other employees, but they’re also a representative of the organisation,” says Mannering, who is also AHRI’s Cairns Network Co-Convenor and Queensland State Councilor.

However, there are some serious circumstances when it would be called for. Here are four common situations that could require an HR professional to breach confidentiality. 

1. An employee is at risk of harming themselves or another person

This is the most likely scenario that could lead HR to breach confidentiality, says Mannering. 

She emphasises that the risk must be both serious and imminent in order to justify a confidentiality breach.

“If someone indicates that they may harm themselves and there’s not necessarily a sense of urgency, the way that [HR should] respond is going to be different than to someone who presents an immediate threat,” she says.

HR professionals should therefore ensure they have all the information at hand to ascertain whether the risk is both serious and imminent. It would be best-practice to engage an expert to help to determine this. 

However, Mannering says there are some things HR can do themselves if expert help is not available:

• Find out about the nature of the threat
• Conduct a risk assessment to determine how likely it is that the threat will take place
• Put measures in place to try and de-escalate the situation before breaching confidentiality. For example, you could encourage the employee to seek help themselves, or seek their consent to make the disclosure and notify a family member or friend who will be able to support them. 

If you’ve determined that harm is likely to occur, it might be necessary to report it to someone internally, such as security, or to call emergency services.

But this doesn’t mean sharing all the information you have about the situation.

“Consider the extent of the disclosure. If someone comes to HR and explains their personal situation, HR needs to consider that the first and primary consideration is the safety of the person and/or people they are threatening, and then work backwards from that. So it may not be appropriate or necessary to share the employee’s background,” says Mannering.

For example, if an employee divulges detail about their personal life, such as a relationship breakdown or financial pressures, it might not be necessary for HR to pass that information on if it’s not critical to keeping an employee or someone else safe.

“If there’s an indication that someone may harm themselves at a particular location, the primary response must be making sure that someone is there to de-escalate the situation. That person may not necessarily need to know the full story as to how the employee got that point.”

“The information you are intending to disclose will likely be very personal and private information, so it absolutely needs to be discussed with the person first.” – Lisa Mannering CPHR

If a non-immediate threat has been directed towards someone else in the workplace, HR should seek to understand why the threat has emerged, says Mannering.

“Investigate whether there is the means for the threat to be carried out and make sure that the other person who is the subject of the threat is in a safe position to prevent harm from occurring.”

In a situation where the threat is directed towards another person external to the workplace, the decision about whether to step in carries additional complexities.

“That’s a really tricky one,” says Mannering. “There’s a boundary between work and home. But again, it’s about working out the likelihood of the threat and why it’s at that point.”

However, in situations where an immediate and serious threat exists, it would be entirely appropriate and necessary for HR to seek assistance or contact emergency services, says Mannering.

If you or someone you know needs help, call Lifeline on 13 11 14. If someone is in immediate danger, call Triple Zero (000).

2. Employee has a conflict of interest

What if an employee comes to HR and says they intend to start their own company, and the employee’s proposed business is in competition with the business of the employer? That would constitute a conflict of interest and could require HR to share this information with their manager. 

“There is a risk that the employee could bad mouth the organisation to try and get customers. This could impact on the organisation’s reputation,” says Mannering.

This particular scenario speaks to the importance of people understanding HR’s role in the organisation from the outset.

“If you have clear policies and open and honest conversations, employees should know that HR is a representative of the organisation.

“So if someone comes to HR and says, ‘Here is a situation which may pose a conflict of interest,’ HR can help them to establish whether that presents a problem, but at the end of the day, that employee is still coming to a representative of the employer.”

Mannering also recommends setting out how conflicts of interest are managed in an employment contract. This will help employees to know how potential conflicts will be dealt with before they arise.

3. An employee informs HR that they’ve broken the law

If an employee privately discloses to you that they’ve broken the law, how should you decide whether to keep that information to yourself or share it with someone else?

Mannering says it comes down to how the employee’s illegal activity relates to their line of work.

“If you found out that someone has a speeding ticket, is it necessary to disclose that to a CEO if it’s not relevant to their job? Possibly not. But if they were operating a company vehicle at the time, then the information may be relevant to enforcing a policy or taking disciplinary action. So in that case, the fact that the employee has broken the law may need to be raised with the employee’s manager. Going further, if the offence caused the employee to lose their licence, then this may be relevant for a manager to know, because the employee may no longer be able to drive a company vehicle or drive themselves between jobs.”

“Breaching confidentiality is like breaking a glass. Once it’s done, there is no going back.” – Lisa Mannering CPHR

There are some states in which HR is legally mandated to report certain crimes.

“There can be statutory requirements around mandatory reporting. So some illegal actions might need to be reported to the Crime and Corruption Commission, or legislation might specifically outline a mandatory legislative obligation to report.”

If an employer summarily dismisses an employee for committing a criminal act at work, there may be reason to report it to the police.

Under the federal Small Business Fair Dismissal Code, for a summary dismissal to be deemed fair, “it is sufficient, though not essential, that an allegation of theft, fraud or violence be reported to the police. Of course the employer must have reasonable grounds for making the report”.

Mannering therefore says that “a report to the police on these types of matters can be used for justifying termination, as long as the employer has acted reasonably”.

She notes that broadly, however, there is no requirement for an organisation to report a criminal offence and whether an organisation chooses to voluntarily report a matter is a decision that needs to be carefully considered.

In some instances, it may be necessary for HR to breach an employee’s confidentiality for the purpose of investigating an alleged crime that took place in a workplace context.

Mannering presents a hypothetical scenario: “Let’s say employee A provides information that employee B may have committed a crime against employee C – for example, at a work event employee B allegedly assaulted employee C – but employee C told employee A not to do anything about it. HR may need to breach employee A’s confidentiality to investigate the matter, and speak with employee C to find out what occurred.”

For an employer to uphold their fundamental duty to provide a safe workplace, this type of disclosure would need to be fully investigated, with appropriate support provided to the relevant employees, says Mannering.

This doesn’t, however, justify the information being shared more widely across the organisation.

HR should ensure that any disclosure made is only to those people strictly necessary to investigate and resolve the matter, says Mannering.

“Expert assistance should be sought, as it may be the case that if there are reasonable grounds to believe it did occur, and employee C does not want to report it to the police themselves, then the employer might decide to.”

4. When HR wants to blow the whistle

People often think they can sneak off to a journalist, disclose an issue like bullying or sexual misconduct that’s happened in the workplace, and not pay the consequences, says Mannering.

But this is typically a far cry from reality.

“It’s really risky business,” says Mannering. While she doesn’t want to deter people from holding companies to account – and whistleblowing can be a powerful way to bring about change – employees should tread with caution.

“Federal provisions only cover certain company specific matters, such as for ASIC or tax, but each state has its own whistleblowing provisions. There are tight provisions as to when an employee can reveal confidential information to the media. 

“You would have had to have exhausted every other internal and external means available to you in order to protect yourself by the time you get to the media,” says Mannering.

There are also certain timeframes that you have to keep in mind. 

Before you go to the media, for example, under the Corporations Act 2001, ninety days needs to have passed between the time you reported it to ASIC or APRA, and you reasonably believe no action has been taken since that time.”

Key points before you breach confidentiality

The situations that may require HR to breach confidentiality are numerous and varied (and this article isn’t intended to provide an exhaustive list), but there are some key points to keep in mind before you proceed with a breach, regardless of the situation at hand. 

To sense-check your decision, Mannering suggests considering:

• If there is a legal obligation or duty to disclose the information?If there is no legal obligation or duty, then it may be necessary to consider whether there is an ethical duty.
  
  
• Whether the information falls under the bounds of confidentiality.
  
  If HR finds out information that has a direct impact on the organisation, but the information is not something which could be considered confidential (such as personal or medical information, or commercial/trade secrets), then it’s unlikely you would be breaching confidentiality by disclosing it, says Mannering.”For example, if your company is part of a supply chain, and you have identified a supplier along the chain who is not paying the right amount which may impact others complying with their obligations, disclosing that information may not be confidential information if it is raised with a manager who is aware of the supply chain arrangements, or another party in the supply chain who also has knowledge of the supply chain arrangements.”Raising concerns outside the organisation or supply chain could have different implications in terms of reputation or defamation, so it would still be worth seeking advice about discussing the information first.”
• Is there an alternative to breaching their confidentiality? If their safety is a concern, could you support the person to help themselves?For example, would they agree to establishing a safety plan with a psychologist and putting steps in place to keep them safe?
• Can you obtain the employee’s consent to disclose?“If you’re talking to someone and you think there is a risk of them harming someone else or harming themselves, have an honest conversation with them. Try to get them on board with the idea of engaging external assistance or engaging with an EAP.”An employer can help to facilitate that. At least then the employee has retained some of the power to feel like they are able to make their own decision.”
• Is it possible to limit what’s disclosed to still protect the employee? Just share part of the information required to de-escalate the situation.
  

HR should also ensure they have all the information to form a full picture of the situation.

“Breaching confidentiality is like breaking a glass. Once it’s done, there is no going back. So make sure you have all the information first so that you are fully informed to take that step, and to be confident in your decision.”

Deciding to breach an employee’s confidentiality isn’t one to take lightly. Know your legal obligations before you take this step. Book in for AHRI’s short course, Introduction to HR law, on 1 June.