The Company That Cared Too Much


This case discusses how a company handled a very sensitive issue about confidentiality of health information and the professional responsibilities of health professionals.


Lynda is a chemist who works for Brock Plastics, a large company in New York. Brock Plastics has a reputation for treating its employees extremely well. In addition to offering generous benefits and bonuses, the company has an on-site occupational health and fitness center that is staffed by a team of company doctors, nurses, nutritionists and fitness experts. This team is responsible for providing free health care, health promotion programs and fitness programs for Brock's employees.

Last year Lynda scheduled an appointment for an annual physical exam with Mary Wolf, the company's occupational health nurse The exam includes a thorough assessment of the employee's health in the prior year. During the exam Lynda informed Wolf that she has been going through a difficult time with her mother, who has been diagnosed with severe depression but has benefited little from her current treatment. Lynda, who is an extremely private person, rarely discusses her personal problems with her co-workers. However, she was relieved to be able to share with Wolf her feelings about the stress of handling her mother's condition. Wolf lent an empathetic ear and provided sound advice for possible psychotherapy and pharmacological treatments for Lynda's mother.

A few weeks after Lynda had her health exam she began receiving pamphlets, through intra-office mail, about a workshop that the company was offering on the current treatments of depression. Lynda shares a large cubicle with two other workers who love to gossip. She was concerned that her co-workers would see the pamphlets and ask questions. As a result, Lynda made an appointment with Wolf to discuss the intra-office mailings.

When Lynda met with Wolf, she expressed her discomfort about receiving personal health information through the company's intra-office mail. Wolf explained that the occupational health department conducts targeted mailings according to health problems that that employees mention about themselves or family members during health exams. When the company decided to offer a class on the latest treatments for depression, Lynda was tagged as an employee to receive the information.

Wolf decided to take this issue back to the team of health care specialists in her department. Some team members reported that other employees had expressed similar concerns. However, they knew how effective the mailings were for recruiting employees into beneficial programs. Furthermore, employees more typically thanked them for remembering that they had a particular health problem that needed attention.

After thoughtful consideration, the team decided to ask employees during their health exams if they would be interested in receiving health information through company mail. If the employees said no, they were tagged in the computer tracking system as ineligible to receive mailings. After one year of the new process, approximately 35 percent of all employees asked during an exam declined having personal health information sent to them through intra-office mail.

Discussion Questions

  1. Did the company nurse violate confidentiality by sending unsolicited health promotion information to Lynda through intra-office mail?
  2. What steps did Mary and the rest of the occupational health team take to ensure that they were ethical in their health care delivery and research practices?
  3. Did the occupational health department deceive employees by not informing them that they would be sent unsolicited health promotion information through intra-office mail?
  4. Should employees be informed when their personal health information is being used to determine which health promotion classes should offered by the company?
  5. Should employees be informed of the occupational health department's confidentiality policies and procedures?

Used with permission of Association for Practical and Professional Ethics. Case drawn from Research Ethics: Cases and Commentaries, Vol. 6, 2002.

. . The Company That Cared Too Much. Online Ethics Center. DOI:

This case is more about the professional responsibilities of health professionals, particularly their obligation to safeguard the confidentiality of medical and health information, than about issues in research ethics. However, the case does suggest some issues for research ethics in the private sector.

Suppose a private corporation decides to conduct research to determine what it can do to improve employees' health as a means of enhancing the corporation's productivity. Imagine, for example, that a company surveys its employees to determine whether its workforce is experiencing significant sleep deprivation. The company might intend to use such information to plan educational programs for employees on the importance of adequate sleep. Or, to take quite a different example, perhaps the corporation conducts marketing research involving human subjects to determine interest in a product line it is considering developing.

In general, scientific research conducted by private corporations is not legally subject to federal guidelines for research ethics. The exceptions include instances in which the corporation uses federal funds in the research; is developing drugs, which must pass FDA guidelines; or hires outside researchers who are themselves subject to federal guidelines. If the researchers are interested in publishing their results in certain journals, New England Journal of Medicine, for example, they may also be required to show the research was conducted ethically under guidelines comparable to the federal guidelines (also referred to as the Common Rule) in order for the paper to be accepted for publication.

Even if the company is not subject to federal research guidelines, however, one can certainly argue that such research guidelines are morally obligatory, even if not legally required. The moral arguments for the Common Rule still apply; they are not predicated on the guidelines being required by law. Discussing a case such as this is a useful antidote to those might think that legal compliance and moral obligation are one and the same; if there is no legal requirement to follow research guidelines, then there is no moral obligation to conduct research in accordance with accepted moral guidelines.

So, for example, a company would be morally obliged to obtain informed and voluntary consent from its employees in order to conduct research on them. Obtaining voluntary consent might be tricky, since workers are in a vulnerable position when their company "invites" them to participate in a research project. The company would also be morally obliged to follow all other relevant ethical guidelines for conducting research on human subjects. The exact content of those guidelines may differ somewhat from those in the natural sciences and may be more akin to those accepted in social science research on human subjects.

Author: Brian Schrag, Indiana University.

Most companies in the United States spend a great deal of time and energy collecting data on their employees; whether it is demographic data about workers' ages or work histories, or health data about injuries and illness that workers may experience on the job. Since the Occupational Safety and Health Act was implemented in 1970, the Department of Labor has required companies to keep track of certain work-related health problems that employees experience, in addition to certain treatments, and whether or not time off from work was required as a result of injuries. However, only rather recently have companies utilized these data to implement prevention strategies and health care programs. This case study is intended to generate discussion about how a company handled a very sensitive issue about confidentiality of health information.

Brock Plastics has been described as a company that is well known for its great benefits and bonuses. In addition, the company provides an on-site fitness club and health unit that is staffed with professionals to assist employees with their diet, stress and personal health issues. Brock Plastics has gone above and beyond what is required in the United States by the Occupational Safety and Health Act. However, this company has followed a common trend in corporate America where companies have begun to see the positive impact in profits by treating their employees as valuable commodities. Companies that have happy and healthy employees are more likely to have highly productive employees.

Occupational health professionals are trained to keep all health information about an employee confidential. Only in circumstances where a health issue is related to a workplace exposure is an occupational health professional permitted to share health information with the employee's manager. For example, if Lynda missed work due to back problems related to her job, occupational health professionals would be allowed to share that information with Lynda's manager in order to improve Lynda's work environment. However, if Lynda missed work due to back problems unrelated to her job, the occupational health professionals would not be allowed to share that information with anyone within the company without Lynda's permission.

According to these rules, did Mary violate confidentiality by sending health promotion information to Lynda through intra-office mail? Technically, no, because Mary did not explicitly share with others the information that Lynda's mother was severely depressed. However, the message contained the implied message that Lynda has a problem with depression. When Mary sent the information without permission, she risked breaching confidentiality. If co-workers opened the letter or saw the information on Lynda's desk, they may have suspected that Lynda was having problems with depression. Therefore, Mary and her staff changed their practice of targeted mailings, ensuring that they obtained permission to mail information before doing so.

The second significant issue in this case is the use of computerized health data in order to plan needed prevention programs by the company. Should Brock Plastics be responsible for sharing information with its employees about how their personal data are being used and stored? Should employees be informed that their personal health information is being used to plan programs? The company's intentions are good. Regardless of the fact that they want to care for the health of their employees in order to safeguard the bottom line, the end result is still the same. The employees are well cared for. However, Brock Plastics has not been forthright with its employees regarding the use of the data. If the company asked employees to provide permission for the use of personal data, they probably would find that some employees would not allow it to be used.

In the past five years, Congress has debated the issue of whether people should be informed about how their health information is utilized and stored by hospitals, insurance companies and corporations. In April 2001, the Department of Health and Human Services promulgated the Privacy Rule. Most health plans and health care providers that are covered by the rule must comply with the new requirements by April 2003. This measure will provide employees with more control over their health information by setting boundaries around the use and release of health records. In addition, it will establish appropriate safeguards that health care providers and others must observe to protect the privacy of health information. Lastly, it holds violators accountable, with civil and criminal penalties that can be imposed if they violate patients' privacy rights. For employees, it means that they will be able to make informed choices about how their personal health information is being used.

It is a positive move for companies like Brock Plastics to invest in the emotional and physical well being of their employees. However, companies must respect employees' rights with regard to their personal health information. Brock Plastics did the right thing by asking its employees if they wanted to have health information sent to them through intra-office mail. However, they still need to implement the process of informed consent for the use of their employees' health data.