Can your employer fire you if he discovers that you have a serious illness after the cyber attack on your hospital? No, according to employment lawyers. (Photo: Ministry of Health/Archives)

Can your employer fire you if he discovers that you have a serious illness after the cyber attack on your hospital? No, according to employment lawyers. (Photo: Ministry of Health/Archives)

An employer who finds out, following the cyber attack on a Luxembourg hospital, that his employee has serious health concerns cannot dismiss him. However, he could request an examination by the occupational health authorities on their fitness for work.

Across the border, Vivalia's hospitals in Belgium are still largely blocked after . What if this happens in Luxembourg and employee health data is leaked? Can an employer fire an employee if he learns that he has hidden a serious illness? Delano’s sister publication Paperjam discussed the topic with two lawyers specialised in labour law.

Does an employee have an obligation to inform their employer if they have a serious health problem?

"No," say labour lawyers Nadia Chouhad and "This is a private matter.”

And when they are aware of this illness before being hired?

The two lawyers agree that this is not the case either. The question cannot be asked during the job interview either, adds Chouhad.

"This is why the Labour Code provides for a compulsory medical examination," says Castegnaro: "At the end of this examination, the doctor declares the employee fit or unfit for the job, without giving the employer any further details about the employee's state of health. If the employee is not fit and the employment contract has already started, it will be terminated automatically without any intervention from the employer.”

Some employees simply have to fill in a questionnaire. What happens if they don't fill in some of their history?

"If something happens to the employee in the course of their work in the future and a history is discovered that they had hidden, the employer cannot be held responsible,” says Chouhad.

Can health status be a condition of employment?

"There are jobs that require intense physical effort. Some are high-risk positions, such as airline pilots,” says Chouhad. “In this case, physical tests are carried out by a doctor.”

An employee who learns of a health problem after being hired does not have to inform his employer. But should they notify the occupational health service, especially in the case of a high-risk job?

"Either they are ill and cannot work. Or they are not ill," the lawyer reasoned. "Perhaps they have received information, in which case it is up to them to make arrangements to go for tests or to be unable to work if they have to undergo treatment. Again, they have no obligation to inform their employer.”

Let's go back to the example of the cyber attack on a hospital. If an employer learns in this way that one of their employees is suffering from a serious illness, which could affect their presence in the office or their abilities, can they dismiss them?

No, according to the two lawyers. That would be "discrimination", says Chouhad. However, "if it turns out that they could be unfit for the job, all the employer has to do is have the employee re-examined by the occupational physician.”

And if he has become unfit for the job?

The first option would be internal reclassification. "If there is no suitable post, we talk about external reclassification. The contract is terminated and the employee returns to the labour market," the lawyer explains. They then become a "job seeker. They will receive the same remuneration as a person who has been reclassified and Adem will have to find suitable jobs for them”, unless they are unable to work.

What about an employer who finds out in this way that an employee is pregnant?

The employer cannot dismiss a person because she is pregnant. But to be protected against such a dismissal, the employee must have provided the employer with a medical certificate confirming her pregnancy. There is no deadline, "the sooner she does this, the sooner she is protected", advises Chouhad. If her employer dismisses her (for another reason) before she has had time to send him the information, she still has eight days to send him the medical certificate. "In this case, the dismissal is cancelled without prejudice to the employer. And if the employer refuses to cancel the dismissal, the pregnant person still has "15 days to go to court and request the nullity of the dismissal".

If an employee, still fit for work, informs their employer of numerous upcoming absences due to health concerns, can the employer dismiss them?

"The employee has the right to be absent for health reasons, absences covered by medical certificates," explains Castegnaro. They then remains "protected for 26 weeks of uninterrupted absence for illness". Then, the employer has "in principle the right to dismiss the employee, provided that the absence disturbs the proper functioning of the company and that it can no longer count on the presence or return of the employee". Here again, the employee could be declared “unfit for work by the occupational physician” and thus reclassified.

And in the private sphere? What can an insurance company do, for example, if it learns, after a data leak, that a customer lied to it about their state of health when signing a contract?

"We have to see how the insurance company obtained this information," says Chouhad. If it is responsible for the cyber-attack, these are "illegal means". If it received this information without looking for it, "there would be a debate", as it did not use illegal means to obtain it, but these are still illegally disclosed documents. In any case, the insurance company has "the possibility to open an investigation and to question the insurance contract. It will not use the information, but ask the person to do some examinations." The person who has defrauded risks "cancellation of the contract, payment of compensation if they have received premiums in this context", or penalties ranging from fines to imprisonment "depending on the seriousness and if the insurer files a complaint".

Whether at work, with their bank or even with their relatives, can the person who suffers harm as a result of the disclosure of their health data take action against the hospital?

"In terms of the law, the hospital would be liable for the damage," says the lawyer. In the case of someone who has defrauded their bank or insurance company, the question of damage arises. "In any case, the person could file a complaint against the hospital for data breach, lack of security.” For Chouhad, it is up to the hospital, in the event of a data leak, to "warn the person concerned and take the necessary steps to ensure that they do not suffer any harm".

This story was first published in French on . It has been translated and edited for Delano.