> I am trying to determine the extent of an employee's liability, if any,
> v. liability to the organization, if it can be proven that the employee
> 1) inadvertently divulged the personal information or personal health
> information of a customer and 2) if they willfully or maliciously
> divulged the information.  I have read in some cases that there is no
> liability to the employee if it is inadvertent.


Well, I'm no attorney, and I didn't even sleep in a Holiday Inn Express last
night, BUT....

The responsibility for controlling the use and access to the information
belongs to the organization, not the employee.  If the employee was allowed
to have access to the information as a part of their assigned duties and
they did something inappropriate with the information and it can be PROVEN,
then it's a two-edged sword.

The person whose information was used improperly would have a case against
the organization; the organization would have a case against the employee.

Also, I would think "willfully and maliciously" would have to be determined
in a court of law, wouldn't you?  You have to establish intent...

Same would be true about "inadvertent"... I mean, if there are guidelines
about who is entitled to what information, how they need to go about
requesting it and who needs to approve the request before the information is
released (checks and balances), it's not easy to "inadvertently" release
information.

Just my opinion...

Larry
--
Larry Medina
Danville, CA
RIM Professional since 1972

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance