In August 2021, the National Border Patrol Council (NBPC) learned that CBP was sending reports containing employee medical information to hundreds of managers and supervisors, among others in USBP, OFO, AMO, and other components, who did not have a need to know the employees’ medical information.

A CBP office created a daily Hospitalized Employee Report and disseminated it far and wide across CBP, containing employee names and a day-by-day breakdown of their status in the hospital, including medical procedures performed, vitals, and more, until the employee was released or passed away. This report was sent to approximately 165 recipients daily, regardless of the sick employee’s component. For example, the report contained information about Border Patrol agents (BPA), yet leadership within OFO, AMO, OFO’s Budget Director, and leadership at LESC, among many others, received private medical information about BPAs

As the NBPC continued to investigate, we discovered that not only was this report being sent to the field, but stations were required to submit an SIR or ESR when an employee was hospitalized due to COVID-19, and these were all sent to their respective distribution lists. We discovered that USBP maintained an SIR distribution list that went to over 450 USBP employees, who could all see employee medical information contained within the SIRs and ESRs.

The union filed a union-initiated grievance alleging violations of the Rehabilitation Act, the Privacy Act, and the Federal Employees Compensation Act.  As a remedy, we insisted that the agency stop collecting and distributing this information to people without an official need to know and that the impacted employees be notified of the disclosure, among others. CBP indicated they stopped collecting and disseminating this information via this report, SIRs, and ESRs. However, despite this, CBP’s Privacy Officer inexplicably determined that the employees who received this medical information did indeed have a need to know of the information and that the impacted employees should not be notified.

The NBPC believed this was nonsense, so we filed for arbitration and settled the matter with the agency last week. CBP agreed to notify each of the impacted employees that their medical information was collected and disseminated and the information contained within the hospitalization report within 60 days of the effective date of the agreement.

If you receive this notification and have questions, please contact your Union Representative!