Protect the Privacy of Employees with Coronavirus

If the new coronavirus, which causes the disease known as COVID-19, becomes an increasing presence in U.S. workplaces, employers will need to take steps to keep employees' health information confidential, as required by the Health Insurance Portability and Accountability Act (HIPAA), and maintain a safe worksite in compliance with the Occupational Safety and Health Act (OSH Act), employment lawyers advise.

"The uncertainty associated with the coronavirus may motivate employers to ask employees about their medical conditions. We caution employers to remember that inquiries about an employee's disability status are limited," wrote attorney Carrie B. Cherveny, senior vice president for strategic client solutions and compliance at Hub International, a global insurance brokerage, and Mingee Kim, senior vice president and certified leave management specialist at the firm.

"In a nutshell, if the employer learns of the employee's medical information, condition, diagnosis, etc., through the health plan, then that information is likely protected under HIPAA," they noted. "Employers may make disability-related inquiries and require medical examinations only if inquiries and examinations are 'job related and consistent with business necessity.' "

Moreover, under the confidentiality provisions of HIPAA and related laws, "only those who 'need to know' may know about the diagnosis," Cherveny and Kim advised. "It may be very difficult to demonstrate that, for example, a line manager 'needed to know' the employee's specific diagnosis. Instead, the line manager likely only needs to know that the employee will be on a leave of absence and not able to work."

Pandemics, however, may alter those practices. Mark J. Neuberger, a litigation lawyer with Foley & Lardner in Miami, said that "when an employee comes to you with a health condition, that's confidential information. But [with the coronavirus], there may be an obligation to tell people" that a colleague has tested positive for the virus.

"Work with local public health officials to get guidance on how to do that," he suggested. HIPAA generally permits a health plan to disclose protected health information (PHI) to a public health authority to prevent or control the spread of an infectious disease.

HIPAA lets health plans disclose protected health information (PHI) to public health authorities.

Public health officials may decide to contact anyone who has been exposed to a co-worker with the virus, doing so "under the auspices of a public health issue," Neuberger said. "That's good for employers," he noted, as it relieves them of liability for revealing PHI while safeguarding employees' health.

Jennifer Ho, vice president of human resources at Ascentis, a human capital management software firm based in Minneapolis, encourages employers to "follow your normal HIPAA privacy policies. The less invasive you can be of somebody's privacy, the better."

But maintaining discretion doesn't preclude employees from creating policies addressing what employees should do when they're showing symptoms such as a cough and fever, she explained. "You can send them home with guidelines to return to work when they have been symptom-free for a period of 24 hours."

[SHRM members-only policy: HIPAA Medical Privacy Policy: Basic Requirements]

Other Privacy Issues

"At present, someone who tests positive for COVID-19 will likely be required by applicable health authorities to disclose that to his or her employer," Bonnie Puckett and Simon McMenemy, attorneys at law firm Ogletree Deakins, advised.

But what if employers suspect that their employees are not sharing this information?

Some companies have contemplated mandating routine temperature screenings or asking for results of medical examinations. That practice, however, is likely illegal under U.S. and European Union law.

Can employers ask employees about personal travel? "As long as areas of heightened epidemic concentration exist, employers can articulate a legitimate interest in asking employees about their travel to those areas in the name of keeping their workforces safe," Puckett and McMenemy wrote.

What about asking about employees' family members' travel? One approach is to encourage employees to disclose any potential heightened risk of exposure. Employers can also share with employees links to Centers for Disease Control and Prevention (CDC) guidelines that discuss the risks of foreign travel.

OSHA Safety Requirements

The Occupational Safety and Health Administration (OSHA) enforces the OSH Act, which requires employers to take reasonable precautions to ensure employee safety and prohibits employers from placing their employees in situations likely to cause serious physical harm or death.

With regard to the coronavirus, where so much remains unknown, "that leaves employers in a bit of a gray area," said Aaron Goldstein, a partner in the Seattle office of law firm Dorsey. However, he advised that prudent steps for employers could include:

• Allowing high risk individuals to preemptively begin working from home if the COVID-19 virus starts spreading widely.
  

• Providing hand sanitizer and encouraging employees to wash their hands frequently and to use hand sanitizer throughout work areas.
  

• Cleaning and disinfecting frequently touched objects and surfaces using a household cleaning spray or wipe. At the worksite, these surfaces could include equipment shared by employees and individuals' keyboards and phones.
  

• If someone at the worksite reports becoming ill, disinfecting the work area and requiring those who work closely with the ill worker to stay home for 14 days.
  

"Reasonable precautions," however, can change depending on the circumstances. With regard to the coronavirus, employers are advised to follow CDC guidelines, now being updated daily, and to share this information with employees as appropriate.

Related SHRM Articles:

Health, Wellness and Leave Benefits Help Employees with Coronavirus, SHRM Online, March 2020

Coronavirus Prompts Companies to Telework, SHRM Online, March 2020

Coronavirus Outbreak Prompts Employers to Review Sick Leave Policies, SHRM Online, March 2020