Employers face privacy restrictions on disclosure of medical information that complicate efforts to notify workers about possible coronavirus exposure in the workplace, lawyers said.
Some companies, including
“The law is extremely clear that an employer cannot disclose any employee’s medical information to anyone except under limited circumstances,” said David Fram, who directs ADA and equal opportunity services at the National Employment Law Institute. “But if the employer tells workers that they might have been exposed to somebody with Covid-19, that’s not disclosing that person’s medical information.”
Companies must account for workers’ privacy rights in the design and enforcement of coronavirus safety protocols to avoid legal liability for breaching employee confidentiality. Workers at many companies have called for employers to notify them when a colleague tests positive for Covid-19, particularly in public-facing jobs in the service sector, such as in supermarkets, and a notification policy could provide workers with peace of mind and help improve morale as businesses reopen.
The Centers for Disease Control and Prevention advised that if employers confirm that a worker contracted Covid-19, then they should inform other employees of their possible exposure. Guidance from the Equal Employment Opportunity Commission, which enforces workplace civil rights laws, has provided some clarity about temperature checks, Covid-19 testing, and contact tracing, but the rules for topics like immunity testing remain murky, several lawyers who counsel companies told Bloomberg Law.
Furthermore, the Occupational Safety and Health Administration, the CDC, and public health agencies don’t mandate that employers share a worker’s Covid-19 diagnosis with other employees, said Amy Leopard, an attorney at Bradley who advises companies on health privacy issues.
Employers that notify workers about contact with infected colleagues should do so without identifying the employee, Leopard said. That precaution is necessary to comply with legal privacy protections and removes an obstacle that might otherwise discourage employees from sharing their diagnoses, she said.
HIPAA Not for Employers
In addition to the ADA, employers have to navigate state privacy statutes, which vary widely depending on the state, attorneys said. Digital contact tracing via smartphone-based tools raises its own privacy issues. Companies should also look out for invasion of privacy “tort” lawsuits brought under state common law, they said.
But the Health Insurance Portability and Accountability Act—which protects against use and disclosure of personal health information, with penalties of up to $1.5 million—doesn’t typically apply to employers, lawyers said.
HIPAA’s privacy restrictions cover health plans, health-care clearinghouses, and health-care providers that conduct certain transactions electronically, according to the Department of Health and Human Services.
“It’s actually a very limited statute,” said Iliana Peters, an attorney at Polsinelli who counsels companies on health information privacy.
HIPAA can be a consideration for employers when they’re attempting to access workers’ health records for Covid-19 diagnoses, Peters said. Companies have a right to the results if they’re paying for the testing, otherwise they would need the employee’s consent, she said.
The privacy restrictions on health records require employers to protect a sick worker’s identity as much as possible, keeping it strictly on a need-to-know basis, lawyers said. Covid-19 testing information should be maintained in medical files separate from each worker’s personnel records, they said.
Contact-tracing programs comply with worker privacy protections as long as they notify workers of exposure without disclosing the specific identity of the person with a confirmed diagnosis, said Stephen Riga, an attorney at management-side firm Ogletree Deakins.
Employers can share de-identified exposure information even in those situations when workers are likely to figure out which of their colleagues was diagnosed with Covid-19, Riga said.
But an “accidental outing” of a particular worker’s health information raises red flags, said Anna Rivera, a plaintiffs’ attorney at Barajas & Rivera. Whether such a situation would make an employer liable for a privacy violation, however, is a “very fact-specific question” that takes into account what occurred and current government guidance on disclosures, she said.
In an exception to disability law’s privacy safeguards, the EEOC said in April that employers can disclose to public health agencies the name of an employee who has Covid-19.
Workers Seek Infection Info
Despite privacy issues related to Covid-19 notifications in the workplace, some workers have been willing to go to court to force their employers to adopt programs to alert those who may have been exposed to infected coworkers.
Unions can give workers some say over how employers handle testing, contact tracing, and diagnosis information.
Pandemic safety protocols are probably a mandatory subject of bargaining, meaning companies that want to impose them must notify the union representing their workers and give them a chance to negotiate, said Marshall Babson, a labor lawyer at management-side firm Seyfarth Shaw.
The argument that testing and tracing protocols are covered by an emergency response exception to employers’ bargaining obligations “gets weaker every day, as the fact of the pandemic becomes more a part of the working landscape,” said Joseph Richardson, who represents unions at Willig, Williams & Davidson.
In light of the issues relating to privacy and ADA compliance raised by employers disclosing the identities of infected workers, unions are demanding—and some employers are providing—the number of confirmed cases and where those employees work, Richardson said. That information, he said, allows the union to monitor spread within a facility.
—With assistance from Ayanna Alexander and Dan Stoller.