Last night, the Department of Economic and Community Development (DECD) issued guidance identifying which businesses are essential under Governor Lamont’s Executive Order 7H.[1] Hospitals and other health care providers (including physician and dentist offices, walk-in care facilities and nursing homes) are, of course, among the businesses considered “essential.”
Clear enough. But must all employees of an essential business continue to work on-site? Executive Order 7H is ambiguous on this question, since it first orders “all” businesses and not-for-profit entities to implement work from home procedures, but later exempts essential businesses (and businesses providing essential goods, services or functions) from these restrictions.
The DECD guidance provides limited direction on how essential businesses should handle their workforce, noting that to the extent possible, employees of essential businesses “whose duties are not critical” to an essential business function described in the guidance should telecommute or utilize any work from home procedures available to them. Unfortunately, the guidance does little to shed light on what duties would be considered “not critical”[2]. Accordingly, health care providers are still in uncertain territory when it comes to making decisions about who should work from home.
Enforcement Discretion issued by the Office for Civil Rights (OCR) last week provides some clarity. OCR states that it will not impose penalties for noncompliance with the regulatory requirements under the Health Insurance Portability and Accountability Act (HIPAA) against covered health care providers in connection with the good faith provision of telehealth during the COVID-19 crisis. The Enforcement Discretion does not address the question of whether employees who are not providing patient care but who use protected health information (PHI) as part of their job (such as for billing) must come to the workplace to perform these functions or whether they too can comply with HIPAA by working remotely. However, FAQs issued by the OCR last week provide that the Enforcement Discretion does not affect the application of the HIPAA rules to other areas of health care outside of telehealth during the COVID-19 emergency, suggesting that employees who use PHI as part of their jobs may continue to work remotely only by using HIPAA-compliant technical solutions. For example, this would mean that transmissions of PHI must be encrypted, such as through a Virtual Private Network.
We will update this post as new information becomes available. In the meantime, please contact us if you have further questions on these developments.
[1] See also our prior blog providing initial guidance on the Executive Order.
[2] FAQs issued by the Governor on March 21, 2020 suggest that Executive Order 7H should be interpreted to allow all employees at essential businesses to work on-site (though they should be encouraged to work from home to the extent that telecommuting procedures can be safely implemented), but it is not clear whether these FAQs can still be relied upon in light of the DECD guidance.
[View source.]
