As we face uncertain times amid the COVID-19 pandemic, a question on the top of many employers’ and employees’ minds is what to do if someone tests positive for or displays symptoms of COVID-19? Is HIPAA implicated? What steps should they take? What can and should be disclosed to protect other employees?
The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule regulates the use and disclosure of health information. It only applies to certain “covered entities” including health plans, such as health insurance companies, HMOs, company health plans, Medicare, and Medicaid; healthcare providers, such as most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists and businesses that electronically bill health insurance; and healthcare clearing houses, which are entities that process nonstandard health information they receive from another entity into a standard. Business associates of these covered entities must also follow HIPAA regulations.
The HIPAA Privacy Rule does not apply to organizations that are not covered entities, including most employers. In the context of COVID-19, an employer will likely learn that an employee has tested positive for COVID-19 from the employee or his or her family in the employer’s role as an employer, and HIPAA usually will not be implicated.
Even though HIPAA is not a likely concern, employers do not have a green light to openly disclose that an employee has COVID-19 to other employees. If an employer knows that an employee has tested positive for or has symptoms of COVID-19, that employer must balance keeping other employees safe while considering the privacy of the infected employee generally and under applicable laws.
The Americans with Disabilities Act (ADA) protects applicants and employees from disability discrimination. Generally, the ADA requires employers to keep employee medical information confidential and prohibits employers from disclosing the name of any employee with a disease, unless disclosing the name is required by another Federal law or directed by the Centers for Disease Control and Prevention (CDC) or applicable public health authority.
The COVID-19 pandemic has changed the ADA field in some respects. Currently, to help prevent the spread of COVID-19, employers are allowed to seek information about an employee’s health which would typically limited by the ADA. During the COVID-19 pandemic, ADA-covered employers may ask employees who call in sick if they are experiencing symptoms of the virus. These include symptoms such as fever, chills, cough, shortness of breath, or sore throat. Employers are allowed to take employees’ temperatures during the COVID-19 pandemic. However, employers must keep the fact that an employee has a fever or other COVID-19 symptoms confidential and not disclose the employee’s identity to other employees to the extent possible.
The Equal Employment Opportunity Commission (EEOC) has said that the ADA does not interfere with employers following advice from the CDC and other public health authorities on appropriate steps to take relating to the workplace. The CDC has advised that employers should inform employees of any potential workplace exposure to COVID-19 as part of the effort to help decrease the spread of the disease and lower the impact of exposure in the workplace. Specifically, the CDC has advised that all employers reduce transmission among employees, maintain healthy business operations, and maintain a healthy work environment. The CDC recommends that employers actively encourage employees who are sick and/or have COVID-19 symptoms to stay home and advise employees who are well but who have a sick family member at home with COVID-19 to notify their supervisor and follow CDC recommended precautions. Employers are able to inform other employees of potential workplace exposure to COVID-19 including, for example, if an employee has tested positive for, is suspected to have, or has been exposed to COVID-19, but only to the extent necessary to adequately inform other employees of their potential workplace exposure and while complying with ADA confidentiality requirements. A good rule is to disclose what is necessary to keep employees informed and safe without revealing the identity of the infected employee.
As always, when dealing with health information, employers should exercise caution when disclosing even general information about potential workplace exposure to COVID-19. It may be possible for other employees to identify the infected employee based on the information shared. The infected employee may attempt to hold the employer liable for disclosure of personal health information; however, employers can take steps to protect themselves by following by following the CDC’s Interim Guidance for Businesses and Employers to Plan and Respond to Coronavirus Disease 2019 (COVID-19) and guidance issued by other government authorities. The COVID-19 pandemic is rapidly evolving and its complete impact on employers is unknown. Be sure to check the CDC and appropriate government authorities for updated information. When in doubt, contact an attorney for legal guidance.
