As the U.S. faces what looks like a resurgence of COVID-19 cases and the possibility of more state and local shelter-in-place orders, employers who have been operating during the pandemic should know what the federal government requires and whether they will be able to continue to operate. What do employers need to know about federal “critical infrastructure” guidance, and what do you need to know as you continue to operate your business?

What Is Critical Infrastructure?

The Centers for Disease Control and Prevention (CDC) defers to the Cybersecurity and Infrastructure Security Agency (CISA), which bills itself as the nation’s risk advisor, to define critical infrastructure sectors. These are organizations whose assets, systems, and networks – whether physical or virtual – are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on national public health or safety.

You should look to the March 28, 2020 CISA 3.0 Memo to determine whether your organization is considered part of the critical infrastructure for the CDC’s purposes, as the agency currently relies on the categories outlined in the memo. CISA 3.0 and the CDC define a critical infrastructure worker as a worker employed in the following sectors:

• Healthcare and Public Health
• Law Enforcement, Public Safety, and Other First Responders
• Food and Agriculture
• Energy
• Water and Wastewater
• Transportation and Logistics
• Public Works and Infrastructure Support Services
• Communications and Information Technology
• Other Essential Functions
• Critical Manufacturing
• Hazardous Materials
• Financial Services
• Chemical
• Defense Industrial Base
• Commercial Facilities
• Residential Shelter Facilities and Services
• Hygiene Products and Services

CISA’s latest guidance, the 4.0 memo issued on August 18, 2020, adds education workers as critical infrastructure workers and includes all organizations that provide transportation, operational, and administrative support for education facilities.

Is Your Business Critical Infrastructure?

The above CISA categories are then broken down into descriptions of workers and the tasks they perform for critical infrastructure. To determine if your business is critical infrastructure per CISA and CDC guidance, your employee must perform one of the tasks described in each category. Following are some of the categories, tasks, and business or professions that would be considered critical infrastructure:

Healthcare and Public Health

• Researchers (i.e., laboratories);
• Healthcare providers (i.e., physicians, dentists, nurses, pharmacists, and their assistants and aids, administrative professionals, and similar workers); and
• Healthcare support services (i.e., third-party transportation services for healthcare, laundry services, billing, IT, childcare services, manufacturers, and healthcare vendors and suppliers).

Food and Agriculture and Energy/Water

• Sellers of food or beverages (i.e., grocery stores, restaurants, convenience stores and other retail that sells food, whether human or pet, online ordering services, );
• Manufacturing and distributing (i.e., manufacturers or energy providers, and their suppliers, vendors, farmers, and supply chains and the support services for those supply chains, security); and
• Manufacturing and maintenance of equipment or services (i.e., machine shops, repair shops, parts vendors, supply vendors).

Transportation and Logistics

• Transportation (i.e., truck and bus drivers and all support systems for those drivers and their businesses, taxis, vehicle rental services, delivery services, dispatch services, airlines and their supply chains and support services); and
• Maintenance and sales of transportation (i.e., construction, car dealerships, car manufacturers, and their supply chains, distributors, warehouses, HVAC services, plumbing, electricians).

Public Works and Infrastructure Support Services/ Communication and Technology/Other Essential Functions/Critical Manufacturing

• These categories are broad, and include nearly any business that supports the response to COVID-19 or supports the other categories of critical infrastructure with logistics, personnel, IT, transportation, manufacturing, or any other services that other critical infrastructure businesses need to perform their functions.

Commercial Facilities/ Residential Shelter Facilities and Services

• This category is also broad, notably including any business that supports the supply chain of building materials from production through application and installation (i.e. hardware stores, construction firms, installation firms, distributors of materials, warehouses, call centers, maintenance and repair firms); and
• Housing (i.e., hotels, shelters, animal shelters, and their support and supply chains).

Hygiene Products and Services

• Producers of hygiene products;
• Sanitation (i.e., laundry services, dry cleaners, disinfection services, janitorial services, pest control); and
• Household Repair (i.e., HVAC, plumbing, electrical).

The CDC’s Critical Infrastructure-Specific Guidance

The CDC advises that critical infrastructure workers may be permitted to continue work following potential exposure to COVID-19, provided they remain asymptomatic and the employee and their employer adhere to the following practices prior to and during their work shift:

• Pre-Screen: You should measure the employee’s temperature and assess symptoms prior to them starting work. Ideally, temperature checks should happen before the individual enters the facility.
• Regular Monitoring: As long as the employee doesn’t have a fever or symptoms, they should self-monitor under the supervision of your occupational health program.
• Wear a Mask: The employee should wear a face mask at all times while in the workplace for 14 days after last exposure. You can issue facemasks or can approve employees’ supplied cloth face coverings in the event of shortages.
• Social Distance: The employee should maintain 6 feet and practice social distancing as work duties permit in the workplace.
• Disinfect and Clean Work Spaces: Clean and disinfect all areas such as offices, bathrooms, common areas, shared electronic equipment routinely.

If these critical infrastructure employee becomes sick during the day, however, they should be sent home immediately. As with any exposure at a workplace, surfaces in their workspace should be cleaned and disinfected. Sick employees should not be allowed to return to work until they have met the CDC’s criteria to discontinue home isolation. Taking these steps and documenting your efforts to mitigate COVID-19 will be key for an employer defending against potential OSHA investigations or citations related to COVID-19.

Additional CDC Guidance For All Businesses

Regardless of your business’ status as critical infrastructure, as discussed more fully here, you must take certain steps when an employee becomes ill. First, you should instruct sick employee to remain at home until released by a physician or public health official. If a doctor’s note releasing the employee is unavailable, follow the CDC guidelines on when an employee may discontinue self-isolation, which contain specific requirements dependent upon whether the employee tested positive for COVID-19 or exhibited COVID-19 symptoms.

Second, after a confirmed COVID-19 case, follow the CDC guidelines for cleaning and disinfecting the workplace. The cleaning staff or a third-party sanitation contractor should clean and disinfect all areas (e.g., offices, bathrooms, and common areas) used by the ill person, focusing especially on frequently touched surfaces.

Third, after learning that one or more employees has been diagnosed with COVID-19, act quickly to have the infected employee identify all other employees or third parties who might have been exposed during the infectious period. Ask the infected employee to identify all individuals who fall in the “6-15-48” zone. As a reminder, a potential exposure means being a household contact or having close contact. As recently analyzed here, the CDC has updated the definition of the term “close contact.” The latest definition now provides the following definition to identify someone who should be considered at risk of being infected:

Someone who was within six feet of an infected person for a cumulative total of 15 minutes or more over a 24-hour period starting from two days before illness onset (or, for asymptomatic patients, two days prior to test specimen collection) until the time the patient is isolated.

Fourth, you should notify all workers who worked in close proximity to the infected employee that they may have been exposed to COVID-19 and follow the critical infrastructure-specific steps above for allowing your employees without symptoms to continue working. Also notify all employees or third-parties who work in the location or area where the employee works of the situation without revealing any confidential medical information such as the name of the employee. Just as it is important to take the preventative steps above, the failure to notify employees at your location of a confirmed case may be a violation of OSHA’s general duty clause, which requires all employers to provide employees with a safe work environment.

Fifth, determine if the employee is eligible for paid time off under company policy, local, state, or federal guidelines. If you are a covered employer under the Families First Coronavirus Response Act (FFCRA), the infected and potentially exposed employees may be eligible for emergency paid sick leave.

Can Your Business Continue To Operate Despite State And Local Shut Down Orders?

That will depend on the state where your business is located. Some states, such as Georgia and Massachusetts, defer to CISA’s evolving definition of workers who perform critical infrastructure functions, such as CISA memo 3.0 or 3.1 in creating exceptions to broad requirements for businesses and travel quarantine mandates. Thus, in Georgia for example, critical infrastructure has been allowed to operate despite shutdown orders, and we anticipate that trend to continue. Similarly, in states like Massachusetts, your employees should continue to be exempt from the main requirements of that state’s travel quarantine.

Other states, like New York, use terms like “essential businesses” and define them by a different set of criteria listed in those states orders. Therefore, business in New York and other states that do not defer to CISA or the CDC for their definition of what is critical infrastructure or an essential business will have to consult their state and local orders to determine if their business may continue to operate.

Conclusion

Addressing confirmed COVID-19 cases and exposure to COVID-19 in critical infrastructure will be an issue for the foreseeable future, and you should review and update your COVID-19 mitigation and contact tracing policies to comply with the latest CDC guidelines. To ensure your response is consistent with current guidance, if you have any doubt as to whether your business is classified as critical infrastructure by CISA, or before continuing to operate in one of these states that do not defer to CISA’s guidance, you will want to seek the advice of counsel.