Covid-19 and Employee Privacy

The Covid -19 pandemic has brought into focus issues relating to workplace health and safety and their interplay with employee privacy. An employer is required to maintain a safe workplace pursuant to the Occupational Safety and Health Act (“OSH Act”).

It is also true that employers must maintain the confidentiality of employees’ health information under the Health Insurance Portability and Accountability Act (“HIPAA”). Additionally, there are limits as to what inquiries an employer can make about an employee’s health conditions, specifically with regard to disabilities, as well as limits to those situations in which an employer might require an employee to submit to a medical examination, all pursuant to the Americans With Disabilities Act (“ADA”).  In the world of Covid-19, how can employers maintain a safe and healthy workplace while protecting employees’ privacy?

Below are a few tips for employers to consider when managing through Covid-19 issues and employee privacy: 

• An employer certainly can implement policies in place dictating that symptomatic employees are to leave the workplace and not return until they have been symptom-free for at least 24 hours (for example). In such cases, employers should advise other employees (potentially including the affected employee’s line manager) that the employee will be out for a period of time, but not the employee’s diagnosis.
• An employer may indicate that an asymptomatic employee might have been exposed to Covid-19 and, without identifying the specific employee, indicate the general location where the affected employee works (e.g., on the 5th floor) or particular workplace events that the employee attended (e.g., the sales meeting that took place on Monday the 16th).
• An employer may ask an employee who has tested positive for Covid-19 to identify employees with whom they have had contact so that the employer can notify those employees of potential exposure.
• While the employer may not share an affected employee’s health information (“PHI”) that is protected within the company or publicly, the employer may share that PHI with public health officials to obtain guidance on how to prevent the spread of infectious disease. It would be prudent to get the employee’s consent prior to sharing that PHI.
• An employer may inquire about an employee’s symptoms, so long as the employer has a reasonable belief that the employee’s condition poses a direct threat of a severe form of pandemic infection.
• As a general matter, Covid-19 cases are not to be recorded on an employer’s OSHA 300 log; however, if a case is confirmed, is work-related (i.e., was contracted on the job), and involves the relevant recording criteria, then the employer would have to record the case on the OSHA 300 log.   

Of course, these are but a few of the many considerations relating employee privacy and Covid-19.