COVID-19, Return to Work, and Data Privacy Guidance
As the COVID-19 vaccines are currently being distributed, employers must address various issues relating to the transition of employees back to the office. Below is a quick general guide concerning what employers can and cannot ask their employees concerning COVID-19:
Can an employer take an employee’s temperature?
Yes. Generally, measuring body temperature is a medical examination. Because the CDC and state/local health authorities have acknowledged community spread of COVID-19 and issued attendant precautions, employers may measure employees’ body temperature.
Can an employer ask an employee if they have had COVID-19?
Yes. Employers may ask all employees who will be physically entering the workplace if they have had COVID-19 or symptoms associated with COVID-19, as well as ask if they have been tested for COVID-19.
Can an employer ask an employee if they are having COVID-19 symptoms?
Yes. During a pandemic, ADA-covered employers may ask employees if they are experiencing symptoms of the pandemic virus.
Can an employer send an employee home during the COVID-19 pandemic if they have COVID or symptoms associated with it?
Yes. The CDC states that employees who become ill with symptoms of COVID-19 should leave the workplace. The ADA does not interfere with employers following this advice.
Can an employer ask an employee if any member of their household has had COVID symptoms or has tested positive?
No. The Genetic Information Nondiscrimination Act (GINA) prohibits employers from asking employees medical questions about family members. GINA, however, does not prohibit an employer from asking employees whether they have had contact with anyone diagnosed with COVID-19 or who may have symptoms associated with the disease.
Can an employer require employees to have a COVID-19 test?
The ADA requires that any mandatory medical test of employees be job related and consistent with business necessity. Applying this standard to the current circumstances of the COVID-19 pandemic, employers may take screening steps to determine if employees entering the workplace have COVID-19, because an individual with the virus will pose a direct threat to the health of others. Therefore, an employer may choose to administer COVID-19 testing to employees before initially permitting them to enter the workplace and/or periodically to determine if their presence in the workplace poses a direct threat to others.
Can an employer require employees to notify the employer if they test positive with COVID-19?
Yes.
Can an employer require employees to adopt infection-control practices?
Yes. Regular hand washing, cough/sneeze etiquette and proper tissue usage and disposal may be required.
Can an employer require employees to wear PPE (masks, gowns, etc.) designed to reduce the spread of COVID-19?
Yes. An employer may require returning workers to wear personal protective gear and observe infection control practices.
Can an employer ask an employee if he or she has been vaccinated?
Yes. Simply requesting proof of receipt of a COVID-19 vaccination is not likely to elicit information about a disability and, therefore, is not a prohibited disability-related inquiry.
Can an employer require employees to have a vaccine?
Yes. Employers are permitted to encourage and even require vaccination before allowing employees to return to work. However, mandatory vaccination policies will require careful planning, training, and transparency to implement effectively and minimize risks.
Can an employer exclude employees from the workplace if they have not had a vaccine?
Yes, but only after doing an individualized assessment to determine if an employee poses a direct threat and concluding there is no other possible accommodation.
Record-Keeping
If an employer is currently complying with the Health Insurance Portability and Accountability Act (“HIPAA”), then it is already prepared to deal with the collection, storage, and disposal of an employee’s Personal Health Information (“PHI”) collected as a result of COVID-19. However, the Occupational Safety and Health Administration’s (“OSHA”) most recent guidance on controlling COVID-19 encourages all employers, including non-health-related companies, to put a COVID-19 prevention program into practice. OSHA encourages record-keeping as part of such a program. Thus, the days of avoiding the storage of health-related data to potentially avoid record-keeping activities are seemingly over. Certainly, employers in California must comply with California’s OSHA’s requirements concerning COVID-19. The following table provides guidance for those employers who are not already HIPAA-compliant.
Can an employer store medical information it collects from employees related to COVID-19?
Yes. The ADA requires that all medical information about a particular employee be stored separately from the employee’s personnel file, thus limiting access to this confidential information.
Can an employer disclose the name of an employee to other employees when it learns that the employee has COVID-19?
No. The employer should not disclose the name of the employee who has COVID-19. However, the CDC stated: If an employee is confirmed to have COVID-19, employers should inform fellow employees of their possible exposure to COVID-19 in the workplace but maintain confidentiality as required by the ADA.
Can an employer keep a log of daily temperature checks before entering the workplace?
Yes, provided that the employer maintains the confidentiality of this information.
Can an employer keep records of employees who have tested positive for COVID-19?
Yes, if confidentiality is kept. Employers should make every effort to limit the number of people who get to know the name of the employee.
Can the employer notify other employees that an employee has tested positive for COVID-19?
Yes. The ADA does not interfere with a designated representative of the employer interviewing the employee to get a list of people with whom the employee possibly had contact through the workplace, so that the employer can then take action to notify those who may have come into contact with the employee, without revealing the employee’s identity.
For almost a year since the onset of COVID-19, employers have been collecting and using data to track and trace the spread of the virus. Employers must be vigilant when collecting and utilizing data for tracking and tracing the spread of the virus and understand the risks of unauthorized disclosure or other potential abuses of the data.
Data Privacy and Security
Employers must develop policies and procedures to collect, use, and analyze PHI that are in compliance with relevant privacy laws. PHI, such as information that an employee has tested positive or is having symptoms of COVID-19, must be stored separately from regular personnel files and kept confidential. If this information is stored electronically, it must be stored in a manner which limits access to the information.
Employers should consider creating a COVID-19 task force that is responsible for handing all COVID-19 related issues within the company. This will necessarily limit the number of people who have sensitive COVID-19 information about employees.
It is important that employers discuss these issues with their data privacy attorney. A data privacy attorney can help employers comply with the patchwork of federal and state privacy regulations, including GDPR and HIPAA, and develop systems for the storage and use of employee PHI.
This article is intended to provide generalized guidance for employers and may or may not apply to your exact situation. If you require specific legal advice on these or related topics, or compliance with data privacy regulation that may affect your business, please contact Walker R. Lawrence, a partner in the employment law practice at Levin Ginsburg.
