COVID-19 Privacy Issues Q&A

FAQ

1. In light of the COVID-19 pandemic, what health-related information can you ask employees to provide? You can ask employees to provide the following information:

• A positive result for, or other diagnosis with, COVID-19;

• Symptoms of infection with COVID-19, e.g., fever of or over 100.4°F, cough, shortness of breath, sore throat;

• “Close contact” (as defined by the Centers for Disease Control) with any person who has tested positive for, or has otherwise been diagnosed with, COVID-19 infection within the preceding 14 days;

• Whether the employee has been asked to self-quarantine by a health official within the preceding 14 days;

• Whether the employee has traveled to, or stopped over in, a country for which the CDC has issued a Level 3 travel health notice; and

• Depending on geographic location, whether the employee is considered “high risk” for COVID-19 infection, meaning over age 60, pregnant, or suffering from diabetes, lung disease, heart disease, asthma, HIV, or similar conditions.

2. Can you take employees’ temperature before permitting them to enter the business?

Yes. However, you should implement a temperature check protocol to ensure that temperature checks are designed to reduce the threat that an employee with COVID-19 poses to the workplace. In particular, temperature checks should be reliable, effective, performed consistently, and respect employees’ privacy. For example, all employees entering the Academy should be checked only by trained personnel and the results should be treated as confidential.

3. Can you require employees to check their own temperatures?

Yes. Any policy on “self-checking” should be designed to address the threat to the workplace in a consistent manner. You also can require employees to stay home from work if their temperature equals or exceeds 100.4°F and to report this symptom of COVID-19 to you.

4. Can you require employees to be tested for COVID-19?

You may be able to require employees to be tested if they have symptoms of COVID-19 and, nonetheless, assert that they are fit for work.

5. Does the Health Insurance Portability and Accountability Act (HIPAA) apply to the health information collected by employers?

Generally, no. HIPAA imposes obligations to safeguard protected health information (PHI) only on “covered entities”, which are defined to include health plans, health care clearinghouses, and health care providers. If you are acting in your capacity as an employer, you are not subject to HIPAA. Other laws, such as the Americans with Disabilities Act (ADA) or state confidentiality laws, may apply.

6. Can you disclose the identity of an employee who has tested positive for, or otherwise been diagnosed with, COVID-19 to co-workers who were in close contact with the infected employee during the relevant 14-day period?

No. The ADA prohibits such a disclosure. However, you can provide co-workers with information that would help them evaluate their own risk of infection.

7. Can you disclose COVID-19 related health information to parents or vendors?

No. The ADA does not permit you to disclose a specific employee’s medical information to your parents or vendors. You can generally inform parents or vendors that an “employee has tested positive for COVID-19” or that an employee “has been exposed to COVID-19,” but the employee should not be identified.

8. Can you ask employees to consent to the disclosure to others of their identity and positive test for COVID-19 infection?

The ADA’s confidentiality provision does not have an express exception for disclosures with the employee’s consent. Although there may be risk in relying on an employee’s consent, that risk could be lessened by taking steps, such as (a) obtaining the employee’s written consent, (b) informing the employee that consent is purely voluntary and may be revoked at any time, and (c) limiting the disclosure that is the subject of the consent to specifically identified employees who were in close contact with the infected employee during the relevant 14- day period. If you feel that there is a reason for you to make such a disclosure, you should check with your legal advisor before doing so.

9. Can you perform temperature checks on, or provide questionnaires inquiring about, the medical health of your customers?

Yes. However, any inquiry should be narrowly tailored to reduce the threat of COVID-19 infection, and you should ensure that medical information received from customers about them is stored in accordance with any applicable state information security law.