Employee Privacy During the COVID-19 Pandemic

During these uncertain times, it’s difficult to know what steps to take to best protect your business and your employees when your state authorizes your business to reopen.   It is important to have a plan in place so that the re-opening process goes as smoothly as possible while protecting employees and customers.  The most important consideration is balancing the employee’s right to privacy relating to medical information versus keeping your other employees and customers safe.  Different additional regulations may come into play if your workforce is unionized.  In that case, be sure to consult with the union representative before instituting any policies or screenings.

At the outset, it is important to emphasize basic hygiene and social distancing guidelines with employees.  Further, be sure to instruct all employees that, under current Center for Disease Control (“CDC”) guidelines as well as guidelines of both the Pennsylvania and New Jersey Department of Health, if an employee  is experiencing flu-like symptoms, he/she should promptly notify his/her supervisor or Human Resources representative and stay home or immediately notify the supervisor or Human Resources Representative that they are feeling ill and go home from work immediately.  Employers should limit any medical/health related inquiries only to actual symptoms of COVID-19 (including fever, chills, cough, shortness of breath, and/or sore throat, loss of smell and taste) or the employee’s potential exposure.  Additionally, emphasize that social distancing practices, specifically keeping a six (6) foot distance between individuals as well as following your state’s guidelines on wearing customers and employees wearing masks (at the time of this article, both New Jersey and Pennsylvania require individuals to wear a mask when entering a business or other facility).

What can an employer legally do to protect itself and its employees and customers during this pandemic?  A policy requiring each employee to submit to a temperature screening before starting work each day is permissible now only related to the COVID-19 pandemic. Generally, speaking taking an employee’s temperature when he/she reports to work would be deemed an invasion of privacy.  In these uncertain times, an employer has the right for COVID-19 purposes to adopt such a policy. This policy does not run afoul of employee privacy laws as long as: 

  1. The policy is instituted for COVID-19 purposes;
  2. When the pandemic ends, the policy is discontinued unless recommended by the CDC or specific state health guidelines;
  3. All employees must be treated equally;
  4. A specific class of employees cannot be signaled out for temperature monitoring (such as those employees over 40);
  5. If an employee’s temperature is above 100.00 degrees, the employee is not permitted to work and is sent home until symptom-free for at least 72 hours (or as recommended by the CDC and or specific state health guidelines);
  6. A contactless thermometer should be used;
  7. Temperatures do not have to recorded; and
  8. You cannot inquire about the employee’s other medical conditions.

It is important to note that employments laws such at anti-discrimination laws under Title

VII of the Civil Rights Act of 1964, as amended (“Title VII”) or the Americans with Disabilities Act of 1990, as amended (“ADA”), the New Jersey Laws Against Discrimination (“LAD”) and/or the Pennsylvania Human Relations Act (“PHRA”) are not suspended.  These laws remain in effect and are enforceable.  However, temporary guidelines have been issued during the pandemic to allow for heightened safety measures to be taken by employers.  The United States Equal Employment Opportunity Commission (“EEOC”) expressly permits an employer to institute a policy of taking employee temperatures for COVID-19 purposes only.  The institution of a policy for a legitimate health, welfare and safety reason during the pandemic and not for discriminatory purposes (to target a certain class of employees) is permissible without fear of a claim of discrimination.

Generally speaking, an employer should not ask an employee if they have a medical condition that the CDC has determined makes him or her more vulnerable to COVID-19.  However, the EEOC pandemic guidance does advise that inquiries into medical information, and even disabilities, could be permitted if the COVID-19 situation is a “direct threat,” which as of March 2020, COVID-19 was deemed to be a “direct threat.”[1]  As this global pandemic evolves, the temporary guidelines could change based on guidance from local and federal public health officials.  The EEOC guidelines also advise that the COVID-19 pandemic has disrupted work routines and caused “unexpected or increased requests for reasonable accommodations” under the ADA.  The EEOC guidelines direct employers and employees to address requests for reasonable accommodations as soon as possible, but note that the COVID-19 pandemic may result in delays in discussing and providing reasonable accommodations.  The EEOC guideline encourage employers and employees to use “interim solutions to enable employees to keep working as much as possible.”

One of the main situations where employee privacy becomes an issue is when an employee advises that he or she has tested positive for COVID-19 or is awaiting results but is a probable positive.  It is important to not reveal the individual’s name to other employees or customers.  Often your local health officials will provide guidance on how to proceed once the case has been reported.  You should inform other employees that came into close contact with the person that someone (not gender specific), without naming the person, has tested positive for COVID-19 or is a probable positive and provide guidance for the employee(s) who may have come in close contact with the positive person on what steps they should take, including self-monitoring, self-quarantine and direct them to his/her health care provider. and directing them to Federal and Local public health agencies.[2]  You should not provide the name of the employee who has tested positive for COVID-19 or probable positive to anyone unless that person signs a specific release allowing you to provide his/her name to other employees. Employee medical information is protected under the ADA and expressly provides that employee medical information must be kept confidential and all employers must continue to follow ADA privacy guidelines.  Employers should be sure to maintain all medical privacy and confidentiality.  You should also ensure that you are only providing accurate and confirmed information as to someone’s COVID-19 status because you do not want to open yourself or your business up to liability for sharing incorrect or false information. 

Additionally, you may also provide more general notice to the rest of your company employees advising of the positive case and providing information on how you as a company are managing the situation pursuant to all federal, state and local guidelines.  It is also helpful to provide a point of contact, either management or Human Resources, for employees to contact if they have any questions or concerns.  Any medical information obtained from employees should be maintained only as a confidential medical record and not contained in an employee file.  These guidelines also apply if an employee informs you that he or she has an immediate household member who has tested positive for COVID-19 or a probable positive.

It is important to rely on federal, state and local public health department guidance only in determining risk of COVID-19 infection and response.  You should not attempt to make any other risk determinations, especially not based on age, race or country of origin, or any other condition as this could open your business up to liability.  Further, per the CDC guidelines, as an employer, you should not require an employee to provide COVID-19 test results or a medical provider note to confirm and/or validate their illness, to qualify for sick leave, or to return to work. federal, state and local public health department guidelines should be followed to determine when an employee can safely return to work.

Additionally, the current COVID-19 pandemic does not supersede the Health Insurance Portability and Accountability Act (HIPAA).  Employers should continue to protect and maintain any employee medical and health information, including the identity of employees testing positive for COVID-19, as confidential under HIPAA. The implications of the COVID-19 and its relation to the ADA is still evolving as more information is learned about the illness. 

The above is general information.  We are continuing to monitor this ever-evolving situation and the complex federal, state and local laws which control what employers should and should not do in response to the global health crisis.  Each situation and workplace is different.  You should consult with an attorney to discuss the specifics of your situation and we stand ready to assist you.

Please contact our office to speak with one of our attorneys who can assist you in creating a preparedness plan for your business, including drafting and implementing policies and procedures for employees self-identifying and reporting symptoms and/or positive COVID-19 test results for themselves and/or immediate household members as well as procedures for protecting and informing other employees, including temperature screening policies, and any other employee privacy inquiries you may have.

[1] Please note that as this global pandemic evolves, this determination could change.

[2] Close contact means within six (6) feet of the person for about ten (10) minutes.