Privacy Protections in the Coronavirus Era: Can Employers Disclose Employee Health Information?

Last week, a record 3.3 million Americans filed for unemployment following massive layoffs and furloughs secondary to COVID-19 business closures. As Americans struggle to avoid exposure to the virus and desperately hang onto their paychecks, for countless people, safety on the job is an even greater concern.

Social distancing is nearly impossible for essential employees, who are still required to clock in at a physical job location. First responders and police officers as well as the staff of hospitals, COVID-19 drive through testing sites, grocery stores, pharmacies, and nursing homes (just to name a few) don’t have the luxury of maintaining a CDC-approved six-foot distance from others, let alone those infected. But what happens when one of these employees falls ill? Do their coworkers and patrons have the right to know?

All employees have the right to a reasonably safe work environment, while also having the right to privacy for all health-related matters. So how can an employer properly protect its staff—and the public—while also protecting the privacy interests of a potentially infected employee?

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) created a national standard which carefully limits who can and cannot disclose someone’s health information. But does HIPAA prevent employers from disclosing information about employees who test positive for or show symptoms of coronavirus? Like many legal questions surrounding the virus, the answer is not as straightforward as one may think.

What Can an Employer Do if an Employee Tests Positive for Coronavirus?

Can an employer disclose the identity of any of its employees who test positive for coronavirus? The general answer is no.

If an employer learns that one of their employees has tested positive through health insurance claims, HIPAA protections are triggered. This means that the employer must not disclose the employee’s identity or any other identifiable information. However, it is within an employer’s right to provide this information to the necessary public health authorities. Though many officials have claimed that they will have this information long before the employer.

That being said, an employer can—and should— disclose to its other employees that they may have come into contact with the virus. Confidentiality rules under HIPAA still apply, so the employee’s identity cannot be disclosed. However, employers are expected to provide a safe work environment under federal labor laws, in any case. Employers themselves may be held legally responsible for purposeful concealment of a workplace danger.

Aside from disclosing to employees that they may be at risk, the employer is also responsible for taking other measures to ensure a safe environment. This may involve disinfecting work areas or shutting down certain departments. Inevitably, this may lead others to reasonably deduce the infected employee’s identity, especially if said employee is absent from work for an extended period of time. An employer cannot control said deductions, it’s even more important to maintain the privacy of an employee’s identity in accordance with HIPAA while also creating a safe work environment.

What Can an Employer Do if an Employee is Showing Symptoms?

Handling instances of employees who show potential symptoms but have not yet been tested for coronavirus is a far more delicate matter. In some cases, such as an employee reporting they have been exposed, an employer may disclose that fact to others. However, an employer remains responsible for protecting the employee’s identity.

In the absence of symptoms, an employer cannot inquire about an employee’s general health—this would qualify as a violation of the Americans with Disability Act. Likewise, any sort of on-site medical examinations, such as temperature screenings, are legally questionable, at best. The Equal Employment Opportunity Commission says that temperature screenings would generally be out of bounds for an employer. Although such checks may be permissible in the midst of a widespread pandemic. However, even if deemed permissible, taking an employee’s temperature answers no questions. An individual can have a fever and be negative for the coronavirus, or conversely, test positive for the coronavirus with a normal temperature. At the same time, such screenings may create a potentially hostile work environment. Employers must proceed with caution to avoid unnecessary biases against sick (but corona-negative) employees.

If an employer suspects an infected employee, but lacks proof, the safest course of action is to urge ill employees to stay home. Employers should ensure that their sick leave policies are flexible and in accordance with necessary laws and guidelines. By encouraging sick employees to stay home, employers are protecting others while also avoiding potential HIPAA violations.

Privacy Issues Abroad

Outside of the HIPAA realm, the European Union has also weighed in on health information protection in the age of coronavirus. The European Data Protection Board, which is composed of data protection authorities from each member state, has made clear that its General Data Protection Regulation (GDPR) rules still apply during these trying times. The chair of the Board, Austrian Data Protection Authority Andrea Jelinek, states: “[E]ven in exceptional times…[they] must ensure the protection of the personal data of the data subjects.”

At the same time, the GDPR also allows temporary suspension from its rules for matters of public interest. Some countries, such as France, have ensured it will maintain its personal data processing in accordance with the GDPR. The French authorities have released a notice confirming that people will still have the right to object to, access, or seek the deletion of their transmitted information. On the other hand, Italy, one of the countries hit hardest by the virus, has adopted a very different ordinance. Italy grants extensive powers to civil protection personnel and lifts restrictions in processing sensitive health information related to the coronavirus.

Overall, health privacy under HIPAA in the age of the coronavirus is an ever-evolving landscape. If you are an employer—or employee—it is important to stay up-to-date on your rights and obligations when faced with a global pandemic.