By Shelby Matsumura
---
As a small business owner, one of your main priorities is to ensure the health and safety of your employees and your clients. Unfortunately, this novel Coronavirus has hit us all in ways we never could have imagined, and we find ourselves confronted with dilemmas and tough decisions despite our best efforts.
One of the most uncertain moments for a small business owner can be when an employee discloses that they are showing coronavirus symptoms or that they have tested positive. Although a scary scenario, business owners should encourage employees to make such disclosures and can even require their staff to confidentially share test results with their employer or if they have been exposed to others with Coronavirus. For more details, check out this FAQ compiled by Epstein Becker & Green, P.C.
However, according to the CDC, employers should not require sick employees to provide a COVID-19 test result or a healthcare provider’s note to validate their illness, qualify for sick leave, or to return to work. Regardless of the circumstances though, it is important to be understanding and sympathetic towards the welfare of your employees so as not to unintentionally alienate them from the rest of your team. Learn how to battle stigma related to COVID-19 using the CDC’s recommendations.
Nevertheless, once an employee informs their employer about potential symptoms or their COVID-19 status, you may think the next step is to ask, “Who do I need to tell?” Before you begin to share this sensitive information, remember that your employee’s privacy must continue to be protected. Medical conditions, including an employee’s COVID-19 status, are protected under:
· The Americans with Disabilities Act (ADA);
· The Health Insurance Portability and Accountability Act (HIPAA); and
· Other relevant state and local laws.
While we are concerned about preserving the overall health and safety of our staff and our clients, it is crucial that employers continue to observe their employees’ legal right to privacy. Thus, before considering who we need to tell, we must first determine what information can be shared versus what is private and protected.
The Americans with Disabilities Act (ADA)
While COVID-19 does not necessarily constitute a “disability,” the ADA provides guidelines for pandemic planning and preparedness to help employers avoid violating the ADA while taking precautions to keep their workforce healthy.
Generally, the ADA prohibits employers from making disability-related inquiries that may elicit information about an employee’s disability status. However, such inquiries are allowed if they are job-related and consistent with business necessity. These standards are met when an employer has a reasonable belief, based on objective evidence, that
An employee’s ability to perform essential job functions will be impaired by a medical condition; or
An employee will pose a direct threat due to a medical condition
A “direct threat,” according to the U.S. Equal Employment Opportunity Commission, is "a significant risk of substantial harm to the health or safety of the individual or others that cannot be eliminated or reduced by reasonable accommodation." If an employee with a disability poses a direct threat, they are not protected under the ADA.
As of March 2020, the CDC and public health authorities determined the COVID-19 pandemic as meeting the direct threat standard. Thus, if an employer has a reasonable belief, based on objective evidence, that an employee’s coronavirus status poses a direct threat, then they can make sensitive medical inquiries without violating the ADA. For further details, check out Arnold & Porter.
If an employee reports feeling ill, you can ask about the employee’s symptoms to determine if they may have COVID-19. Symptoms include fever, chills, cough, shortness of breath, or sore throat. You can also send these employees home. If an employee appears to be sick enough to pose a “direct threat” to the health and safety of themselves or their coworkers, employers may make a more detailed medical inquiry. If an employee tests positive for coronavirus, employers should inform other potentially affected employees who may have had contact with that individual, but should not reveal the identity or medical information of the affected employee. All information obtained through these inquiries must be confidential and kept separate from the employee’s personnel file. However, you cannot ask an employee who does not have symptoms to disclose whether they have COVID-19.
You can read more about ADA guidelines here.
The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule
The HIPAA Privacy Rule sets forth national standards for protecting an individual’s medical records and other personal health information. Generally, the Privacy Rule only applies to covered entities such as health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The purpose of the rule is to create safeguards to protect the privacy of health information while setting limits on the uses and disclosures of such data. HIPAA is an important structure that gives patients the right to control access to their own health information. Learn more from the U.S. Department of Health & Human Services.
Although the Privacy Rule usually only applies to covered entities like health plans and healthcare providers, it may also implicate employers if they learn of medical information or diagnoses regarding their employees through a covered health plan. Thus, to err on the side of caution, employers should treat all employee medical information, such as the employee’s identity, as highly confidential with the protections set forth by HIPAA. Check out these guidelines provided by Farella Braun & Martel for more details.
Similar to how Legalucy breaks down a more clear path in evaluating legal solutions, the U.S. Department of Health & Human Services has created a decision-making tool to assist emergency preparedness in determining how to gain access to and use health information about persons with disabilities without violating the Privacy Rule. You can find this tool here, and you will be guided through questions regarding the disclosure in question, the source of the information being disclosed, to whom the disclosure is being made, and the purpose of the information.
If an employer is unsure how to notify his employees about a COVID-19 positive employee without accidentally revealing their identity, an employer can share this information via a company-wide notice that includes:
· A general communication that there is a suspected or confirmed case of Coronavirus in the workplace while urging employees to check for symptoms and stay home if they feel ill
· An update on how the company is managing the situation
· Helpful materials from the CDC and other public health agencies
· Contact information for the designated individuals such as someone in HR
Check out Proskauer’s privacy blog to learn more about appropriate announcements.
State and local laws
To stay informed on California rules and regulations regarding COVID-19, check out: COVID19.CA.GOV and the California Department of Public Health.
The California Labor & Workforce Development Agency provides specific information depending on whether you are an employee or an employer.
The Occupational Safety and Health Act (OSH Act)
Although it is essential to protect the privacy of an employee with Coronavirus, employers must also consider their obligations under the OSH Act, which is enforced by the Occupational Safety and Health Administration. Under this act, employers must take reasonable precautions to ensure employee safety and prohibit placing employees in situations that can cause serious physical harm or death. In addressing these concerns, check out these recommendations provided by the Society for Human Resources Management:
· Encourage employees to monitor their health and report any symptoms
· Allow employees to work from home and avoid close contact
· Provide hand sanitizer and encourage employees to wash their hands and wear a mask over their face
· Clean and disinfect the workplace, in addition to frequently touched objects and surfaces
For other “reasonable precautions,” employers can look at the CDC’s recommended measures for protecting yourself.
Potential consequences
Trust us, the last thing we want to do is scare you, but there can be legal consequences to both revealing the identity of a COVID-19 positive employee or not handling this situation appropriately. Revealing the protected information of a COVID-19 positive individual can lead to liability for invasion of privacy or potential emotional distress claims. Additionally, failing to address the health and safety of your workforce could look like purposeful concealment of a workplace danger that violates the OSH Act. To employers, this can feel like an incredible catch-22 situation.
While somewhat removed from the concerns facing small business owners, we have seen pricey fines placed upon larger companies for violating consumer privacy. In 2019, the Federal Trade Commission imposed a $5 billion penalty, the largest penalty the U.S. government has ever assessed for any violation, on Facebook for “deceiving users about their ability to control the privacy of their personal information.” This is obviously a large-scale, extreme case of privacy violations, but this settlement demonstrates how much our society and government values personal privacy. Small business owners are less likely to have an even remotely similar claim filed against them, but it is still important for employers to recognize the valuable role privacy plays in their business and to commit themselves to protecting their employees’ privacy rights.
Generally speaking though, as long as you give your best efforts to comply with the ADA, HIPAA, and state and local laws, you should be able to limit your liability as a business owner.
What are your next steps?
Now that the importance of employee privacy has been brought to the forefront of this conversation, it can be incredibly challenging for business owners to strike the balance between employee privacy and protecting the health and safety of the general public. Although there are many resources business owners can use to help address the Coronavirus amongst their employees, here is a general checklist that summarizes the main points of this blog post:
Require employees to confidentially share their test results, if they have been in contact with a COVID-19 positive person, or if they are experiencing coronavirus-like symptoms. Feel free to send an ill employee home to protect his or her health and safety, as well as the collective welfare of your team.
Do not alienate an employee who discloses coronavirus-like symptoms as it could have a detrimental impact on his or her professional relationships and the productivity of your business.
Ask the affected employee to identify all individuals who had close contact with him or her in the last 14 days. Inform these employees or customers that they have been in contact with a COVID-19 positive person without revealing the employee’s identity. Send these individuals home to ensure coronavirus does not continue to spread in your business.
Ultimately, if an employee discloses a positive COVID-19 status, notify your local public health agency for the most effective and up-to-date steps you need to take as an employer. For more info on the role of businesses and employers during the coronavirus pandemic, check out the CDC guidelines.
Business owners are being confronted with unprecedented uncertainty and gray areas regarding the Coronavirus. While employers will continue to be held to the standards of the OSH Act and will need to protect the health and safety of their employees to the best of their abilities, employers must also exercise restraint if an employee discloses his or her COVID-19 status. Once this pandemic subsides, employees will remember which employers responded reasonably and supportively.
---
Are you interested in launching or sustaining a pandemic proof small business? Spot issues, take action, stay safe, and thrive in a post Covid-19 world with Legalucy.
Your interaction with Legalucy and mypandemicproofbusiness.com does not create an attorney client relationship. We provide information for your reference only. Such information should not and cannot be construed as legal advice. For more information, please contact hello@legalucy.com.