COVID-19 FAQ: Confidentiality

Last updated April 10, 2020.

This general guidance is based on U.S. federal employment law and the current medical assessment of COVID-19. State and local laws may apply, and medical assessments may change, resulting in different conclusions.

Confidentiality

[od_accordion title=”Question 1. Is an employer’s knowledge that an employee has COVID-19 subject to HIPAA’s privacy restrictions?” after_title=”(Updated April 10, 2020)”]Not usually. The Health Insurance Portability and Accountability Act (HIPAA) regulates the use and disclosure of health information of patients held by health care providers, health plans or insurers, and organizations that support these entities. It is not applicable for most employers (even if they are within the health care industry) as long as they are not actually providing medical treatment (e.g., a provider) or paying for the costs of medical treatment (e.g., insurers and plans), medical care, or providing services to companies that do these things. Because most employers will learn of a COVID-19 diagnosis from the employee or his or her family in the employer’s role as an employer, HIPAA usually will not be implicated.

We note that the CARES Act contains a provision, which requires the Secretary of Health and Human Services (HHS) to issue, by September 23, 2020, guidance regarding the sharing of protected health information during the current public health emergency. We will continue to monitor developments in this area.[/od_accordion]

[od_accordion title=”Q2. May an employer disclose an employee’s actual or probable COVID-19 diagnosis to others?” after_title=”(Updated April 8, 2020)”]A2. Yes, according to the CDC and the EEOC, employers should inform fellow employees of their potential workplace exposure, but only to the extent necessary to adequately inform them of their potential workplace exposure, while maintaining confidentiality under the ADA (i.e., without revealing the infected individual’s name unless otherwise directed by the CDC or applicable public health authority).

Employers also may communicate to non-exposed employees generally that there has been a potential COVID-19 exposure, without sharing additional identifying information. Further, employers may be able to communicate to appropriate non-employees (e.g., customers, vendors, and others with whom the employee may have come in contact while working) that there was a potential COVID-19 exposure, again without sharing identifying information. In all cases, time and circumstances permitting, employers may find it helpful to coordinate with state or local health authorities for guidance and direction regarding the scope and content of disclosures. In addition, the EEOC confirmed that the ADA permits employers to notify public health authorities if the employer learns that an employee has COVID-19.

To ensure that the identity of the infected or potentially infected employee is disclosed only to authorized individuals, the EEOC recommends that employers designate a company representative so that managers and supervisors know to whom to report a COVID-19 diagnosis or presentation of symptoms associated with the disease. The designated representative must be instructed to maintain the confidentiality of the employee’s name. The EEOC expressly acknowledges that the designated representative may interview the employee to obtain a list of people with whom the employee possibly had contact within the workplace, but this does not require disclosing the employee’s name.

Employers also should evaluate any applicable state privacy laws or state mini-ADA laws to ensure they do not contain different or additional requirements or provisions.[/od_accordion]

[od_accordion title=”Q3. May an employer share with other employees the name of an employee who has tested positive for COVID-19?” after_title=”(Updated April 8, 2020)”]A3. No, not based on current COVID-19-related CDC or EEOC guidance. The ADA requires employers that collect medical information from employees to keep such information confidential. Guidance from the EEOC and the CDC indicate that, while it may be necessary to collect medical information from employees about their conditions, employee confidentiality must be maintained. Communications with employees exposed because of contact with an employee who tests positive or is displaying symptoms should be sufficient to indicate to the exposed employees the heightened risk, without violating confidentiality and without divulging the name of the person who tested positive.[/od_accordion]

 

For more answers to your frequently asked questions, please select a topic below:

• ADA
• Attendance
• Compensation and Tax Issues
• Confidentiality
• Disability Related Inquiries and Medical Examinations
• Employees with Symptoms or Exposure
• Families First Coronavirus Response Act (FFCRA)
• FMLA
• Health coverage
• Hiring During the COVID-19 Pandemic
• NLRA
• Reduction in Force/WARN
• Retirement Plan Issues
• Short-term disability coverage
• Tax Credits Under FFCRA and the CARES Act
• Vacation, Paid Time Off, and Paid Sick Leave
• Wage and Hour
• Workers’ Compensation
• Workplace Safety