COVID-19/Coronavirus, Employment Law

COVID-19 FAQ: Confidentiality

Surgeon adjusting hairnet.



Last updated April 10, 2020.

This general guidance is based on U.S. federal employment law and the current medical assessment of COVID-19. State and local laws may apply, and medical assessments may change, resulting in different conclusions.

Confidentiality

  • Not usually. The Health Insurance Portability and Accountability Act (HIPAA) regulates the use and disclosure of health information of patients held by health care providers, health plans or insurers, and organizations that support these entities. It is not applicable for most employers (even if they are within the health care industry) as long as they are not actually providing medical treatment (e.g., a provider) or paying for the costs of medical treatment (e.g., insurers and plans), medical care, or providing services to companies that do these things. Because most employers will learn of a COVID-19 diagnosis from the employee or his or her family in the employer’s role as an employer, HIPAA usually will not be implicated.

    We note that the CARES Act contains a provision, which requires the Secretary of Health and Human Services (HHS) to issue, by September 23, 2020, guidance regarding the sharing of protected health information during the current public health emergency. We will continue to monitor developments in this area.

  • A2. Yes, according to the CDC and the EEOC, employers should inform fellow employees of their potential workplace exposure, but only to the extent necessary to adequately inform them of their potential workplace exposure, while maintaining confidentiality under the ADA (i.e., without revealing the infected individual’s name unless otherwise directed by the CDC or applicable public health authority).

    Employers also may communicate to non-exposed employees generally that there has been a potential COVID-19 exposure, without sharing additional identifying information. Further, employers may be able to communicate to appropriate non-employees (e.g., customers, vendors, and others with whom the employee may have come in contact while working) that there was a potential COVID-19 exposure, again without sharing identifying information. In all cases, time and circumstances permitting, employers may find it helpful to coordinate with state or local health authorities for guidance and direction regarding the scope and content of disclosures. In addition, the EEOC confirmed that the ADA permits employers to notify public health authorities if the employer learns that an employee has COVID-19.

    To ensure that the identity of the infected or potentially infected employee is disclosed only to authorized individuals, the EEOC recommends that employers designate a company representative so that managers and supervisors know to whom to report a COVID-19 diagnosis or presentation of symptoms associated with the disease. The designated representative must be instructed to maintain the confidentiality of the employee’s name. The EEOC expressly acknowledges that the designated representative may interview the employee to obtain a list of people with whom the employee possibly had contact within the workplace, but this does not require disclosing the employee’s name.

    Employers also should evaluate any applicable state privacy laws or state mini-ADA laws to ensure they do not contain different or additional requirements or provisions.

  • A3. No, not based on current COVID-19-related CDC or EEOC guidance. The ADA requires employers that collect medical information from employees to keep such information confidential. Guidance from the EEOC and the CDC indicate that, while it may be necessary to collect medical information from employees about their conditions, employee confidentiality must be maintained. Communications with employees exposed because of contact with an employee who tests positive or is displaying symptoms should be sufficient to indicate to the exposed employees the heightened risk, without violating confidentiality and without divulging the name of the person who tested positive.

 

For more answers to your frequently asked questions, please select a topic below: