Once an employee has been exposed to a suspected or confirmed case of COVID-19, what do you do? Once an employee has tested positive, what do you say? How does an employer walk the fine line between protecting the privacy of affected individuals and ensuring the safety of others in the workplace?

Because a national public health emergency has been declared and all 50 states and the District of Columbia have issued similar declarations, employers may go much further in their medical inquiries and exams.

Employers should ask employees to notify Human Resources if the employee has been exposed to a suspected or confirmed case of COVID-19, so that the employer can take precautions. The same is true if the employee has tested positive for coronavirus. All self-reports by employees should be kept confidential and should be noted in separate employee medical files that the employer maintains, not in the employee’s personnel file.

The message to employees should be couched in terms making clear that asking employees to self-report is part of the employer's effort to keep co-workers safe and stop the spread of the virus. Emphasize that finding out about exposure or potential exposure quickly is key, and given the delay with obtaining tests and test results, self-reporting is paramount.

For example:

“We understand that it can take the health department several days to notify the employer if an employee is positive. To protect each other, we ask that you notify the HR Department if you have tested positive. (This information will remain confidential, etc.). ”

With respect to whether a sick worker’s colleagues be notified that they have been exposed to someone experiencing the symptoms of COVID-19, there is a tension between the employer’s duty to provide a safe workplace under the “general duty” clause of the Occupational Safety and Health Act (OSHA) and the duty to protect the privacy of the ill employee. Employers are going to have to balance those concerns by relying on recommendations from the Centers for Disease Control and Prevention (CDC), the World Health Organization (WHO), state and local health authorities, and common sense.

If an employee goes home sick with COVID-19 symptoms, many employers are choosing to close the workspace and send home those who worked in proximity to the ill worker for 14 days or until the ill employee has tested negative. That is the safest bet, particularly if there are other employees who have underlying vulnerabilities that make them particularly susceptible – e.g., heart disease, lung disease, suppressed immune system, or other chronic medical conditions.

Return to Work Process

Employers remain entitled to ask employees why they have been absent from work and when they expect to return, even if they suspect it was for a medical reason. Employers may continue to require a doctor’s note before allowing employees to return to work consistent with their policies; however, the CDC and OSHA are appealing to employers not to do so, as healthcare provider offices and medical facilities may be overwhelmed and unable to respond timely. Because healthcare professions may be too busy during a pandemic to provide them, employers may want to set up a process allowing a doctor to simply certify by email or otherwise that the employee does not have COVID-19 and may return to work.

Confidentiality of Positive Diagnosis

A sick employee’s medical information must remain confidential with limited exceptions: “(1) supervisor[s] and manager[s] may be told about necessary restrictions on work duties and about necessary accommodations; (2) first aid and safety personnel may be told if the disability might require emergency treatment; (3) government officials may access the information when investigating compliance with the ADA; (4) employers may give information to state workers’ compensation offices, state second injury funds, or workers’ compensation insurance carriers, in accordance with state workers’ compensation laws; and (5) employers may use the information for insurance purposes. 29 C.F.R. §§ 1630.14(b)(1)(i)–(iii), (c)(1)(i)–(iii); 29 C.F.R. pt. 1630 app. § 1630.14(b).”

If an infected employee authorizes disclosure of his/her identity to affected co-workers, the employer may share that information.

Temperature Assessment of Employees

According to the EEOC guidance, an employer cannot ask asymptomatic employees to disclose whether they have a condition that could make them particularly vulnerable to COVID-19 or to undergo a medical exam with one IMPORTANT exception: “If employers have sufficient objective information from public health advisories to reasonably conclude that employees will face a direct threat if they contract pandemic influenza, then employers can ask asymptomatic employees about their vulnerabilities.”

Based on the widespread community transmission of COVID-19, the number of mandated business closures and shelter in place orders, that standard certainly appears to have been met. At this stage, employers can require employees to confirm that they have no symptoms. They can even take employees' temperatures at the door although that may not be of much value; according to the CDC, many persons carry the virus without having a fever.

HIPAA Considerations for Group Health Plans

Finally, employers should not review health plan claims data to try to determine which employees (or dependents) have filed claims for testing or treatment related to COVID-19. This violates the HIPAA Privacy Rule, and OCR has not issued any COVID-19 waivers for health plans.