If an employee arrives at work with COVID-19 symptoms or develops symptoms during the workday, ask him/her to go home and to stay home from work until he/she has consulted with a healthcare provider and met the CDC’s criteria to discontinue home isolation. According to EEOC guidance, asking an employee if they are experiencing symptoms of COVID-19, taking their temperature, asking them to get a COVID-19 test, or telling them to stay home does not violate their rights under the Americans with Disabilities Act (ADA) or the Rehabilitation Act due to the direct threat that COVID-19 currently poses to employers’ workplaces. However, in order to protect an employee’s confidential medical information, CAAs may want to consider implementing a reporting protocol or policy in order to minimize the number of people who receive information about an employee’s symptoms or COVID-19 diagnosis. All employer officials who are designated as needing to know the identity of an employee should be specifically instructed that they must maintain the confidentiality of this information.
After the employee has left the workplace, follow the CDC cleaning and disinfection recommendations. The ADA does not interfere with a designated representative of the employer interviewing the employee to get a list of people with whom the employee possibly had contact through the workplace, so that the employer can then take action to notify those who may have come into contact with the employee, without revealing the employee’s identity. For example, using a generic descriptor, such as telling employees that “someone at this location” or “someone on the fourth floor” has COVID-19, provides notice and does not violate the ADA’s prohibition of disclosure of confidential medical information. For small employers, coworkers might be able to figure out who the employee is, but employers in that situation are still prohibited from confirming or revealing the employee’s identity. They can disclose that the employee is on leave or is teleworking, but cannot disclose the reason why. Ask the potentially affected employees to follow the recommended precautions in the CDC’s Recommendations for Community-Related Exposure, which may include home isolation. Remind them that your agency has preventive measures in place to reduce the spread of the virus and that you are staying informed of all relevant information.
Take additional precautions your agency deems reasonable and appropriate to prevent further transmission, but remember that every employee’s personal and medical information should be kept confidential. See 29 C.F.R. § 1630.14 and Response Question 7 below.
Make sure your employees know not to come into work if they are experiencing symptoms of COVID-19 or if they have been exposed to someone with COVID-19. Ask employees to contact their supervisor via phone or email to let the supervisor know if they are experiencing symptoms or have been exposed. If the employee is experiencing COVID-19 symptoms, refer to the previous question. If the employee has been exposed to someone with COVID-19, the CDC recommends asking him/her to self-quarantine for 14 days, telework if possible, and self-monitor for symptoms.
According to the EEOC, employers can ask employees who report feeling ill or call in sick questions about their symptoms to determine if they have or may have COVID-19. Many law firms have interpreted this guidance to mean that employers may ask employees for the results of their COVID-19 tests and may require employees to self-disclose a COVID-19 diagnosis. If your CAA adopts a policy requiring employees to report symptoms and/or diagnoses, make sure that it is applied in a consistent and non-discriminatory manner. COVID-19 third party testing providers that are subject to HIPAA must obtain an employee’s consent before sharing the employee’s test results with their employer. All employee symptom and diagnosis information should be treated as a confidential medical record, even if it is not generated by a healthcare professional. See 29 C.F.R. § 1630.14 and Response Question 7 below.
If one of your employees tests positive for COVID-19, he/she should follow the advice of his/her doctor and the CDC. In most states, you are not required to notify the appropriate public health bodies of the positive test result. However, some states, like New Mexico, have required employers to report positive test results. Check with your local counsel and public health department to see if your state requires such reporting, and to whom.
Without disclosing any personal information (e.g., name, department, title) of the employee who tested positive, identify potentially affected employees who may have been in contact with the employee who tested positive. Notify the potentially affected employees that someone they may have been in contact with at work has tested positive for COVID-19 and will be isolating at home. Ask the potentially affected employees to follow the recommended precautions in the CDC’s Recommendations for Community-Related Exposure, which may include home isolation. Remind them that your agency has preventive measures in place to reduce the spread of the virus and that you are staying informed of all relevant information. Take additional precautions your agency deems reasonable and appropriate to prevent further transmission, but remember that every employee’s personal and medical information should be kept confidential. See 29 C.F.R. § 1630.14 and Response Question 7 below.
All US employers must report work-related fatalities, in-patient hospitalizations, amputations, and losses of an eye to OSHA (the Occupational Safety and Health Administration). Certain employers must also keep a log of employee injuries or illnesses that meet recording criteria set by regulation. Generally, employers with fewer than 10 employees, or those that fall within an industry considered to be “low-hazard” (classified by North American Industry Classification System, or NAICS, codes), are exempt from keeping routine injury and illness records. For more information on which entities are exempt, see this FAQ and Fact Sheet.
For the purposes of recordkeeping on work-related injuries and illnesses, OSHA has clarified that employers that are subject to OSHA’s recordkeeping rule are responsible for recording cases of COVID-19 if the case:
- Is confirmed as a COVID-19 illness;
- Is work-related, meaning an event or exposure in the work environment either caused or contributed to the employee’s infection with COVID-19 (29 C.F.R. 1904.5); and
- Involves one or more of the general recording criteria in 29 CFR 1904.7, such as medical treatment beyond first aid or days away from work.
On May 19, 2020, OSHA announced that for the remainder of the COVID-19 public health crisis, in reviewing whether an employer has made a reasonable determination of work-relatedness, OSHA will consider the following factors:
- The reasonableness of the employer's investigation into work-relatedness. Employers, especially small employers, are not expected to undertake extensive medical inquiries, given employee privacy concerns and most employers' lack of expertise in this area. It is sufficient in most circumstances for the employer, when it learns of an employee's COVID-19 illness, (1) to ask the employee how he believes he contracted the COVID-19 illness; (2) while respecting employee privacy, discuss with the employee his work and out-of-work activities that may have led to the COVID-19 illness; and (3) review the employee's work environment for potential SARS-CoV-2 exposure. The review in (3) should be informed by any other instances of workers in that environment contracting COVID-19 illness.
- The evidence available to the employer. The evidence that a COVID-19 illness was work-related will be considered based on the information reasonably available to the employer at the time it made its work-relatedness determination. If the employer later learns more information related to an employee's COVID-19 illness, OSHA will take that into account as well in determining whether an employer made a reasonable work-relatedness determination.
- The evidence that a COVID-19 illness was contracted at work. OSHA will take into account all reasonably available evidence, in the manner described above, to determine whether an employer has complied with its recording obligation. This cannot be reduced to a ready formula, but certain types of evidence may weigh in favor of or against work-relatedness. For instance:
- COVID-19 illnesses are likely work-related when several cases develop among workers who work closely together and there is no alternative explanation.
- An employee's COVID-19 illness is likely work-related if it is contracted shortly after lengthy, close exposure to a particular customer or coworker who has a confirmed case of COVID-19 and there is no alternative explanation.
- An employee's COVID-19 illness is likely work-related if his job duties include having frequent, close exposure to the general public in a locality with ongoing community transmission and there is no alternative explanation.
- An employee's COVID-19 illness is likely not work-related if she is the only worker to contract COVID-19 in her vicinity and her job duties do not include having frequent contact with the general public, regardless of the rate of community spread.
- An employee's COVID-19 illness is likely not work-related if he, outside the workplace, closely and frequently associates with someone (e.g., a family member, significant other, or close friend) who (1) has COVID-19; (2) is not a coworker, and (3) exposes the employee during the period in which the individual is likely infectious.
- OSHA will give due weight to any evidence of causation, pertaining to the employee illness, at issue provided by medical providers, public health authorities, or the employee herself.
In almost half of all states, OSHA has approved a job safety and health program to be operated by the state itself, rather than federal OSHA. CAAs in states with OSHA-Approved State Plans should be aware of the COVID-19-related guidance set forth at their state level. State plans are required to be at least as restrictive as federal requirements, but some states, like Virginia, have responded to the pandemic with new workplace safety standards that are more specific than current federal guidance. For example, under Virginia’s standard, all employers must clean and disinfect all common spaces, including bathrooms, frequently touched surfaces and doors at a minimum at the end of each shift. All shared tools, equipment, workspaces and vehicles must be cleaned and disinfected prior to transfer from one employee to another. Employers that do not abide by these standards may be cited by the Virginia Department of Labor and Industry (DOLI), with maximum penalties ranging from $13,494 per violation to $134,937 per violation. DOLI has also indicated that it may exercise its power to close down an employer’s operations if necessary to ensure employee safety. By contrast, federal OSHA has not issued any binding guidance on sanitizing workplaces during the COVID-19 pandemic, instead referring employers to the CDC’s recommendations. It has also emphasized that the agency will exercise discretion and consider an employer’s good faith efforts to comply with relevant guidance when deciding whether to cite a violation.
If an employee tests negative for COVID-19, he/she should follow the advice of his/her doctor. Note that it is possible for individuals with the virus to receive a false-negative test result, so depending on the circumstances surrounding an employee’s level of exposure, your CAA may still choose to ask the employee to self-quarantine for 14 days before returning to work.
Your CAA should keep confidential medical information in individualized files separate from each employee’s personnel files in a location that is only accessible to authorized personnel. Authorized personnel includes:
- HR personnel;
- Supervisors and managers who need to be informed of necessary accommodations, if applicable;
- First aid and safety personnel, if the employee is otherwise covered by the ADA and might require emergency treatment or if specific procedures are needed in the case of fire or other evacuations;
- Government officials investigating compliance with the ADA or other Federal and state laws;
- Workers’ compensation offices;
- Insurance companies; and
- Emergency responders in the event of an emergency.
See 29 C.F.R. § 1630.14, JAN Guidance, Prevention Question 4. If a manager or supervisor receives medical information involving COVID-19, or any other medical information, while teleworking, and is able to follow an employer’s existing confidentiality protocols while working remotely, the supervisor has to do so. But to the extent that is not feasible, the supervisor still must safeguard this information to the greatest extent possible until the supervisor can properly store it. This means that paper notepads, laptops, or other devices should not be left where others can access the protected information. Similarly, documentation must not be stored electronically where others would have access. A manager may even wish to use initials or another code to further ensure confidentiality of the name of an employee.
When disclosing confidential medical information, even to authorized personnel, CAAs should exercise discretion to safeguard the privacy of employees and prevent unnecessary disclosures. CAPLAW recommends limiting disclosures to the minimum information necessary for the receiving parties’ purposes. If possible, you should also obtain an employee’s written or verbal permission to disclose their information.
It is also important to note that privacy statutes in your state may impose requirements for maintaining the security of this data and penalties for failing to do so. A number of states’ data breach notification statutes define protected personal information as including medical or health information, which could encompass temperature and/or testing results.
No. The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule usually does not apply to employers, even if they collect health-related information, unless they conduct certain activities that subject them to HIPAA requirements.
“Covered entities” for purposes of HIPAA compliance include certain health care providers, health plans, and health care clearinghouses. Government funded programs whose principal purpose is not providing/paying for the cost of health care (e.g., a food stamp program), and government funded programs whose principal activity is directly providing health care or making of grants to fund the direct provision of health care (e.g., community health center) are not considered a “health plan,” and thus a CAA administering those services would not be a covered entity. However, a third party conducting or processing coronavirus testing in various workplaces may be subject to HIPAA. If your CAA has hired a third party to conduct or process COVID-19 testing for your employees (such as using a third-party laboratory to test a specimen for the presence of COVID-19), the third party will likely need to get a HIPAA-compliant authorization from your employee to share information with you, the employer. Thus, employers requiring COVID-19 testing should include in their testing packets a HIPAA-compliant authorization form that employees must sign and provide to the third-party service provider or laboratory. The employee may share their information directly with you if they so choose, and once it has been disclosed to you, it should be treated as a confidential medical record under the ADA.
The HIPAA Privacy Rule controls how a covered entity, such as a health plan or health care provider, can share individuals’ protected health information with an employer. If your CAA has a self-insured health plan such that you need to comply with the Privacy Rule, the Privacy Rule still does not apply to your employment records, but it does protect your medical or health plan records. The Department of Health and Human Services has issued guidance for covered entities concerning the disclosure of protected health information to first responders, HIPAA flexibilities, and the use of PHI for public health and health oversight activities during the pandemic, among other topics.
Under the Families First Act Coronavirus Response Act (the Act), employers must provide up to two weeks of Emergency Paid Sick Leave to employees forced to miss work for qualifying reasons related to the COVID-19 pandemic. At this time, employees who are sent home with COVID-19 symptoms or a positive diagnosis will likely be advised to self-quarantine by their health care provider, thereby making them eligible for Emergency Paid Sick Leave. Employees who have been exposed to the virus may qualify under qualifying reason #1 (“The employee is subject to a federal, state or local quarantine or isolation order related to COVID-19”), but only if federal, state or local guidance requires them to stay at home.
The Act also expands the federal Family and Medical Leave Act by providing paid leave (Emergency FMLA) to employees who are unable to work or telework because they are caring for a minor child whose school or childcare provider is closed or unavailable due to a public health emergency. Emergency Paid Sick Leave and Emergency FMLA are both available to employees of covered employers until December 31, 2020, so your CAA should ensure that it makes this leave available to employees who qualify to take it.
If an employee does not qualify for federal paid leave or has used up such leave, your CAA should follow its policies and act consistently when applying them. Many CAAs’ policies address unpaid administrative leave, paid vacation or PTO, and sick leave. There are no federal laws obligating an employer to provide paid vacation leave or PTO. Your CAA must consult with local counsel regarding state laws that may govern such leave.
CAPLAW has issued the following resources related to Emergency Paid Sick Leave and Emergency FMLA:
- DOL Issues Revised Rule on FFCRA Leave in Response to Court Ruling - September 15, 2020
- Federal Court Strikes Down Certain FFCRA Leave Rules - August 12, 2020
- IRS Issues Guidance on Claiming Credit for Paid Leave - April 1, 2020
- Paid Leave Under COVID-19 Response Act - March 20, 2020
Generally speaking, under federal law, employers are free to require employees to be vaccinated, so long as they properly consider religious and medical accommodation requests as mandated by Title VII of the Civil Rights Act of 1964 (Title VII) and the Americans with Disabilities Act (ADA). States may also have their own laws affording greater protection to employees with disabilities and prohibiting discrimination. As discussed further below, CAAs should consider federal and state guidance, as well as individual details particular to their organization, when determining whether to make vaccinations mandatory.
Under Title VII and the ADA, respectively, such programs must accommodate an employee’s sincerely held religious belief or disability. The federal agency charged with enforcing these laws, the Equal Employment Opportunity Commission (EEOC), has traditionally been wary of mandatory vaccination programs. However, the EEOC has acknowledged that COVID-19 meets the ADA’s “direct threat standard” – that is, an employee infected by COVID-19 poses a “significant risk of substantial harm” to others in the workplace – which has allowed employers to engage in more intrusive medical screening measures than the ADA would otherwise permit. This recognition of COVID-19 as a direct threat makes it seem more likely that the EEOC will consider additional flexibilities related to vaccine mandates. Nevertheless, the analysis of when an employee has a sincerely held religious belief or a disability that can be reasonably accommodated without undue hardship is conducted differently by individual federal and state courts, which makes facilitating a vaccine mandate more complicated.
Another factor that is likely to impact a vaccine mandate is that the available vaccines will be distributed pursuant to an Emergency Use Authorization (EUA) from the FDA. Because EUA vaccines are technically considered investigational and are issued under less strict standards than those required for formal FDA approval, it is possible that the FDA and CDC will take the position that employers cannot mandate vaccination under those circumstances. Like the EEOC, the FDA has not articulated a clear approach to COVID-19 vaccines, although the CDC has propagated guidance strongly favoring the vaccination of “critical workforce”. Organizations employing a unionized workforce will likely need to negotiate with the union in implementing a vaccine mandate pursuant to the National Labor Relations Act.
CAAs considering a mandatory vaccination program should consult local counsel as to relevant precedent and binding law in their state, review guidance issued by state and federal agencies, and ask themselves whether a mandatory vaccine program is necessary in light of alternative preventative measures (e.g., remote work, altered job duties, availability of PPE, etc.). If a CAA determines that a mandatory program is necessary, it should consider whether the program should be narrowly applied to situations where alternative measures are not viable, along with preparing to review and administer medical and religious accommodation requests, formulating a deadline for vaccination and disciplinary procedures for non-compliance, and looking into providing employees with a vaccine directly.
*Updated October 15, 2020
**Updated December 4, 2020
This resource is part of the Community Services Block Grant (CSBG) Legal Training and Technical Assistance (T/TA) Center. It was created by Community Action Program Legal Services, Inc. (CAPLAW) in the performance of the U.S. Department of Health and Human Services, Administration for Children and Families, Office of Community Services Cooperative Agreement – Grant Award Number 90ET0467-03. Any opinion, findings, conclusions, or recommendations expressed in these materials are those of the author(s) and do not necessarily reflect the views of the U.S. Department of Health and Human Services, Administration for Children and Families.