As the lifting of stay-at-home orders and other restrictions on non-essential businesses shifts into high gear in most states, employers who are transitioning their employees back into the workplace are faced with a whole new set of questions. How and when should they reopen their offices, factories, or other workplaces. Will employees who have been working from home or furloughed be brought back all at once? Can they implement staggered shifts or continued work from home policies to reduce the number of employees in the workplace? Should they implement testing, screening, and other monitoring of employees?
Until there is a reliable COVID-19 vaccine, chief among these will be how can employee screening and monitoring be implemented in a manner that protects employee privacy, complies with applicable laws and regulations, and helps to identify employees who may be infected.
1. Employers may conduct workforce wide COVID-19 testing and screening
While, under normal circumstances, workforce-wide diagnostic testing would be impermissible under the Americans with Disabilities Act (ADA), the current epidemic has at least temporarily changed the workplace landscape.
Diagnostic testing of an employee usually requires the employer to demonstrate that it has an objectively reasonable belief that the specific employee to be tested poses a “direct threat” to the rest of its workforce. However, in guidance issued on March 21, 2020 and April 23, 2020, the EEOC announced the severity of the COVID-19 pandemic provides employers with sufficient objective evidence that any employee could be a “direct threat.” As such, testing of all employees for COVID-19 is permitted during the duration of the pandemic. In fact, some states have gone so far as requiring pre-workday employee screening (or at least assurances from employees that such screenings were done before entering the workplace).
Though testing is permitted, there are some practical and legal hurdles to actually implementing a testing program. First, an employer should decide whether it will implement COVID-19 tests or symptom-screening protocols. Some employers may simply require that employees undergo temperature checks and self-report symptoms. Other employers may seek to actually test for COVID-19. Employers that choose to conduct actual tests will need to consider how to obtain such tests, whether the tests are “accurate and reliable” as required under the EEOC guidance, and whether to conduct such tests in-house or rely on third-party testing services. Finally, employers will need to ensure any data collected related to an employee’s health, whether that be from a self-reported symptom check or a COVID-19 test, is properly and appropriately stored and protected. As explained below, employers will have a duty to ensure proper safeguards are in place, similar to safeguards generally associated with personal identifying information in the pre-COVID world. Limiting access and dissemination of confidential employee information will be key to reducing future breach liability.
2. Monitoring and Tracking Applications
One option some employers are evaluating is the use of monitoring and tracking applications in the workplace. These applications, which can be installed on mobile devices such as cellphones or smart watches, enable employers to track employees’ movement and locations. This can either be used to help ensure employees maintain sufficient physical separation from one another by alerting the user when someone is within six feet, or to track an employee’s location to assist in later identifying those employees who came into contact with an infected individual. In considering such a program, however, employers will need to ensure they are only capturing appropriate and necessary information, and should be mindful not to collect or record (both deliberately and incidentally) employee’s protected information. These geo-location tracking applications implicate numerous privacy concerns for employers, and should only be implemented after a thorough review of the risks and legal/compliance concerns.
3. Employee Privacy Considerations
The implementation of a testing or self-reporting program can open the door to unintended liability for failure to protect confidential employee information. Therefore, it is crucial that the implementation of the program be accompanied by the proper recordkeeping protocols.
Secure Storage of Screening and Testing Results
Any testing results or health screening records that are collected and retained by employers must be stored in a secure manner and kept confidential by the employer. These health screening and testing records require additional confidentiality protections as medical records under the ADA. As with other medical records, they must be kept in a separate file from the employee’s personnel file, and access to the medical records should be limited to only those employees who have a need to know. Generally, only the employer’s HR department should have access to such medical records information. An employee’s supervisor should not have access to this information unless it is necessary for the supervisor to implement a reasonable accommodation for the employee.
In addition to protections under the ADA, many state laws impose additional protections for protecting individual’s health information. These state law requirements may require employers to provide additional data security than otherwise applies to general employment records and trigger data breach notification requirements if such information is accessed or acquired without authorization.
Finally, employers should consider the record keeping and retention requirements that apply to such records. If employers are conducting regular diagnostic testing or daily screenings and maintaining the results of these tests, they will need to consider how long to retain such records in their systems. The standard retention period the employer uses for other similar employee health and medical records will also apply to these COVID-19 testing records. For example, if the employer keeps medical records or drug testing results for the length of the employee’s employment plus three years after termination, the same standard should apply to COVID-19 screening and testing results.
Geo-location tracking issues
If an employer decides to pursue additional employee tracing and monitoring measures through various digital monitoring and tracking applications, it should both give employees advance notice of such monitoring and seek to ensure employee buy-in. In some states, employers may need to provide express notice and obtain consent before tracking an employee’s location, even during work hours. The installation of such applications on personal mobile devices could lead to concerns about infringing on employees’ ability to engage in protected organizing activities. Similarly, employers may also be collecting information about an employees’ private and personal movements and locations in non-work hours in a manner for which they have no permissible purpose to use or retain such information. And, as a general matter, using mobile devices and applications to monitor employees’ locations to ensure social distancing or engage in contact tracing without the knowledge or consent of employees is likely to meet with employee disapproval and complaints.
Implementing such workplace monitoring through mobile applications will likely require that employers modify and update existing employee manuals and privacy policies. An employer will have to determine whether such monitoring efforts are more difficult and time-consuming than they are worth compared to other forms of screening and testing.
Ultimately, the goal of any employee COVID-19 monitoring and screening policy is to help ensure the safety and health of employees, while at the same time making them feel comfortable in returning to the workplace. The use of such monitoring and tracking applications may be counter to this goal if employees are not fully comfortable with the information that is being collected about them.
Related professionals
Related practices