Legal Hold/Preservation: N.M. Oncology & Hematology Consultants v. Presbyterian Healthcare Servs., 2017 U.S. Dist. LEXIS 130959 (D.N.M. Aug. 16, 2017). In this case, the court declined to impose sanctions for a litigation hold that gave employees discretion when preserving documents, citing no prejudice to the opposing party. However, the court clarified that because data storage is inexpensive, there is less justification to allow employees preservation discretion, and that

With a growing number of COVID-19 cases around the U.S., companies are flooding their attorneys with questions over how to deal with the pandemic. Privacy challenges regarding asking and sharing workers' health information are also highly requested, lawyers said.

"Right now the outbreak does pose a lot more challenges with how you protect employees and the public and not disclose [their] information," said Dora Wang, a partner in Reed Smith's global regulatory enforcement group. 

Employers must toe the delicate line of not impeding workers' privacy while maintaining a safe working environment. But while various laws regulate the sharing and disclosure of personal medical information, the unique coronavirus outbreak may change how they are enforced. 

Some companies, however, may differ in which privacy laws they fall under. Uber Technologies Inc., for instance, released a notice that it's working with public health authorities and may temporarily suspend drivers who contract or are exposed to COVID-19. Joyce Smithey of Smithey Law Group noted that employee protections don't extend to contractors, but other companies must abide to various employee privacy rights.

Notably, the Americans with Disabilities Act regulates what type of medical information an employee is required to share with their employer, she said. However, the coronavirus spreading in close quarters could trump ADA restrictions if there's a "legitimate safety concern," she added.

Still, the employee's responses should only be shared with others on a need-to-know basis, Smithey said. Wang suggested companies designate some department, such as human resources, to collect and protect medical information to minimize privacy risk and meet the strict restrictions of disclosing health status in the event an employee contracts or is exposed to COVID-19.

The Health Insurance Portability and Accountability Act's privacy rule regarding medical records would also apply if the company provides health care plans to their employees, Smithey added. The rule requires safeguards to protect personal health information and sets limits and conditions on the uses and disclosures that may be made without patient authorization.

For multinational companies developing strategies to minimize the potential spread of the coronavirus in its offices and not run afoul of varying privacy laws, Wang said there is no one-size-fits-all solution.

Instead, companies should observe local requirements that apply to that office's location and abide by the general principles of data privacy such as data minimization, Wang said.

While there are established privacy laws on the books governing employee health and employer obligations, Smithey and Wang acknowledged these laws are being tested by a new deadly pandemic that may shift the public's—and perhaps regulators'—expectations.

"I think the U.S. in some ways is learning how to balance public health interest with privacy protection," Wang said. "It's not an easy one and it's a moving situation, and as public interest increases and there's greater political and social will for disease control, some of that privacy protection could be at least balanced with the overriding need for public safety. Companies are monitoring that."

|