As the COVID-19 pandemic begins to subside in our area, employers have shifted their focus to returning employees to the workplace. In making this shift, employers must take steps to create a safe work environment to reduce the risk of transmission of the virus in the workplace, which may involve collecting information from employees regarding their health status and contacts. The collection of this information can raise privacy concerns that may vary based on the nature of the information collected, the manner in which it is collected, and whether and to what extent the information is shared once it is collected. For employers who are weighing the best way to maintain a safe work environment, this article discusses privacy issues associated with various methods of collecting information, and how they may be addressed.

The Collection of Medical Information

Employers looking to reduce the potential for the spread of COVID-19 within the workplace have a number of options. Many have implemented temperature-taking, including on-site scans, as well as reporting of at-home tests. Antibody testing has been lauded as a potential avenue for identifying employees who have already had the virus, with the hope that those employees will have developed immunity to contracting the illness again. Federal, state and local government agencies have been promoting contact-tracing as another method of reducing the potential spread of the disease, by notifying those who have come into contact with individuals who are later diagnosed with COVID-19 in an effort to halt the further spread of the illness. The marketplace has been expanding rapidly, with a number of technologies available to identify workers who may have contracted COVID-19 and trace their contacts in the workplace.

On April 23, the U.S. Equal Employment Opportunity Commission (EEOC) issued guidance regarding how certain laws, including the Americans with Disabilities Act (ADA) impact how employers may respond to the COVID-19 pandemic. Specifically, the ADA, among other things, only allows employers to mandate medical testing if the requirement is job-related and a business necessity. In the EEOC's recent guidance, the agency expressly noted that when the standard is applied to the current pandemic, an employer "may take steps to determine if employees entering the workplace have COVID-19 because an individual with the virus will pose a direct threat to the health of others." In light of this guidance, many employers have begun to analyze how many of the below methods may help them stop the spread of COVID-19 in the workplace.

Temperature Testing

One of the most common steps employers have taken to identify individuals who may have contracted COVID-19 is the use of temperature checks in the workplace. Employees may be asked to take their own temperature, or temperatures may be taken by employers using touchless thermometers in the workplace. Some employers have also employed facial scanners with infrared sensors that allow them to measure an employee's temperature.

Based on COVID-19's ability to spread throughout the community and the prevalence of fevers in infected persons, the EEOC has expressly permitted employers to measure employee body temperatures during this pandemic.

Diagnostic Testing

 Many employers have turned to diagnostic testing to keep infected employees out of the workplace. Diagnostic tests use nasal or saliva samples to screen for the presence of genetic material associated with SARS-CoV-2, a virus believed to cause COVID-19. Positive tests indicate that an individual is currently infected with COVID-19, while negative tests demonstrate the absence of a current infection. A negative test result, however, does not ensure that an employee could not contract the virus at a later time.

As long as an employer uses an accurate and reliable testing method, the EEOC has stated that the employer may "choose to administer COVID-19 testing to employees before they enter the workplace to determine if they have the virus."

Antibody Testing

 Antibody testing, theoretically, would enable employers to determine whether certain individuals may be immune from further COVID-19 infections, allowing those employees to return to the workplace sooner, and with fewer necessary precautions in terms of social distancing and the use of protective equipment. The tests are performed by health care professionals through blood samples that are examined to determine whether an individual has developed antibodies against the virus.

To date, the Food and Drug Administration, the CDC, and the World Health Organization have all expressed doubt regarding whether antibody tests can be used to reliably demonstrate that certain individuals are impervious to further COVID-19 infections. In fact, the CDC has noted that antibody tests "should not be used to make decisions about returning persons to the workplace." In accordance with the CDC's position, on June 17, the EEOC updated its guidance to clarify that employers are not permitted to conduct antibody testing as a condition of permitting employees to re-enter the workplace. Specifically, the EEOC stated that it believes that such testing, at this time, does not meet the "job related and consistent business necessity" requirements for medical testing under the ADA.  Accordingly, mandatory antibody testing is not an option at this time for employers seeking to screen employees prior to their return to work.

Contact Tracing

 Contact tracing has been heralded as one of the most effective ways to identify and stop potential COVID-19 outbreaks before they become prevalent. This prevention method requires employers to collect information regarding an infected employee's recent contacts to determine whether other employees may have been exposed to COVID-19. Once identified, these employees may be asked to monitor their symptoms and self-quarantine until COVID-19's incubation period expires.

Contact tracing can be accomplished digitally or manually. With regards to digital contact tracing, a number of companies have developed applications that would enable employers to track the movement of employees within the workplace. These applications could be downloaded to a mobile phone, or offered through a wearable device, such as a bracelet, card, or other device that can be clipped to a belt. Some devices are designed merely to communicate with one another via Bluetooth, notifying employees by sound or light if they are within an unsafe distance of one another. Others collect data and deliver it to an application, tracking the movements of employees and reporting them to the employer. Some devices employ geolocation data in order to track employee movement. If an employee subsequently tests positive for COVID-19 and reports the diagnosis to the employer, the employer would be able to review the data and notify other employees who were in close proximity with the infected individual.

Privacy Concerns Related to the Collection of Medical Information

As a general matter, the collection of medical information by an employer, with the exception of the collection of medical information for purposes of an employer-sponsored group health plan, is not covered by the Health Insurance Portability and Accountably Act (HIPAA). However, to the extent that an employer would like to collect information relating to testing results directly from an employee's physician, the employer should seek the employee's written consent regarding the release of this information. Once the information is received (regardless of whether the information comes from the employee or the physician) the company should ensure that it can only be accessed by individuals who require the information. Moreover, if an employer provides other employees with notice that they may have come into contact with an individual who has been infected, the notice should not include the identity of the infected individual.

Employers should also be aware of the various data breach notification statutes that may apply. Although states' definitions of protected personal information may vary, many protect medical or health information, which may include health records or medical information. Some also define biometric information as protected personal information, and still others have biometric information privacy laws, including Illinois, which has a Biometric Information Privacy Act that provides a private right of action. These biometric laws typically protect biometric identifiers such as retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry and other physical characteristics unique to an individual.

While these statutes likely would not apply to temperatures taken by an employer because they generally exclude information captured to diagnose or screen for illnesses, they may apply to some of the technologies now being offered, including facial recognition scans that can be used to capture an individual's face geometry or other unique facial characteristic. To the extent this is the case, employers should take care to advise their employees in writing of the collection of their biometric information, and the purpose for which the information is being collected. Employers should obtain employee consent to the employer's use of biometric equipment in writing. Any information that is collected should be destroyed once the employer uses the information for its identified purpose.

Employers subject to the California Consumer Protection Act should proceed in a similar manner. Among other things, the CCPA requires covered businesses to notify employees that "personal information," including medical and biometric information, will be collected and the business purpose for such collection.

Where applicable due to the collection of what is defined as protected personal information, data breach notification laws require businesses to notify individuals if their protected information is subject to a breach. The laws may also impose certain requirements for maintaining the security of the protected information. Some states, including Pennsylvania, also recognize a common law claim for negligence based on an employer's obligation to exercise reasonable care to protect sensitive personal information collected and stored by the employer. Accordingly, employers should be sure to secure any protected personal information collected from employees, including by limiting access to the information, and by not retaining it any longer than absolutely necessary. If medical information is retained, it should be maintained as a confidential medical record and should be separated from an employee's personnel file.

Privacy Concerns Relating to the Use of Monitoring Software

Employers considering monitoring software to track employee movement should be aware that the installation of such applications on personal devices, and potentially company-owned devices, could raise privacy concerns. Many states, including Pennsylvania, have various statutes and common law rules that allow individuals, including employees, to bring a private right of action for privacy violations. The touchstone for many of these cases is whether the individual has a "reasonable expectation of privacy" in the identified area.

To reduce the risk of triggering these types of actions, employers considering the use of contact-tracing applications on a cellphone should detail to employees the information that will be collected and the purpose for the collection. Moreover, employers should consider updating their employee handbooks to reflect this policy and asking employees to provide a written acknowledgement and consent to the installation and use of the application. To the extent employers intend to ask employees to install the application on a personal device, in addition to privacy considerations, employers may face other obstacles, including determining how to address employees who may not own a mobile device, or who are required to store personal devices or are otherwise not permitted to use them at a worksite. Additionally, if the application is dependent on employees entering data regarding their health or the medical diagnosis of a COVID-19 infection, the application can only function properly if employees are actually entering the necessary data.

Additionally, employers should carefully consider the technology behind any monitoring system, to determine how it tracks activity and what information is collected and stored. Technologies that employ geolocation data may implicate GPS tracking laws, as well as off-duty conduct laws that exist in many states. To reduce these risks, employers may wish to consider devices that employ Bluetooth technology, and ensure that any monitoring is limited to the workplace and does not extend to out-of-office activity.

Stay Informed

In the wake of the COVID-19 pandemic, many employers have begun to collect additional information about their employees to prevent the spread of virus within the workplace. Employers should consider applicable privacy laws and regulations and carefully consider the scope and manner of information being collected to ensure that their actions comply with all applicable federal and state laws.

Risa Boerner is a partner at the national labor and employment law firm Fisher Phillips and is chair of the firm's data security and workplace privacy practice group. She can be reached at [email protected].

Luke McDaniels is an associate at the firm representing employers in a broad range of labor and employment matters in state and federal courts and agencies. He can be reached at [email protected].