With COVID-19 came a slew of issues regarding what is private health information and what employers can disclose. To understand what you can and can’t say, we need to look at two points, the Health Insurance Portability and Accountability Act (HIPAA) and providing information about potential exposure to the virus.
It’s easy for employers to misunderstand the requirements of HIPAA as it applies to the workplace. According to the U.S. Department of Health and Human Services (HHS), HIPAA “controls how a health plan or a covered health care provider shares (employees’) protected health information with an employer.” HIPAA does not protect employment records, even if those records are health-related. So to clarify this, HIPAA generally regulates how much information a health insurance plan provider or a health care provider can give to an employer. It does not protect information your employer might ask of you, like doctor’s notes, nor does it prevent employers from communicating to employees about COVID-19 in the workplace.
If you have an employee who tests positive, there are several steps you should take, as outlined in this article. You must inform other employees that they have been exposed to the virus and that they should contact their health care provider about next steps. You should not disclose the name of the infected employee in this case. Per the Equal Employment Opportunity Commission (EEOC) guidelines, you can, and should, notify your state health agency, including the employee’s name.
Employers might incorrectly assume they can’t inform their workers about a known exposure to COVID-19 because they think it’s protected health information. It is possible, and necessary, to communicate exposure without identifying the employee.