Committee Blog: Employee Privacy Guidelines In A Time Of COVID-19

By NCIA’s Human Resources Committee 

Privacy Guidelines

As employers across the country bring back their employees, coronavirus risks remain top of mind. These concerns are important to ensure both the safety of their employees and the ability of their businesses to remain open. No one wants their employees to experience a spike in infections, or to subsequently close down as a result. However, protecting employees and businesses from COVID-19 is not as simple as asking an employee if they are sick. Federal and state laws restrict the type of medical information an employer can require an employee to share, even during the pandemic.

Under the Federal Americans with Disabilities Act (“ADA”) and the California Fair Employment and Housing Act (“FEHA”), medical inquiries are generally not allowed unless they are job-related and consistent with business necessity. Under this standard, medical inquiries are allowed if the employee poses a “direct threat” to him/herself or others because of a medical condition. FEHA regulations provide that factors to be considered when determining the merits of the direct threat defense include, but are not limited to:

• the duration of the risk;
• the nature and severity of the potential harm;
• the likelihood that potential harm will occur; and
• the imminence of the potential harm.

FEHA regulations say that the analysis of these factors should be “based on a reasonable medical judgment that relies on the most current medical knowledge and/or on the best available objective evidence.”

Unfortunately, this leaves the answer to whether employers may make medical inquiries or take temperatures “it depends.” Ultimately it becomes a business/risk tolerance decision. Asking employees questions about their medical condition and taking their temperatures may be more defensible if there has been documented exposure to COVID-19 in the workplace or a high rate of contagion in the community. 

The answer will also depend on what the Centers for Disease Control (“CDC”) determines. If the CDC makes a determination that COVID-19 is significantly more severe than the seasonal flu, it could pose a “direct threat.” Under the ADA, a direct threat is “a significant risk of substantial harm to the health or safety of the individual or others that cannot be eliminated or reduced by reasonable accommodation.” When the CDC advises testing, employers will have better standing to require it. CDC guidance is available here.

The Equal Employment Opportunity Commission has also issued specific COVID-19 guidance. The EEOC has advised employers that they may ask all employees who physically enter the workplace if they: (i) have COVID-19; (ii) have been tested for COVID-19; or (iii) are experiencing symptoms associated with COVID-19. Employers may also check the temperatures of employees entering the workplace. If an employee refuses to answer or refuses to submit to a temperature check, the employer may refuse to permit him or her to enter the workplace. However, employers should reassure refusing employees that the questions are simply designed to ensure workplace safety.

Employers may then single out individual employees for temperature checks or questioning only if the employer has a reasonable belief, based on objective evidence, that the employee has COVID-19 or symptoms associated with COVID-19. Employers may also ask employees if they have had contact with anyone who has been diagnosed with COVID-19 or who has symptoms of COVID-19. 

If a manager learns that an employee has COVID-19 or symptoms associated with COVID-19, the manager may disclose this information to which employees are necessary to take action consistent with CDC guidance. As a general rule, employers should try to limit the number of necessary employees” who know the employee’s identity. Everyone informed of the employee’s identity should be told to keep the information confidential. This includes telling others that an employee may be absent or working from home, but not explaining why. 

If employers do decide to take temps, there are multiple additional issues to consider: who will do the testing? What training? Will nonexempt employees be paid for their time undergoing testing? What will the employer do if the employee refuses? What information is recorded? All of these questions should be addressed in advance, and the answers should err on the side of caution. Tests should be simple, as non-invasive as possible, and as little data should be recorded as possible. Data for each employee should be recorded separately; an employer should not compile a single list of employees and their temperatures. An employer could, however, maintain a record of a single employees’ temperature of time. In other words, a single piece of paper could track an individual employee’s temperature history, but not the entire workforce’s temperature history.

In summary, employers must be careful to ensure their employees’ privacy rights remain respected and protected as they return to work. Employers may take reasonable precautions to ensure infected and at-risk individuals do not work, but must be careful in the questions they ask and the manner in which they record and keep the information. If a diagnosis is confirmed, employers must also be careful about who that information is shared with. Everyone wants a safe workplace; employers must simply keep in mind that a safe workplace is one that ensures an employee’s physical safety as well as their privacy. 

NCIA’s Human Resources Committee is comprised of human resource practitioners devoted to bringing best practices to the cannabis industry. Their focus is educating and bringing awareness to misclassification of employees, promoting guidelines for employee safety, clarification on wage and hour issues in the industry and creating checklists to being a legitimate employer.