Health Tech, Health Services, Legal

Employers must consider privacy protections as they roll out contact-tracing tools

Companies are rolling out suites of tools to monitor their workforce for Covid-19 cases. But even in the midst of a pandemic, there are still limitations on what information they can collect and how they can use it.

Covid tracking

Consulting giant PwC developed a contact-tracing app that would track if employees had been in close contact with each other while in the office, alerting them if they might have been exposed to Covid-19. While the company is testing the system internally, it plans to offer it to its clients.

Other companies are turning to screening tools, such as Microsoft and UnitedHealth Group, which are rolling out an app that would require employees to answer a series of questions about symptoms before they enter the office.

It might sounds a bit like a scene out of 1984, but the use of these tools is a reality as companies try to mitigate the spread of Covid-19 as workplaces reopen. Even in the midst of a pandemic, employers must be cautious not to encroach on personal health data that would be protected under privacy and employment laws, attorneys said.

For example, companies can require employees to participate in a temperature check when they come into work. But they can’t ask workers about their medical history or any underlying conditions while trying to determine who might be at a higher risk from Covid-19.

“While (temperature) checks are considered to be medical examinations, they do not violate ADA rules on medical inquiries because in the pandemic environment they are considered consistent with business necessity.  You still have to abide by ADA requirements with respect to the confidentiality of medical information and retain records of temperature checks in confidential medical files kept separate from the normal personnel file,” Richard Rainey, a labor and employment partner with Womble Bond Dickinson, wrote in an email.

In some cases, health systems are offering services to help companies monitor and contact trace employees. For example, New Orleans-based Ochsner Health System began offering local companies health screenings, temperature checks and virtual appointments.

A startup launched within Renton, Washington-based Providence St. Joseph Health, Ayin Health Solutions also began offering screening tools for employers. The company said it would offer employee health screenings, Covid-19 testing, risk-stratification and contact tracing tools.

“It’s not simply enough to test and just reopen the door to reentry. It’s an ongoing process,” said Dr. Rhonda Medows, CEO of Ayin Health Solutions and president of population health at Providence St. Joseph. “(Workers) are all part of the frontline. They haven’t all gotten the protections they’ve needed. We’d like to go in and help. Everything from social distancing and masks, to also helping them assess employee populations.”


Risk stratification requirements

For the latter, Ayin Health said the employer would receive aggregated, de-identified data on risk-stratified employee cohorts. They would not receive information on an individual’s health conditions or medical history.

From there, the idea is that companies would be able to offer reasonable accommodations, such as working from home, a separate facility, or alternating work days.

From a legal perspective, employers can use this information to make the work environment safer for employees, but they cannot force them out of the workplace for their own protection. Companies also cannot ask employees if they have underlying medical conditions that might make them vulnerable to Covid-19.

If an employee brings up a health concern, their employer must have a good faith dialogue to see if accommodations can be made that would allow them to safely perform their job.

“In the pandemic setting this could be allowing telework if possible, arranging work stations in a way to allow for social distancing, or the use of personal protective equipment,” Rainey wrote. “Allowing the employee to take leave would also be a possible accommodation in some cases.”


Location data

Like PwC, Ayin is also offering a location-based tool that can tell when employees have come within proximity of each other and can send screening questions for Covid-19 symptoms. It also includes a wearable that can check their temperature for fever. The device would only be used in a workplace setting.

“It not only helps us identify them to get them tested or get them care, but it also helps us know if we need to do contact tracing,” Medows said.

When it comes to contact tracing and location monitoring, companies should be cautious in the questions they ask and how much data they collect, said Libbie Canter, a partner with Covington and Burling who specializes in privacy and data security.

“Companies need to think about not collecting more data than they reasonably need. Do you need precise geolocation? Is proximity sufficient?” she said.

When it comes to determining if an employee might have been exposed to Covid-19 outside of the workplace, companies should be extra cautious. For example, while an employee might share that they had traveled recently, they might also share that they had gone to a place of worship, which is protected.

Canter said companies should think carefully about who has access to  this data, when it will be deleted, and what notice or consent they will provide to employees.

“I do think there are some circumstances where employers would be able to condition returning to the workplace on the employee participating in some information sharing,” she said. “That doesn’t mean that they have to consent to share anything and everything.”


Photo credit: LeoPatrizi, Getty Images