How COVID-19 is impacting HIPAA and ADA Compliance
Add the following concern to the myriad ways COVID-19 is prompting wholesale changes in the ways we live and work – how the staffing industry addresses the lawful disclosure of health information under HIPAA and ADA guidelines in the midst of a global pandemic. Read on for some information on the circumstances under which employers are permitted to disclose information related to an employee or contractor’s exposure and infection with COVID-19 under the existing regulations enunciated by the 1996 Health Insurance Portability and Accountability Act (HIPAA) and the Americans with Disabilities Act (ACA)
It can be difficult to determine whether it is legal under HIPAA to disclose important information about employees’ exposure to or infection with the Coronavirus. Particularly because it is critical for public health agencies to be able to trace contacts and the spread of the virus in impacted communities which requires timely and transparent reporting on who is infected, where and when.
Under HIPAA rules, “Covered Entities” such as healthcare providers, health plans, and healthcare clearinghouses may not disclose protected health information (PHI) without permission. If an individual tests positive for COVID-19, that diagnosis is considered to be “PHI”. HIPAA permits PHI to be disclosed to public health authorities to the extent that such disclosure is relevant to the fight against expanding contagion. Recent analysis by the National Law Review suggests it is appropriate for Covered Entities to disclose positive test results for COVID-19 to state and local health departments, Health and Human Services and the Centers for Disease Control (CDC). However, Covered Entities may not disclose PHI including positive COVID-19 test results to the media.
Under the Americans with Disabilities Act (ADA), the threshold is different. The ADA mandates that medical information obtained by an employer during work-related health examinations must be kept in a confidential medical file. That file must be kept separate from employees’ personnel files. The CDC is encouraging employers to query their workforce about recent travels, exposure to infected persons, and any COVID-19 related symptoms they may be experiencing. Any medical data or information gathered via this process must be treated as confidential.
Further, when positive cases are discovered in the workplace, ADA guidance suggests the employer investigate the exposure of others within the workforce without identifying or disclosing the name(s) of the employees with confirmed infection. Nor should the employer reveal any personally identifiable information regarding the infected employee. The ADA does not however, prohibit the disclosure of positive cases to state, local or federal health departments.
It can be challenging in some cases to determine if health information was attained by an employer through regular employer status or through self-insured health plans commonly used by contractors and other such resources. For this reason it is prudent to discuss these issues with an experienced workforce management solution provider such as nextSource. We’re making our consultants available to answer any questions you might have with respect to your own operations. Reach out today to learn how to ensure you’re properly protecting compliance with HIPAA and ADA regulations in the age of COVID-19.
To read more on this subject
