If HR knows someone at work has covid, can they let employees know?

August 1, 2021 11:52 AM

Any legal eagles on the green? Here's an example of a sticky issue that might come up at a certain workplace I know of: Let's say an employee has tested positive for COVID. They don't know if it's Delta or not.

HR knows, and this person's manager has just been told.

The COVID person's manager is trying to get clear on what they can tell the other employees.

HR says because of HIPAA regs, the manager can't mention the name of the employee who has COVID to other employees. They will let them know, however, that one of their co-workers has COVID, and that they were last in the office at a definite time on a certain day, and they'll be clear about the date and time. Just can't name the COVID person.

The COVID person, let's say, was in the office a few days ago without a mask, coughing.

Let's say the COVID person is an anti-vaxxer and their co-workers know it. Once it gets out that someone has COVID, most people will figure out who it was.

One other employee was definitely exposed. This employee was notified that he may have been exposed, and by whom.

Otherwise, what can this manager tell their employees?

My thought is that everyone needs to know the identity and health status of this person, immediately. Isn't the company open to legal action if someone else gets COVID, and they were unaware their co-worker had the virus because HR sealed off information about it?

Off the cuff, I'm thinking that every single darn employee needs to know their co-worker has COVID. Even if they weren't around that person on the day that this employee possibly exposed another co-worker, others are still vulnerable to getting the virus. But they don't know they're in danger. How can HR possibly defend not being clear about this?

What do you guys think, though?

posted by cartoonella to Law & Government (16 answers total)

Unless your workplace is a health care provider or generally related to health care, HIPAA probably doesn't apply. Further, HIPAA doesn't apply to employment records, even if the employment records include medical details. Here is a quick primer for HIPAA: link.

However, the ADA is generally taken to limit disclosure of individual's medical conditions, even in COIVD times.

How can HR possibly defend not being clear about this?

Beyond the law, what are the employees supposed to do with the information? They should be taking the same testing/quarantine actions (as appropriate and/or recommended by the government) if they were in contact with an arbitrary infected/transmitting person as if they were in contact with anti-vaxer conspiracy theorist Bob [*] who happens to be infected and transmitting.

[*] who may or may not be male; just an arbitrary name.
posted by saeculorum at 11:57 AM on August 1, 2021 [6 favorites]

HR is right. Notifying everyone in danger does not require naming the individual. Imagine this post said “AIDS person” instead of “covid person” and that’s the situation this employer is in.
posted by kapers at 12:02 PM on August 1, 2021 [9 favorites]

You may be been exposed to covid at x date and time please get tested is different than PERSON exposed you to covid, please get tested. Many workplaces are small enough that one is two but legally it's a different. The workplace can say we we didn't say person had covid specifically, we just said there was an exposure and for people to get tested. People figuring it out because someone was there with symptoms, or is out of work (or never comes back, honestly) is just inference not confirmation.
posted by AlexiaSky at 12:23 PM on August 1, 2021 [4 favorites]

Sounds like HR did what they had to do. There’s no reason the people who weren’t exposed need to know anything.
posted by ThePinkSuperhero at 12:32 PM on August 1, 2021 [1 favorite]

There’s no reason the people who weren’t exposed need to know anything.

One could argue that existing exposure thresholds may be optimistic, given some early results about increased transmission risk of the delta variant. Unfortunately, that's not the manager's call to make. I've been in more or less this situation as a manager (thankfully with information less life-or-death than COVID exposure, but similar idea), and it stinks. That's late stage capitalism for ya, though.

The manager could ask HR to expand the definition of 'exposure' to, for example, consider a shorter time-overlap / non-overlap and/or larger radius, but that probably won't happen without the force of regulation since HR's primary obligation is to the company's legal exposure and bottom line, not to individual employees' health.
posted by Alterscape at 12:42 PM on August 1, 2021 [4 favorites]

Isn't the company open to legal action if someone else gets COVID, and they were unaware their co-worker had the virus because HR sealed off information about it?

Not a lawyer, but I'm unaware of any legal requirement to disclose known illnesses in the workplace. Otherwise employers would have to reveal any time they knew an employee had the flu or any other number of communicable diseases that might be less severe but still potentially serious.
posted by Candleman at 1:01 PM on August 1, 2021 [1 favorite]

CDC has guidelines on this. Confidentiality is maintained because of the Americans with Disabilities Act, not HIPAA. And maybe Joe is an anti-vaxxer, but vaccinated Ann could still get COVID. Still, guessing is very different from being told. (And isn’t everyone potentially exposed if there are communal areas or even an elevator or stairwell?)
posted by FencingGal at 1:04 PM on August 1, 2021 [4 favorites]

Not an answer but perhaps helpful information anyhow:

I work for a large educational institution, and nearly every day I receive "Notice of Potential Workplace Exposure" emails that contain a link to the campus exposure dashboard, which then shows a map and list of exposure locations. The list contains dates and specific buildings where exposure might have happened ("4th floor" or "all floors" or "classrooms" or "1st and 2nd floors," for example), plus the case ID number. Some case ID numbers are attached to multiple locations, presumably in the case of an employee or student who entered more than one building during the time when they were potentially contagious. The emails also note "You are receiving this email notification in accordance with California Assembly Bill 685, which requires employers to notify employees of any potential workplace exposure within one day."
posted by knucklebones at 1:05 PM on August 1, 2021 [12 favorites]

At my job they email anyone who shared a building with an infected person for any amount of time and tell them that a person who was in x building on y date was later diagnosed with a disease (they have this info from the badges we use as building keys). This has been standard practice for years; I remember they sent one out when someone came to the office and it turned out they had measles.

I don't think there's any reason to name names. Ultimately even if it's a total stranger it's possible you shared a restroom, elevator, or stairwell with them. But it depends somewhat on how accurately your management is able to generate a list of who was in the same building as this person when.
posted by potrzebie at 1:38 PM on August 1, 2021 [3 favorites]

This doesn't make sense. Everyone at the company needs to know they have been exposed to a co-worker with COVID. They will be told this fact, minus details, by the manager, with HR's knowledge (at least, that's what I understand you to be saying.)

what is the purpose or the function of also sharing the co-worker's full name and/or contact info, belief system, etc.? None of those things are useful to know for their co-workers who must behave as though they have COVID until such time as they have isolated & tested sufficiently to be sure they don't, and mask afterwards anyway. None of these things are useful to know in order for employees to take precautions and operate on the assumption that any of the people they physically work with could be contagious, which was already true and which they should already have known. The added urgency of the information that someone has tested positive is useful; their name is not.

if the identified person is as reckless as they sound, they have probably infected someone else by now already, very possibly someone at work. so leading their co-workers to believe that there is only one dangerous/potentially infectious person to be around is deeply irresponsible and probably false.

HR should not be violating employee privacy for no useful purpose. HR should, however, have been notified when the person went around maskless, & intervened -- if being maskless in the office is against company policy. and if it isn't against company policy at the moment, there's the actual HR problem.
posted by queenofbithynia at 1:47 PM on August 1, 2021 [8 favorites]

There is a unquestionably a big difference in viral load between passing someone in the hall, and sitting next to them unmasked and speaking closely for two hours. In an ideal world we would know exactly who tested positive so people have a better sense of how carefully they should sequester themselves from close family until receiving test results. But there is no way that will happen for the above reasons. But yes, it absolutely matters who was positive and how long they spent in what proximity to specific people. Just because it’s unethical to share that info doesnt mean the info is meaningless.
posted by asimplemouse at 2:27 PM on August 1, 2021 [2 favorites]

I know multiple people who have gotten notifications like this across multiple workplaces and as far as I know, they’ve never included names, just dates/times and maybe locations . I can’t speak to whether this is a legal issue or just a more general confidentiality standard-practice thing but the workplace in question sounds like it’s functioning well within normal practice, in as much as “normal” exists right now.
posted by Stacey at 3:04 PM on August 1, 2021 [1 favorite]

Here's how this has been doing in lots of places: you get told if you are exposed to Covid because of a coworker (or student or whatever), but not who it is. In many places, people know or figure it out. That doesn't not mean you are legally entitled to this information.
posted by bluedaisy at 3:32 PM on August 1, 2021 [3 favorites]

My company has had to do this kind of alert a lot over the past year. I've seen both the "someone in the company had Covid" notices and the "you, EC, may have been exposed" notices. Here's how they both shook down.

1. Our HR tells the people who have likely been directly exposed to the infected person FIRST. They do not mention the infected person's name - when they told me, they only said that "based on who we know this person interacts with, it is likely you have been exposed." They asked me to self-quarantine for 14 days, and if I was fine at the end of those 14 days, to let them know, and I could then come back. It was only well after the fact that I figured out who it was, but HR did not tell me, nor would they confirm who it was if I ever asked.

2. Then once they inform the likely-to-have-been-exposed people, they send out a general notice to the company that "someone tested positive" and "we have asked some employees to self-quarantine as a result"; they then reiterate the company's Covid policy, encourage everyone to mask up and test themselves and remind everyone to report symptoms to HR as soon as possible.

The reason they inform the "you may have been exposed" people first is so that once they send out that general memo, it also sends a signal to the rest of the company that "if we didn't already reach out to you, you're ok." There are never any details about who was infected and where they may have infected others; only that someone has tested positive and "it's likely you were exposed" or "we've informed those people exposed privately and individually".
posted by EmpressCallipygos at 7:10 PM on August 1, 2021

Seems to me (based on experience in my workplace, not involving COVID) that ALL potentially exposed people need to know WHEN and WHERE they may have been exposed, but not by WHOM. This balances the right of those exposed to know they have been exposed with the right of the exposer to anonymity. It’s not important to know who, just that exposure exists.
posted by lhauser at 5:28 PM on August 2, 2021

Yes I'm am unclear why it's important to know who it was, can the OP clarify?
posted by WalkerWestridge at 8:34 PM on August 2, 2021