If an employee arrives at work with COVID-19 symptoms or develops symptoms during the workday, ask him/her to go home and to stay home from work until he/she has consulted with a healthcare provider and met the CDC’s criteria to discontinue home isolation. According to EEOC guidance, asking an employee if they are experiencing symptoms of COVID-19, taking their temperature, asking them to get a COVID-19 test, or telling them to stay home does not violate their rights under the Americans with Disabilities Act (ADA) or the Rehabilitation Act due to the direct threat that COVID-19 currently poses to employers’ workplaces. However, in order to protect an employee’s confidential medical information, CAAs may want to consider implementing a reporting protocol or policy in order to minimize the number of people who receive information about an employee’s symptoms or COVID-19 diagnosis. All employer officials who are designated as needing to know the identity of an employee should be specifically instructed that they must maintain the confidentiality of this information.

After the employee has left the workplace, follow the CDC cleaning and disinfection recommendations. The ADA does not interfere with a designated representative of the employer interviewing the employee to get a list of people with whom the employee possibly had contact through the workplace, so that the employer can then take action to notify those who may have come into contact with the employee, without revealing the employee’s identity. For example, using a generic descriptor, such as telling employees that “someone at this location” or “someone on the fourth floor” has COVID-19, provides notice and does not violate the ADA’s prohibition of disclosure of confidential medical information. For small employers, coworkers might be able to figure out who the employee is, but employers in that situation are still prohibited from confirming or revealing the employee’s identity. They can disclose that the employee is on leave or is teleworking, but cannot disclose the reason why. Ask the potentially affected employees to follow the recommended precautions in the CDC’s Recommendations for Community-Related Exposure, which may include home isolation. Remind them that your agency has preventive measures in place to reduce the spread of the virus and that you are staying informed of all relevant information.

Take additional precautions your agency deems reasonable and appropriate to prevent further transmission, but remember that every employee’s personal and medical information should be kept confidential. See 29 C.F.R. § 1630.14 and Response Question 7 below.

Make sure your employees know not to come into work if they are experiencing symptoms of COVID-19 or if they have been exposed to someone with COVID-19. Ask employees to contact their supervisor via phone or email to let the supervisor know if they are experiencing symptoms or have been exposed. If the employee is experiencing COVID-19 symptoms, refer to the previous question. If the employee has been exposed to someone with COVID-19, the CDC recommends asking him/her to self-quarantine for 14 days, telework if possible, and self-monitor for symptoms.

According to the EEOC, employers can ask employees who report feeling ill or call in sick questions about their symptoms to determine if they have or may have COVID-19. Many law firms have interpreted this guidance to mean that employers may ask employees for the results of their COVID-19 tests and may require employees to self-disclose a COVID-19 diagnosis. If your CAA adopts a policy requiring employees to report symptoms and/or diagnoses, make sure that it is applied in a consistent and non-discriminatory manner. COVID-19 third party testing providers that are subject to HIPAA must obtain an employee’s consent before sharing the employee’s test results with their employer. All employee symptom and diagnosis information should be treated as a confidential medical record, even if it is not generated by a healthcare professional. See 29 C.F.R. § 1630.14 and Response Question 7 below.

If one of your employees tests positive for COVID-19, he/she should follow the advice of his/her doctor and the CDC. In most states, you are not required to notify the appropriate public health bodies of the positive test result. However, some states, like New Mexico, have required employers to report positive test results. Check with your local counsel and public health department to see if your state requires such reporting, and to whom.

Without disclosing any personal information (e.g., name, department, title) of the employee who tested positive, identify potentially affected employees who may have been in contact with the employee who tested positive. Notify the potentially affected employees that someone they may have been in contact with at work has tested positive for COVID-19 and will be isolating at home. Ask the potentially affected employees to follow the recommended precautions in the CDC’s Recommendations for Community-Related Exposure, which may include home isolation, and perform enhanced workplace cleaning and disinfecting once isolating employees have left the premises. Remind them that your agency has preventive measures in place to reduce the spread of the virus and that you are staying informed of all relevant information. Take additional precautions your agency deems reasonable and appropriate to prevent further transmission, but remember that every employee’s personal and medical information should be kept confidential. See 29 C.F.R. § 1630.14 and Response Question 7 below.

All US employers must report work-related fatalities, in-patient hospitalizations, amputations, and losses of an eye to OSHA (the Occupational Safety and Health Administration). Certain employers must also keep a log of employee injuries or illnesses that meet recording criteria set by regulation. Generally, employers with fewer than 10 employees, or those that fall within an industry considered to be “low-hazard” (classified by North American Industry Classification System, or NAICS, codes), are exempt from keeping routine injury and illness records. For more information on which entities are exempt, see this FAQ and Fact Sheet.

For the purposes of recordkeeping on work-related injuries and illnesses, OSHA has clarified that employers that are subject to OSHA’s recordkeeping rule are responsible for recording cases of COVID-19 if the case:

1. Is confirmed as a COVID-19 illness;
2. Is work-related, meaning an event or exposure in the work environment either caused or contributed to the employee’s infection with COVID-19 (29 C.F.R. 1904.5); and
3. Involves one or more of the general recording criteria in 29 CFR 1904.7, such as medical treatment beyond first aid or days away from work.

On May 19, 2020, OSHA announced that for the remainder of the COVID-19 public health crisis, in reviewing whether an employer has made a reasonable determination of work-relatedness, OSHA will consider the following factors:

• The reasonableness of the employer’s investigation into work-relatedness. Employers, especially small employers, are not expected to undertake extensive medical inquiries, given employee privacy concerns and most employers’ lack of expertise in this area. It is sufficient in most circumstances for the employer, when it learns of an employee’s COVID-19 illness, (1) to ask the employee how he believes he contracted the COVID-19 illness; (2) while respecting employee privacy, discuss with the employee his work and out-of-work activities that may have led to the COVID-19 illness; and (3) review the employee’s work environment for potential SARS-CoV-2 exposure. The review in (3) should be informed by any other instances of workers in that environment contracting COVID-19 illness.
• The evidence available to the employer. The evidence that a COVID-19 illness was work-related will be considered based on the information reasonably available to the employer at the time it made its work-relatedness determination. If the employer later learns more information related to an employee’s COVID-19 illness, OSHA will take that into account as well in determining whether an employer made a reasonable work-relatedness determination.
• The evidence that a COVID-19 illness was contracted at work. OSHA will take into account all reasonably available evidence, in the manner described above, to determine whether an employer has complied with its recording obligation. This cannot be reduced to a ready formula, but certain types of evidence may weigh in favor of or against work-relatedness. For instance: 

• • COVID-19 illnesses are likely work-related when several cases develop among workers who work closely together and there is no alternative explanation.
  • An employee’s COVID-19 illness is likely work-related if it is contracted shortly after lengthy, close exposure to a particular customer or coworker who has a confirmed case of COVID-19 and there is no alternative explanation.
  • An employee’s COVID-19 illness is likely work-related if his job duties include having frequent, close exposure to the general public in a locality with ongoing community transmission and there is no alternative explanation.
  • An employee’s COVID-19 illness is likely not work-related if she is the only worker to contract COVID-19 in her vicinity and her job duties do not include having frequent contact with the general public, regardless of the rate of community spread.
  • An employee’s COVID-19 illness is likely not work-related if he, outside the workplace, closely and frequently associates with someone (e.g., a family member, significant other, or close friend) who (1) has COVID-19; (2) is not a coworker, and (3) exposes the employee during the period in which the individual is likely infectious.
  • OSHA will give due weight to any evidence of causation, pertaining to the employee illness, at issue provided by medical providers, public health authorities, or the employee herself.

In almost half of all states, OSHA has approved a job safety and health program to be operated by the state itself, rather than federal OSHA. CAAs in states with OSHA-Approved State Plans should be aware of the COVID-19-related guidance set forth at their state level. State plans are required to be at least as restrictive as federal requirements, but some states, like Virginia, have responded to the pandemic with new workplace safety standards that are more specific than current federal guidance.

For example, under Virginia’s standard, all employers must clean and disinfect all common spaces, including bathrooms, frequently touched surfaces and doors at a minimum at the end of each shift. All shared tools, equipment, workspaces and vehicles must be cleaned and disinfected prior to transfer from one employee to another. Employers that do not abide by these standards may be cited by the Virginia Department of Labor and Industry (DOLI), with maximum penalties ranging from $13,494 per violation to $134,937 per violation. DOLI has also indicated that it may exercise its power to close down an employer’s operations if necessary to ensure employee safety.

By contrast, federal OSHA has not issued any binding guidance on sanitizing workplaces during the COVID-19 pandemic, instead referring employers to the CDC’s recommendations and issuing non-binding guidance encouraging routine and enhanced sanitation practices. The Biden Administration has directed OSHA to promulgate a binding Emergency Temporary Standard (ETS) to ensure workplace safety during the COVID-19 pandemic and to increase enforcement efforts. The White House is currently reviewing a draft ETS prepared by OSHA, so new workplace safety standards are likely forthcoming.

If an employee tests negative for COVID-19, he/she should follow the advice of his/her doctor. Note that it is possible for individuals with the virus to receive a false-negative test result, so depending on the circumstances surrounding an employee’s level of exposure, your CAA may still choose to ask the employee to self-quarantine for 14 days before returning to work.

Your CAA should keep confidential medical information in individualized files separate from each employee’s personnel files in a location that is only accessible to authorized personnel. Authorized personnel includes:

1. HR personnel;
2. Supervisors and managers who need to be informed of necessary accommodations, if applicable;
3. First aid and safety personnel, if the employee is otherwise covered by the ADA and might require emergency treatment or if specific procedures are needed in the case of fire or other evacuations;
4. Government officials investigating compliance with the ADA or other Federal and state laws;
5. Workers’ compensation offices;
6. Insurance companies; and
7. Emergency responders in the event of an emergency.

See 29 C.F.R. § 1630.14, JAN Guidance, Prevention Question 4. If a manager or supervisor receives medical information involving COVID-19, or any other medical information, while teleworking, and is able to follow an employer’s existing confidentiality protocols while working remotely, the supervisor has to do so. But to the extent that is not feasible, the supervisor still must safeguard this information to the greatest extent possible until the supervisor can properly store it. This means that paper notepads, laptops, or other devices should not be left where others can access the protected information. Similarly, documentation must not be stored electronically where others would have access. A manager may even wish to use initials or another code to further ensure confidentiality of the name of an employee.

When disclosing confidential medical information, even to authorized personnel, CAAs should exercise discretion to safeguard the privacy of employees and prevent unnecessary disclosures. CAPLAW recommends limiting disclosures to the minimum information necessary for the receiving parties’ purposes. If possible, you should also obtain an employee’s written or verbal permission to disclose their information.

It is also important to note that privacy statutes in your state may impose requirements for maintaining the security of this data and penalties for failing to do so. A number of states’ data breach notification statutes define protected personal information as including medical or health information, which could encompass temperature and/or testing results.

No. The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule usually does not apply to employers, even if they collect health-related information, unless they conduct certain activities that subject them to HIPAA requirements.

“Covered entities” for purposes of HIPAA compliance include certain health care providers, health plans, and health care clearinghouses. Government funded programs whose principal purpose is not providing/paying for the cost of health care (e.g., a food stamp program), and government funded programs whose principal activity is directly providing health care or making of grants to fund the direct provision of health care (e.g., community health center) are not considered a “health plan,” and thus a CAA administering those services would not be a covered entity. However, a third party conducting or processing coronavirus testing in various workplaces may be subject to HIPAA. If your CAA has hired a third party to conduct or process COVID-19 testing for your employees (such as using a third-party laboratory to test a specimen for the presence of COVID-19), the third party will likely need to get a HIPAA-compliant authorization from your employee to share information with you, the employer. Thus, employers requiring COVID-19 testing should include in their testing packets a HIPAA-compliant authorization form that employees must sign and provide to the third-party service provider or laboratory. The employee may share their information directly with you if they so choose, and once it has been disclosed to you, it should be treated as a confidential medical record under the ADA.

The HIPAA Privacy Rule controls how a covered entity, such as a health plan or health care provider, can share individuals’ protected health information with an employer. If your CAA has a self-insured health plan such that you need to comply with the Privacy Rule, the Privacy Rule still does not apply to your employment records, but it does protect your medical or health plan records. The Department of Health and Human Services has issued guidance for covered entities concerning the disclosure of protected health information to first responders, HIPAA flexibilities, and the use of PHI for public health and health oversight activities during the pandemic, among other topics.

Under the Families First Act Coronavirus Response Act (the Act), employers must provide up to two weeks of Emergency Paid Sick Leave to employees forced to miss work for qualifying reasons related to the COVID-19 pandemic. At this time, employees who are sent home with COVID-19 symptoms or a positive diagnosis will likely be advised to self-quarantine by their health care provider, thereby making them eligible for Emergency Paid Sick Leave. Employees who have been exposed to the virus may qualify under qualifying reason #1 (“The employee is subject to a federal, state or local quarantine or isolation order related to COVID-19”), but only if federal, state or local guidance requires them to stay at home.

The Act also expands the federal Family and Medical Leave Act by providing paid leave (Emergency FMLA) to employees who are unable to work or telework because they are caring for a minor child whose school or childcare provider is closed or unavailable due to a public health emergency. Emergency Paid Sick Leave and Emergency FMLA are both available to employees of covered employers until December 31, 2020, so your CAA should ensure that it makes this leave available to employees who qualify to take it.

If an employee does not qualify for federal paid leave or has used up such leave, your CAA should follow its policies and act consistently when applying them. Many CAAs’ policies address unpaid administrative leave, paid vacation or PTO, and sick leave. There are no federal laws obligating an employer to provide paid vacation leave or PTO. Your CAA must consult with local counsel regarding state laws that may govern such leave.

CAPLAW has issued the following resources related to Emergency Paid Sick Leave and Emergency FMLA:

• DOL Issues Revised Rule on FFCRA Leave in Response to Court Ruling – September 15, 2020
• Federal Court Strikes Down Certain FFCRA Leave Rules – August 12, 2020
• IRS Issues Guidance on Claiming Credit for Paid Leave – April 1, 2020
• Paid Leave Under COVID-19 Response Act – March 20, 2020

Generally speaking, under federal law, employers are free to require employees to be vaccinated as long as they properly consider medical accommodation requests under the Americans with Disabilities Act (ADA) and religious accommodation requests as mandated by Title VII of the Civil Rights Act of 1964 (Title VII). States may also have their own laws affording greater protection to employees with disabilities and prohibiting discrimination. CAAs should consider federal and state guidance, as well as details particular to their organization, when determining whether to require employee vaccinations.

CAAs considering a mandatory vaccination program should consult local counsel as to relevant precedent and binding law in their state, review guidance issued by state and federal agencies, and ask themselves whether a mandatory vaccine program is necessary in light of alternative preventative measures (e.g., remote work, altered job duties, availability of PPE, etc.). If a CAA determines that a vaccine mandate is necessary, it should consider whether the mandate should be narrowly applied to situations where alternative measures are not viable. The CAA should also prepare to review and administer medical and religious accommodation requests, formulate a deadline for vaccination and disciplinary procedures for non-compliance, and consider providing employees with a vaccine directly. Organizations employing a unionized workforce will likely need to negotiate with the union in implementing a vaccine mandate pursuant to the National Labor Relations Act.

CAAs conducting employee and community vaccine awareness efforts may choose to support such activities with CSBG funds. In Information Memorandum 161, the Office of Community Services states that CSBG CARES and regularly-appropriated CSBG funding may be used to support fair and equitable COVID-19 vaccination efforts and related activities. CAAs may implement CSBG-funded public health activities, including the promotion of COVID-19 vaccinations, based on the results of local community needs assessments, which may include a review of health outcomes and available health care resources. In addition, CAAs may partner with other organizations serving low-income residents, including public health departments, religious organizations, charitable groups, and community organizations, in supporting vaccination efforts.

Although COVID-19 vaccine mandates are generally allowable under federal law, CAAs are still obligated to consider employees seeking an exemption from the mandate due to the employee’s disability or medical condition, which will trigger a request for a reasonable accommodation under the ADA.

The Equal Employment Opportunity Commission (EEOC) has issued guidance clarifying that vaccination requirements that screen out or tend to screen out an individual with a disability must meet the ADA’s “direct threat standard” – that is, the employer must show that an unvaccinated employee poses a “significant risk of substantial harm” to others in the workplace. Employers must conduct an individualized assessment of four factors in determining whether a direct threat exists: the duration of the risk; the nature and severity of the potential harm; the likelihood that the potential harm will occur; and the imminence of the potential harm.

If an employer is able to show that the unvaccinated employee poses a direct threat in the workplace, the employer and employee should communicate to determine whether a reasonable accommodation for the employee’s disability exists. This informal process is known as “the interactive process”. A reasonable accommodation is a change in the work environment that allows an employee with a disability to perform their essential job functions and enjoy equal benefits and privileges of employment, so long as the accommodation does not impose an undue hardship on the employer. Under the ADA, an undue hardship is any significant difficulty or expense incurred in providing the accommodation. Examples of possible reasonable accommodations for an unvaccinated employee include teleworking, or taking leave under the federal Family and Medical Leave Act (FMLA) or under the employer’s policy.

If there is no way to provide a reasonable accommodation without posing an undue hardship, an employer may exclude the employee from the workplace. However, the employer may not necessarily terminate the employee, as other employee rights under equal employment opportunity laws or other federal, state, or local authorities may prohibit such action. Further, since all currently available vaccines are being distributed pursuant to an Emergency Use Authorization (EUA), which utilizes standards that are less strict than those required for formal FDA approval, employers are advised not to terminate an employee for refusing to be vaccinated.

More information about reasonable accommodations under the ADA and Title VII may be found here.

Although COVID-19 vaccine mandates are generally allowable under federal law, CAAs are still obligated to consider employees seeking an exemption from the mandate due to the employee’s sincerely held religious belief under Title VII.

Sincerely held religious beliefs are defined by the EEOC as “theistic beliefs…as well as non-theistic moral or ethical beliefs as to what is right and wrong which are sincerely held with the strength of traditional religious views.” This definition includes some beliefs that aren’t necessarily thought of as traditional religious views, such as atheism or religious beliefs held by an individual that aren’t shared by many other people, if any at all. However, this definition does not include personal preferences or any social, political, or economic philosophies. EEOC guidance explains that because the definition of religion is broad and protects beliefs, practices, and observances with which the employer may be unfamiliar, the employer should ordinarily assume that an employee’s request for religious accommodation is based on a sincerely held religious belief. If, however, an employee requests a religious accommodation, and the employer has an objective basis for questioning the religious nature or the sincerity of a particular belief, practice, or observance, the employer would be justified in requesting additional supporting information.

If an employee claims an exemption for a sincerely held religious belief, the employer must go through an interactive process under Title VII that is very similar to the interactive process under the ADA. That is, the employer and employee should communicate to determine whether a reasonable accommodation exists that does not pose an undue hardship on the employer. However, under Title VII’s “de minimis” standard, an employer may show that an accommodation would cause an undue hardship under Title VII by demonstrating that the accommodation would incur anything more than a trivial cost to the employer. This is a far lower standard than the ADA’s “significant difficulty or expense” standard.

As with employees seeking an exemption for a disability under the ADA, if there is no reasonable accommodation possible, the employer may exclude the unvaccinated employee from the workplace. However, the employer may not automatically terminate the employee without determining whether any other federal, state, and local laws would prohibit termination.

More information about reasonable accommodations under Title VII and the ADA may be found here.