Now that states have begun to lift stay-at-home orders and practices are reopening for more routine and elective services, privacy officials may need to pivot again to help covered entities (CEs) institute precautions, such as screening, to keep both workers and patients at low risk of exposure to COVID-19—while maintaining privacy and adherence to laws, regulations and new edicts on local levels. Business associates will also have to implement policies and procedures for reopening, and for compliance with HIPAA and their business associate agreements.
The issues are multiplied for hospitals, doctors and other facilities that are in the dual role of employer/provider. They must comply with different rules that address worker confidentiality, such as the Americans With Disabilities Act (ADA), enforced by the Equal Employment Opportunity Commission (EEOC).
In addition to puzzling out legalities of COVID-19 screening, including when and how data should be kept, HIPAA officials have to act to thwart—and catch—the sometimes irresistible urge among employees to snoop into patient records, no doubt heightened due to the transmissibility of the COVID-19 virus.
The situation could seem like “a huge mess,” attorney Joseph Lazzarotti, with Jackson Lewis PC in Berkeley Heights, New Jersey, told RMC’s sister publication, Report on Patient Privacy.
Match Safeguards to Actual Risks
Perhaps the preeminent issue CEs are facing as they try to get back to normal is screening both workers and patients for COVID-19 infection or exposure, and what is allowed and what isn’t. Further, they need to know if they are creating protected health information (PHI) or not, and how the information must be stored.
An additional consideration is how much information the employer/CE might be able to share with workers about those who may have tested positive.
The Centers for Disease Control and Prevention (CDC) has been the lead agency in issuing guidelines, both for screening patients in health care settings and establishing protocols for when workers who test positive or are suspected of having COVID-19 should return to work.[1]
For example, the CDC points out that “employers are responsible for providing a safe and healthy workplace” and should create a plan to ensure this is the case. Among the activities to consider is the conduct of “daily in-person or virtual health checks (e.g., symptoms and/or temperature screening) of employees before they enter the work site.”
