Practical Advice for Employers Responding to COVID-19 Contact Tracers

In mid-April 2020, which in the age of COVID-19 feels like eons ago, President Trump announced his Opening Up America Again plan, designed to restart the U.S. economy by encouraging state and local governments to lift stay-at-home restrictions put in place to slow the spread of COVID-19. And many state and local governments followed the President’s lead, relaxing, often in stages, directives that had temporarily shuttered non-essential businesses.

But now, several weeks into reopening, many employers, especially those that have brought a substantial number of employees back to the workplace, are experiencing a steady stream of confirmed positive COVID-19 cases in their workforces. And the same employers are learning, particularly over the past couple of weeks, that state and local health authorities are rapidly ramping up efforts to track down those testing positive for COVID-19 to implement contact tracing and prevent further infection.

When contact tracers call, here are a few things employers should keep in mind:

  1. Contact tracers work for public health authorities, not law enforcement.

Contact tracing is an established disease-control method used to stop the spread of infectious diseases by identifying, testing, and isolating those who are sick. Contact tracers interview those who are confirmed to have COVID-19, determining those people who have been in close contact with the positive individual while the individual may have been infectious. Potentially exposed individuals are, in turn, advised of the risk of exposure and encouraged to respond appropriately.

In most cases, contact tracers start the tracing process with the individual testing positive, but tracers are trained to utilize creative investigatory methods to track down the information that they need. Because of the substantial risk posed by COVID-19, and dire need to contain the virus, employers are receiving calls from contact tracers attempting to track down employees who have tested positive for COVID-19 and those with whom the positive employee may have had contact.

Contract tracers work for public health authorities, and although these authorities often are vested with certain regulatory authority (the power to impose quarantine orders, for example), they are not law enforcement agencies. Despite this, employers are reporting being contacted by contact tracers who are aggressive and, in some instances, suggest that their authority is more substantial than it actually is. Employers should not be rattled by such tactics—in most cases, information about the authority of contact tracers can be found on the website of the public health authority that employs the contact tracer.

  1. Cooperation with contact tracers is typically voluntary.

Although contact tracers may suggest otherwise, cooperation with a public health authority’s contact tracing effort is almost always voluntary. This doesn’t mean that refusal to cooperate with tracing efforts will dissuade the tracer assigned to the case—tracers are trained to use persistence and persuasion to obtain information necessary to slow the spread of infectious disease. But at the end of the day, neither public health authorities nor the contact tracers they employ have the power to force an employer to cooperate with tracing efforts. Likewise, and though employers should confirm under applicable state and local law, employers generally have no legal obligation to report to public health authorities any information about any employee who tests positive for COVID-19.

  1. Employers that want to cooperate with contract tracing should remember that tracing efforts may implicate employee privacy concerns.

Even though employers generally have no obligation to cooperate with contract tracing efforts, many recognize the importance of contact tracing and want to support tracing efforts to the extent possible. These employers should, however, keep in mind that information about an employee’s COVID-19 test result is confidential medical information and that disclosing such information, even to public health authorities, implicates employee privacy interests.

Before an employer discloses any information about an employee’s COVID-19 test result to a contact tracer, the employer should obtain the employee’s consent, if possible, memorialized in a writing. And even where consent is obtained, the employer should disclose only that information strictly necessary to aid contact tracing efforts—in most cases, this will be only an employee’s name and contact information. The positive employee, after all, is in most cases the best source of information necessary for contact tracing. Anecdotally, our clients have generally found that employees are willing to provide consent for employer cooperation with contact tracing efforts.

Some of our clients have raised concern that cooperation with contact tracing efforts could violate the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule. But in most cases, employee medical information disclosed to an employer is not covered by HIPAA because the employer is not a health care provider or business associate as those terms are defined in HIPAA. And even if this were not the case, the U.S. Department of Health and Human Services’ Office of Civil Rights recently announced that it will not impose penalties for violations of HIPAA’s Privacy Rule against health care providers or their business associates for disclosures made for public health and health oversight activities during the COVID-19 pandemic.

The Bottom Line for Employers

While we cannot predict the future development of the COVID-19 pandemic, we strongly suspect that, in the coming weeks and possibly months, employers will face a significant uptick in positive COVID-19 cases among employees. And as state and local governments ramp up efforts to slow the spread of the virus, we also anticipate increased contact tracing efforts. Employers will almost certainly be contacted by public health authorities with increasing frequency in connection with these efforts. Employers should not be alarmed by these contacts, but should instead develop a protocol for responding to requests for information that takes into account and balances the public health interest at stake with employee privacy rights.