As states begin to gradually reopen their economies, employers are facing questions about when and how to safely bring employees back to work. Although scientists and health care professionals continue to study the spread of COVID-19 to learn more about its presentation, transmission and immunity, the Centers for Disease Control and Prevention (CDC) notes that “a significant portion of individuals with [COVID-19] lack symptoms (“asymptomatic”) and that even those who eventually develop symptoms (“pre-symptomatic”) can transmit the virus to others before showing symptoms.”

While certain preventive measures like wearing a face covering and maintaining six feet of social distancing can prevent or slow COVID-19 transmission, many employers plan to use COVID-19 testing to ensure that employees who are physically present in the workspace are healthy. Absent a vaccine or widespread immunity, pre-work COVID-19 screening can help ensure that asymptomatic carriers of the virus do not jeopardize workplace safety.

Some employers are choosing to subsidize COVID-19 testing for employees as a pre-return screening precaution, raising legal questions about how and to whom the results may be disclosed. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes standards for the protection of individually identifiable health information, and typically prevents health care providers from disclosing sensitive health data to employers. However, the HIPAA Privacy Rule recognizes the need for health care providers to provide employers with access to health information in certain situations.

Below we have set out scenarios when providers are legally permitted to disclose COVID-19 testing data to employers directly.

1. Patient gives consent. At the time of service, health care providers can obtain written consent from the patient authorizing the release of COVID-19 testing results directly to his or her employer. Unlike other treatment situations, a health care provider may even condition the performance of an employee test on the employee’s provision of an authorization (i.e., the provider may refuse to perform the exam unless the patient executes a valid authorization). See 45 CFR § 164.508(b)(4)(iii).
2. Testing falls under HIPAA’s workplace medical surveillance exception. Health care providers may disclose health screening results directly to an individual’s employer when the service was provided at the employer’s request, and the employer needs the information to comply with legal obligations related to workplace health monitoring. The health care provider must provide the individual with written notice that the information will be disclosed to his employer at the time of the service and must limit the disclosure to the findings regarding the medical surveillance at issue. See 45 CFR 164.512(b)(1)(v).
3. Testing paid for by employer. If the employer subsidizes COVID-19 testing for its employees, the employer may be entitled to information regarding the specific employees the provider tested and when the testing was conducted. However, this would not entitle the employer to the results of the testing.

Providers will also need to take into account applicable state privacy laws to determine whether a disclosure discussed above is permissible. If a state law is more stringent than HIPAA, then the state law will apply. Given that these disclosures are situation-specific, and state law may override a permitted disclosure under HIPAA, we recommend that providers seek legal advice before making such disclosures.

Lastly, although this guidance is aimed at providers, there will be a multitude of issues employers face when requesting and handling testing results.