The guiding principle for employers to follow when asking or talking about individual employees’ health concerns is “data minimization.” In other words, employers should collect and share employee health information only to the extent necessary to protect the workforce from COVID-19 exposure and should keep those records confidential.

First, employers should consider directing COVID-19 related inquiries to only those employees who report feeling ill, and when doing so, limiting the inquiry to whether they are experiencing COVID-19 symptoms, including fever, chills, cough, shortness of breath, or sore throat, whether, in the past 14 days, they have either been in close contact with a person confirmed to have COVID-19, or whether, in the past 14 days, they have traveled from an area with sustained community transmission. Second, as noted in the EEOC’s pandemic guidance, recently updated on March 19, 2020, employers are not permitted to ask disability- or impairment-related questions, except in limited circumstances. Consequently, they may not ask whether any of their employees suffer from medical conditions that increase the likelihood of infection. Third, employers should not seek information about or based on national origin or race, and they should instead ask questions in a uniform, objective, and non-discriminatory manner.

If an employer discovers through inquiry that an employee is experiencing COVID-19 symptoms or is confirmed to have the illness, it should not disseminate the person’s name or other personally identifiable information to co-employees. This is because employers must maintain the confidentiality of all employee medical information obtained through disability-related inquiries or medical examinations, under the ADA. State law may also impose separate privacy obligations. In addition to privacy concerns, releasing personally identifiable information risks subjecting that employee to negative stigma from co-workers.

However, an employer does have an obligation to provide a safe workplace, and it cannot ignore the possibility that the individual above (if confirmed to have COVID-19) has exposed other employees to COVID-19 as well. Accordingly, the employer should do the following:

1. Inform employees that a co-worker is confirmed to have contracted COVID-19 in the workplace, while maintaining the sick employee’s anonymity/confidentiality in adherence with ADA confidentiality standards;
2. Inform employees of the steps that the employer is taking to prevent new exposures within the workplace;
3. Reiterate the importance of employees’ self-reporting and self-quarantine if they begin to experience COVID-19 symptoms; and
4. Refer employees to accurate information on the virus, including links to CDC resources, and to designated employee contacts whom they can reach out to with questions, concerns, and self-reports.

In order to investigate whether other exposures have occurred in the workplace, employers should interview the sick individual to identify close contacts (as defined in the CDC risk assessment framework) in the past 14 days. Consider interviewing any identified employees to inform them of their risk of exposure to COVID-19 and to determine whether they are experiencing any symptoms.

Employees who are experiencing symptoms or employees who have had close contact with the infected coworker should not be allowed come into work. Depending on the number of contacts between symptomatic employees and co-workers, an employer may consider temporarily closing a location to prevent the spread of infections.

However, in the absence of symptoms or close contact with an infected coworker, the decision to remove particular individuals from the workplace following a potential exposure may not be based on protected risk factors which increase susceptibility to COVID-19, such as age or disability, if similarly situated employees without protected characteristics are not also being removed. While OSHA guidance recommends that protected individual risk factors be taken into account in employers’ infection response plans, they should not be taken into account in such a way that protected individuals are treated differently than their co-workers.

Companies should keep abreast of any new guidance that authorities and regulators release on employers’ collection and sharing of employee data and update their own rules and procedures accordingly.