Report on Patient Privacy 21, no. 6 (June 2021)
“For the first time in the history of the United States, an employer is forcing an employee to participate in an experimental vaccine trial as a condition for continued employment.”
So begins the provocative lawsuit filed against Methodist Hospital System in Houston by 117 employees who do not want to be vaccinated against COVID-19.[1] Despite the assertion, workers are not being asked—or forced—into a study.[2] But until the case is decided, health care organizations will want to move cautiously regarding COVID-19 vaccinations, while ensuring they comply with employment as well as privacy laws—among others.
To better understand the details, RPP spoke to Joseph Lazzarotti, a principal in the Berkeley Heights, New Jersey, office of Jackson Lewis PC. Lazzarotti founded and directs its Privacy, Data and Cybersecurity Practice Group and is also a part of the firm’s Employee Benefits Practice Group.
Lazzarotti noted employers will need to pay attention to more than just HIPAA. Regulations and guidance issued by the Equal Employment Opportunity Commission (EEOC) are also in play, as can be state laws.
RPP: What positions are health care employers taking toward mandating a COVID-19 vaccine?
JL: A significant consideration for a lot of health care organizations that I’m seeing is the Food and Drug Administration (FDA) grant of emergency use authorization for the vaccines. So people are still kind of squeamish about mandating them. I suspect that, if that changes to full approval, we will see more mandate it.
RPP: Is it illegal to mandate vaccinations now?
JL: From an employment perspective, based on the EEOC’s more recent guidance, federal laws do not prevent employers from requiring employees entering the workplace to be vaccinated for COVID-19. Of course, there are exceptions. Reasonable accommodation, such as for religious objections, need to be provided. Some employers may have to work with union representatives. And, some state laws may affect the nature and scope of a mandate.
RPP: So are you advising doctors, offices or hospitals to encourage but not mandate? Or what is your approach?
JL: I think the safest course right now, if you really want to push vaccinations, is to figure out how you can provide incentives. Employers not providing or contracting with a third party to provide vaccines have some flexibility in the kinds of incentives they can provide. Some employers are including vaccinations as part of wellness programs tied to their existing group health plans. In this case, they have to observe the HIPAA and Affordable Care Act rules concerning those programs. EEOC really hasn’t spoken clearly on this with formal guidance, but you can’t offer a substantial incentive that undermines the voluntariness of agreeing to be vaccinated. You could offer a water bottle, a gift card, but you couldn’t take $50 off the employees’ monthly health premium for a year. You can’t pay their gym membership; you can’t pay for airline tickets.[3]
RPP: Do the issues change if the provider itself is vaccinating workers?
JL: Yes. Administering a vaccine requires asking prevaccination screening questions, and some of those questions may get at a person’s disability, thus triggering a disability-related inquiry. An inquiry is generally permissible for employers so long as it is job-related and consistent with business necessity. The exception to that rule is when the inquiry is part of a voluntary wellness program. But, long-standing EEOC guidance says to be voluntary, employers can neither reward nor punish employees—regardless of whether they did or didn’t answer those questions. EEOC has modified its position a little over the years, and now it is saying you can provide some incentive but it has to be limited; it has to be de minimis, nothing too substantial.
RPP: Don’t hospitals and other health care providers have similar experience with this, for example, related to either encouraging or mandating that workers get seasonal flu shots?
JL: In essence it’s a very similar kind of analysis. Of course, the flu vaccine is approved and has been around for a while. Flu shot programs also may be considered voluntary wellness programs, and without a pandemic, there is not the same motivation to incentivize vaccination. Also, employers might have offered flu shots at a health fair and decided that did not implicate employer benefit rules, but it is not clear how the Department of Labor would look at that.
RPP: Can you give examples of other incentives that would be allowed?
JL: Some employers have taken a raffle approach, where the incentive is not provided directly to the employee. The employer says, “Whoever gets the vaccine, we’ll put your name into a raffle, and at the end of this process, we’ll pick 10 names who will win a prize.” There are some questions that come up, such as whether this would implicate state gaming laws, and we don’t know how the EEOC would view this. But it’s not certain, with a raffle, that an employee will get the prize. There’s just a chance of winning, and the analysis may be the value of that chance, not the reward itself.
Another approach we have seen is looking at when a “community,” which could be the workplace or the workplace plus residents in a retirement community, as one example, reaches a desired level of vaccinations, the organization arranges a special event or some other reward for the community. Days off, paid time off, also can be offered to employees getting the vaccine. This is typically where neither the employer nor its agent is administering the vaccine to employees. By the way, there are some state laws that are requiring paid time off to get the vaccine.
Some businesses are issuing gift cards ranging from $25 to $500. Some employers have an existing system allowing workers to earn points that could be redeemed for items, etc. They could offer 1,000 points to get the vaccine, for example. But again, if the employer is considered to be making a disability-related inquiry in this process, it needs to consider the value of these rewards. Those are some of the different approaches we have seen for incentivizing vaccinations.
RPP: Where does HIPAA fit into this, or does it? Is it a HIPAA violation for a health care employer to ask employees if they are vaccinated?
JL: In general, no. Remember, when health care providers are acting as employers, HIPAA generally does not come into place, except when dealing with the company’s health plan for employees. But the EEOC’s guidance in late May[4] clarified a point of confusion about vaccination status, stating that a person’s COVID-19 vaccination status is considered confidential medical information. So while the HIPAA privacy and security rules do not apply, employers still need to treat that information like they would any other medical information covered by the Americans with Disabilities Act—separate medical file, reasonable safeguards, limited disclosure. Employers want to have some access management rules for this information, and should consider potential applicability of other federal and state laws and regulations, such as the Occupational Safety and Health Administration (OSHA) and the California Consumer Privacy Act.
RPP: But employers can ask the worker about vaccination status, correct?
JL: Yes, employers can ask. But they should avoid asking why the employee didn’t get vaccinated if the employee’s answer is no. Employers could ask whether the employee plans to get vaccinated, which may help for planning purposes, although employers may also want to remind employees not to offer other medical information.
RPP: Can the employee refuse to answer the question?
JL: Yes, employees can refuse to answer. But then the question becomes, what does the employer do in that situation? They could prohibit the employee from coming on-site, but I think employers really need to be careful how they proceed down that road. Another consideration is who is asking the question? Is it human resources? Is it the employee’s manager? Consider that a recent Centers for Medicare & Medicaid Services regulation requires long-term care facilities to educate, offer, and report on COVID-19 vaccinations for residents and staff.[5]
RPP: If vaccination status is part of a confidential medical record, can you require nonvaccinated workers to wear masks, which could then signal to everyone that they are not vaccinated?
JL: It’s an interesting question, and there is a lot to unpack here. I was at a local grocery store this weekend and encountered some neighbors we knew were vaccinated and who chose to wear masks. In the employment context, state and local mandates, union issues, landlord requirements, ability to enforce, and other issues including privacy have to be considered. A policy stating unvaccinated persons only, must, or can wear masks may raise some issues. Allowing employees to be free to wear a mask, whether they are vaccinated or not, gives a little leeway to employees, and leaves open the question of whether a masked person is or is not vaccinated.
RPP: Are there other related, emerging issues you see that are concerning?
JL: Some health care clients have proposed using their electronic medical record system to track employee COVID cases. This can quickly become problematic. This may not be an emerging issue as health care employers have for a long time needed to consider their dual roles—provider and employer—carefully. But the urgency of COVID has made it more pressing.
Collecting vaccination cards, vaccination passports, etc. is also a hot issue. Questions about whether and how best to collect this information, who can access it, how long to retain and safeguard it, and other issues are popping up. There is not a clear answer on this, but the application of OSHA rules suggests that this information is part of the employee medical record, subjecting it to a 30-year retention rule, has some organizations thinking about whether to collect vaccination cards.
One other thing is the increased use of devices and apps to help manage the continued screening, verification, data collection, etc. A thermal camera may be helpful for confirming temperatures for COVID-19 screening, but the device could be inadvertently collecting biometric information. An app used to survey the vaccination status of employees or upload vaccine confirmation could be collecting other information about employees—geolocation data, for example—or it may not be sufficiently secure.
RPP: Any other actions they should avoid?
JL: There are situations where health care employers might review employees’ patient record for an employment purpose—how many of our employees are vaccinated, etc. When employees come in for vaccinations as patients, that information is protected under HIPAA, and it should, generally, be treated like any other patient data. Providing reminders to staff not to engage in this activity can go a long way to avoid this.
RPP: Can health care organizations continue to enforce a policy that patients or visitors wear masks, regardless of vaccination status?
JL: In general, yes, although the policy needs to have exceptions, such as whether individuals have a medical condition that prevents them from wearing one. State and local laws have to be monitored, of course.
You want to be sensitive to people’s views. I know some people have strong feelings about getting vaccinated or not getting vaccinated, as well as having to wear a mask, or two for that matter. It will be interesting to see how the Texas case plays out, and I’m sure there will be other litigation. I think, for the most part, people understand how difficult this all has been, but businesses and employers cannot accommodate every employee’s wishes. Employers have to do their best to track fluid legal requirements while balancing employee relations, liability and other issues, all while remaining practical.
1 Bridges et al. v. The Methodist Hospital (Montgomery Cnty. Ct. 2021), https://bit.ly/2RtjJNi.
2 Theresa Defino, “System Stands By COVID Vaccine Mandate,” Report on Patient Privacy 21, no. 6 (June 2021).
3 Stephen Miller, “EEOC Proposes—Then Suspends—Regulations on Wellness Program Incentives,” SHRM, last updated February 16, 2021, https://bit.ly/3w0Bp1U.
4 Equal Opportunity Employment Commission, “What You Should Know About COVID-19 and the ADA, the Rehabilitation Act, and Other EEO Laws,” technical assistance questions and answers, updated May 28, 2021, https://bit.ly/3fVfdke.
5 Medicare and Medicaid Programs; COVID-19 Vaccine Requirements for Long-Term Care (LTC) Facilities and Intermediate Care Facilities for Individuals With Intellectual Disabilities (ICFs-IID) Residents, Clients, and Staff, 86 Fed. Reg. 26,306 (May 13, 2021), https://bit.ly/3vZlS2t.
[View source.]
