As states ease COVID-19 pandemic restrictions and businesses begin to reopen, employers increasingly seek to clarify their obligations to employees upon reopening. Indeed, recent enforcement memos reveal that the U.S. Department of Labor (Department of Labor) has increased its in-person inspections and have required more employers to disclose when employees are infected by COVID-19. In April of this year, the Department of Labor’s Office of Occupational Safety and Health Administration (OSHA) issued interim guidance that classified COVID-19 as a recordable illness, making it reportable to OSHA if the employee’s work environment exposed him or her to the virus.1 OSHA has since issued its “Revised Enforcement Guidance for Recording Cases of Coronavirus Disease 2019 (COVID-19)” memorandum (“OSHA Memorandum”) dated May 19, 2020, which replaces its April guidance referenced earlier.2
In the new guidance, OSHA continues to classify COVID-19 as a recordable illness, which subjects employers to its recording requirements as described below. However, an employer determining whether a COVID-19 case is “work-related” under the OSHA Memorandum may pose a risk from an employee-privacy standpoint when one considers the intimate and personal nature of the solicited disclosures from the employee. Employers must stay vigilant in that, while complying with OSHA’s new guidance, they do not violate their employees’ various privacy rights in the process.
Determining Whether a COVID-19 Case Is Work-Related
Generally, OSHA requires employers (with 10 or more employees) to record all serious work-related3 illnesses via OSHA Form 300 (Log of Work-Related Injuries and Illnesses), Form 300A (Summary of Work-Related Injuries and Illnesses), or Form 301 (Injury and Illness Incident Report). Employers must also do the following: maintain records of work-related injuries or illnesses for five years; report any worker fatality within eight hours; and report any hospitalization of a worker within 24 hours. Each year, from February through April, OSHA requires employers to post a summary of the injuries and illnesses recorded the previous year at the workplace. Also, employers must provide copies of the records to current and former employees, or their representatives, upon request. Failure to meet these requirements results in significant monetary fines (ranging from $13,260 to $132,598 per violation depending on severity of offense).
The OSHA Memorandum requires employers to use OSHA Form 300 when recording work-related COVID-19 illnesses and is currently in effect until further notice. Moreover, OSHA classifies COVID-19 as a “privacy concern” case, which means that employees can request that their name be excluded from an employer’s Form 300 log submission and disclosure. Failure to comply with an employee’s request under 29 C.F.R. § 1904.29(b)(10) can result in penalties as articulated under Section 17(a) of the Occupational Safety and Health Act of 1970.
To trigger the reporting requirement, COVID-19 cases must:
To better understand OSHA’s new requirements, the compliance standard employed by OSHA’s Compliance Safety and Health Officers (CSHOs), who perform inspections, is informative. The OSHA Memorandum asks CSHOs to evaluate the following factors to assess an employer’s compliance with the guidance:
Based on the foregoing, it is important for an employer to make a reasonable and good-faith effort inquiry regarding the possible causal link between an employee’s COVID-19 infection and his or her occupational duties. Although an employer may be relieved of the obligation to record a case where it cannot reasonably make that determination, the employer should maintain adequate records of its efforts and decision-making process.
Importantly, employers should keep in mind that the guidance explicitly calls for them to respect the privacy of their employees when conducting fact-finding investigations. Given these concerns, it is essential for employers to work closely with their human resources departments to ensure that their company’s COVID-19 recordkeeping practices both comply with these new requirements and keep their employees’ privacy secure.
What This Means for an Employee’s Privacy
It is important to remember that this new guidance does not provide a waiver to an employee’s right to privacy in the workplace. As mentioned above, COVID-19 is explicitly categorized as a “privacy concern” case under OSHA’s rules. The guidance specifically advises employers, especially those running small businesses, to avoid “extensive medical inquiries,” so as to protect and respect an employee’s privacy. Additionally, due to the guidance classifying a COVID-19 case as a “privacy concern,” OSHA’s rules require employers to respect an employee’s request to not disclose his or her name on its Form 300 Log.5 Finally, when conducting their investigations, employers need to maintain their employees’ confidentiality as required by various applicable laws (e.g., the Americans with Disabilities Act, HIPAA, and state and federal laws).
Please note, this guidance is interim and subject to revision or withdrawal. Phillips Lytle urges you to regularly check the relevant regulations and guidance from regulatory bodies applicable to your business, and stands ready to assist with the appropriate compliance measures.
For more information on this topic, please contact Anna Mercado Clark at (212) 508-0466, email@example.com; Joel L. Thayer at (202) 617-2726, firstname.lastname@example.org; a member of the Coronavirus (COVID-19) Response Team; or the Phillips Lytle attorney with whom you have a relationship.