3 Critical Questions You Need to Ask Before Testing Employees for COVID-19

Some employers are scrambling to implement COVID-19 testing or screening procedures as they reopen. These tips can help organizations avoid putting themselves at legal risk in the process.
By: | July 3, 2020

As more state and local governments give businesses the green light to reopen, employers are exploring all available options for keeping coronavirus out of their facilities. Safe and reliable testing and screening procedures will play a key role in those efforts.


“Many United States businesses are finding themselves in a bit of do-it-yourself role when it comes to public health and the COVID-19 response,” said Cecily Barclay during “COVID-19 Testing in the Workplace: What You Need to Know Before Testing Begins,” a cross-practice webinar presented by law firm Perkins Coie.

“But this is a potentially positive and significant role as businesses are perhaps best suited to catch the disease early, in the very environments in which it is otherwise most likely to spread,” said Barclay, partner in Perkins Coie’s San Francisco office.

With tests costing around $100 each and often a waiting period up to 3 days, daily testing isn’t feasible for most operations. But weekly testing is something that many employers are considering. Companies such as Tyson Foods and Ford Motor Company have publicly discussed the details of their testing programs.

A testing program that is effective without exposing the organization to unintended risk must involve a cross-functional approach involving risk management, safety, HR, facilities and legal departments working collaboratively. Here are three key questions each organization must address.

1) What are the land use, real estate and leasing issues you might face in developing and operating an onsite testing facility?

Organizations must assess their available spaces and consider first what their goals are, such as testing alone or testing plus screening. The key is to ensure that these procedures can be completed before a worker interacts with other workers.

For the sake of efficiency, cleanliness and the ability to retain a sense of “normalcy,” many experts recommended using facilities that are onsite, but outside the usual workspaces, either indoors or outside.

If an indoor site is available and appropriate for the purpose, the primary concerns would involve whether leasing contract restrictions that might apply.

“If you are in a landlord-tenant relationship, the main message here is to review your lease, review your lease and review your lease,” Barclay said.

However, as for any planning or regulatory issues, indoor onsite testing would be seen on a par with a flu shot program, assuming the testing does not involve on-site lab work or diagnoses.

Some organization are opting for outdoor testing and/or screening, utilizing outdoor canopies or well ventilated tent enclosures.

“Once you are venturing outside, there are really three areas of consideration for local agencies,” said Barclay. “Look at the individual planning, building and fire department regulations that apply to the area in which you’re going to be locating the facility. There are great variations across the cities, counties and states in which you may be considering locating one of your testing facilities.”

Barclay said that as with indoors, testing and screening would be considered incidental to the business and unlikely to run afoul of zoning regulations. Building and fire codes, however, may require a dedicated ingress/egress plan or dictate what kind of set-backs may be required from nearby streets or buildings.

The regulations will vary depending greatly upon location, with organizations located in urban areas potentially facing added hoops to jump through, such as conditional permitting.

In areas that are highly developed, the planning code requirements for locating one of these facilities outside a building may be lengthy and confusing and really didn’t contemplate the type of use that a testing facility would involve.

2) What are the labor and employment concerns that will arise as you begin to test your workers?

Employers are understandably concerned about whether requiring medical testing and screening is allowed by law.

The short answer, said Perkins Coie’s Ann Marie Painter, is yes.

Both testing and screening are considered medical exams under the ADA, which may be permissible under certain circumstances – one of which is whether the employee will pose a direct threat to others due to a medical condition.

Fortunately, said Painter, partner in the law firm’s Dallas office, the EEOC has been very direct in clarifying that the presence of COVID-19 in the workplace absolutely satisfies the direct threat test.

“The EEOC gives some additional guidance that employers should make sure that whatever tests are administered are accurate and reliable, and gives suggestions about where to find [information] about safe and accurate testing.

“But it’s important to note that the accurate testing that’s out there only reveals if a virus is present, and that a negative test doesn’t mean that the employee will not acquire the virus later. So it’s very important to keep in mind that the actual testing — if you choose to go this direction — is only one route that you will want to pursue to make sure that your workplace is safe for your employees.”

For employers that opt use medical screening or questionnaires, the EEOC has also provided some clarity.

The EEOC has said that in a severe influenza pandemic, an employer can ask employees to identify themselves as potentially being at higher risk of contracting the virus.

“In addition,” Painter said “you’re also able to ask employees about symptoms that they may be experiencing that are related to COVID-19 There’s a fair amount of latitude that employers can apply when making these inquiries.”

Painter stressed that COVID-19 testing is not required: “Currently, we’re unaware of any state or regulation that actually mandates testing by employers,” Painter said.

Many employers have been looking to OSHA’s general duty clause to understand what their obligations are, she said, as the clause requires employers to provide a workplace that is free from recognized hazards that are causing or could cause death or serious physical harm.

Thus far, however, OSHA has not entered or applied any emergency standard or order related to COVID-19, and does not require testing for the virus.

Painter said that many employers have been asking if they’re required to report a positive COVID-19 test on their OSHA 300 log. And the answer is yes, in certain cases. Reporting may be required if there is a lab-confirmed case of COVID-19, if the employee is infected as a result of performing their work-related duties. For some employers, that may be a gray area.

“It’s very possible that employees have contracted the virus in some other environment other than the workplace. And it will require some investigation to determine if in fact a positive test is work related and needs to be reported on your OSHA log.


“This would be a case where you may have to conduct some contact tracing and also you may want to consult with counsel before you decide that this has to be reported,” she said.

The ADA requires all medical information of employees is kept separate from other personnel related information and is kept confidential. While that sounds easy, but it may be a little bit more challenging to ensure that this information is, in fact, kept and maintained on a confidential basis, because there may be multiple points at which the data is being collected and gathered.

“It will require some training on the part of the employer to ensure that this kind of information, if you’re gathering it, is being kept properly,” Painter said.

Lastly, employers who do opt for testing or screening will need to ensure they’re in compliance with all wage and hour regulations. For hourly workers who are being required to submit to testing before entering the workplace, employers must assess the amount of time the procedures are going to take.

“If the time is not de minimus, it will need to be recorded and counted as compensable time for those employees. This is going to be a particularly difficult issue to work through — it’s going to be a big one.”

3) What privacy and data security issues will come up as a result of the information that you will collect?

Physical privacy sounds straightforward to maintain, but issues can arise. With new tests expected that can show the presence of antibodies in as little as 15 minutes, employers must exercise caution in how they deliver results.

The same applies if you have an employee who does test positive for the virus and is sent home. While it might be a necessity to take additional sanitizing measures in the person’s workstation, it could be argued that doing so in full view of coworkers amounts to a public disclosure of a positive test result.

Data security should also be top of mind for employers who test or screen.

With the proliferation of various testing and screening methods and types of data being collected, employers must be certain that the data they collect remains private.

Where one manufacturer might choose to test every employee weekly, others might opt for remote at home testing or mail-in health screening questionnaires. Some grocery stores have set up on-site antibody testing, and Massachusetts has launched a mobile testing program geared toward long-term care facilities. Communication through mobile apps and other health technology is becoming part of the equation.

“Notwithstanding the fact that we are in a pandemic, there is still a fair amount of attention being focused by regulators on privacy and data security with respect to this data,” said Dominique Shelton Leipzig, partner in Perkins Coie’s Los Angeles office.

Because most employers will need to utilize one or more outside vendors for screening, vendor management is a top concern. In the event of a breach, said Shelton Leipzig, regulators will often look to see whether an appropriate vendor management plan was in place beforehand.

In particular, she said, it’s important that companies who work with testing or screening vendors know:

  • Who in the vendor’s organization has the lead privacy and data security issues?
  • Is the data that they are collecting being inventoried and is there a proper understanding of data flows and where the data will be stored?
  • Has the vendor has conducted a legal privacy and data security risk assessment?
  • Is the vendor is going to be using a cloud environment or sub-vendors that will assist with the management of the of the tests?
  • Have those vendors have taken steps to mitigate any other specific risks associated with processing sensitive health data?
  • Does the vendor have privacy and data security protocols in place to protect the data?

There are about 134 different data protection laws around the globe, she said, and while many of them on focused on consumer privacy, some will also apply to the collection of employee information.

The California Consumer Privacy Act, for example, can apply to employee data to a certain degree. That entitles anyone covered under the Act to know what specific data is being collected, the purpose of the collection and if the data was shared with any third parties.

“So you want to ensure that you’re working with your HR teams and others to ensure that there is a personnel privacy policy that exists, because this portion of the statute does apply to employee data,” said Shelton Leipzig.


The CCCP also provides a right to access to all data collected, delivered in a portable format, and a right of deletion. These are all considerations that employers affected by the Act will need to consider.

Employers beyond the scope of California’s law should be looking at these issues as well, she said, because there are currently 17 other states with laws similar to California’s under consideration.

The most important privacy and security questions for your team to answer before you begin a testing program, according to Shelton Leipzig, are “How are we going to make sure that the testing and the data collection process is private and secure?” “Are our privacy notices up to date?” and “What vendors are we using and have they been vetted for their security protocols?”

Vetting vendors may sound onerous, Shelton Leipzig said, but it need not be.

“You can get certifications from vendors, like ISO 27001 certifications or others that are proxies, to give you a sense that there’s been a proper security protocols in place,” she said. &

Michelle Kerr is Workers' Compensation Editor for Risk & Insurance, and chair of the annual National Comp conference. She can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

Risk Scenario

The Betrayal of Elizabeth

In this Risk Scenario, Risk & Insurance explores what might happen in the event a telemedicine or similar home health visit violates a patient's privacy. What consequences await when a young girl's tele visit goes viral?
By: | October 12, 2020
Risk Scenarios are created by Risk & Insurance editors along with leading industry partners. The hypothetical, yet realistic stories, showcase emerging risks that can result in significant losses if not properly addressed.

Disclaimer: The events depicted in this scenario are fictitious. Any similarity to any corporation or person, living or dead, is merely coincidental.


Elizabeth Cunningham seemingly had it all. The daughter of two well-established professionals — her father was a personal injury attorney, her mother, also an attorney, had her own estate planning practice — she grew up in a house in Maryland horse country with lots of love and the financial security that can iron out at least some of life’s problems.

Tall, good-looking and talented, Elizabeth was moving through her junior year at the University of Pennsylvania in seemingly good order; check that, very good order, by all appearances.

Her pre-med grades were outstanding. Despite the heavy load of her course work, she’d even managed to place in the Penn Relays in the mile, in the spring of her sophomore season, in May of 2019.

But the winter of 2019/2020 brought challenges, challenges that festered below the surface, known only to her and a couple of close friends.

First came betrayal at the hands of her boyfriend, Tom, right around Thanksgiving. She saw a message pop up on his phone from Rebecca, a young woman she thought was their friend. As it turned out, Rebecca and Tom had been intimate together, and both seemed game to do it again.

Reeling, her holiday mood shattered and her relationship with Tom fractured, Elizabeth was beset by deep feelings of anxiety. As the winter gray became more dense and forbidding, the anxiety grew.

Fed up, she broke up with Tom just after Christmas. What looked like a promising start to 2020 now didn’t feel as joyous.

Right around the end of the year, she plucked a copy of her father’s New York Times from the table in his study. A budding physician, her eyes were drawn to a piece about an outbreak of a highly contagious virus in Wuhan, China.

“Sounds dreadful,” she said to herself.

Within three months, anxiety gnawed at Elizabeth daily as she sat cloistered in her family’s house in Bel Air, Maryland.

It didn’t help matters that her brother, Billy, a high school senior and a constant thorn in her side, was cloistered with her.

She felt like she was suffocating.

One night in early May, feeling shutdown and unable to bring herself to tell her parents about her true condition, Elizabeth reached out to her family physician for help.

Dr. Johnson had been Elizabeth’s doctor for a number of years and, being from a small town, Elizabeth had grown up and gone to school with Dr. Johnson’s son Evan. In fact, back in high school, Evan had asked Elizabeth out once. Not interested, Elizabeth had declined Evan’s advances and did not give this a second thought.

Dr. Johnson’s practice had recently been acquired by a Virginia-based hospital system, Medwell, so when Elizabeth called the office, she was first patched through to Medwell’s receptionist/scheduling service. Within 30 minutes, an online Telehealth consult had been arranged for her to speak directly with Dr. Johnson.

Due to the pandemic, Dr. Johnson called from the office in her home. The doctor was kind. She was practiced.

“So can you tell me what’s going on?” she said.

Elizabeth took a deep breath. She tried to fight what was happening. But she could not. Tears started streaming down her face.

“It’s just… It’s just…” she managed to stammer.

The doctor waited patiently. “It’s okay,” she said. “Just take your time.”

Elizabeth took a deep breath. “It’s like I can’t manage my own mind anymore. It’s nonstop. It won’t turn off…”

More tears streamed down her face.

Patiently, with compassion, the doctor walked Elizabeth through what she might be experiencing. The doctor recommended a follow-up with Medwell’s psychology department.

“Okay,” Elizabeth said, some semblance of relief passing through her.

Unbeknownst to Dr. Johnson, her office door had not been completely closed. During the telehealth call, Evan stopped by his mother’s office to ask her a question. Before knocking he overheard Elizabeth talking and decided to listen in.


As Elizabeth was finding the courage to open up to Dr. Johnson about her psychological condition, Evan was recording her with his smartphone through a crack in the doorway.

Spurred by who knows what — his attraction to her, his irritation at being rejected, the idleness of the COVID quarantine — it really didn’t matter. Evan posted his recording of Elizabeth to his Instagram feed.

#CantManageMyMind, #CrazyGirl, #HelpMeDoctorImBeautiful is just some of what followed.

Elizabeth and Evan were both well-liked and very well connected on social media. The posts, shares and reactions that followed Evan’s digital betrayal numbered in the hundreds. Each one of them a knife into the already troubled soul of Elizabeth Cunningham.

By noon of the following day, her well-connected father unleashed the dogs of war.

Rand Davis, the risk manager for the Medwell Health System, a 15-hospital health care company based in Alexandria, Virginia was just finishing lunch when he got a call from the company’s general counsel, Emily Vittorio.

“Yes?” Rand said. He and Emily were accustomed to being quick and blunt with each other. They didn’t have time for much else.

“I just picked up a notice of intent to sue from a personal injury attorney in Bel Air, Maryland. It seems his daughter was in a teleconference with one of our docs. She was experiencing anxiety, the daughter that is. The doctor’s son recorded the call and posted it to social media.”

“Great. Thanks, kid,” Rand said.

“His attorneys want to initiate a discovery dialogue on Monday,” Emily said.

It was Thursday. Rand’s dreams of slipping onto his fishing boat over the weekend evaporated, just like that. He closed his eyes and tilted his face up to the heavens.

Wasn’t it enough that he and the other members of the C-suite fought tooth and nail to keep thousands of people safe and treat them during the COVID-crisis?

He’d watched the explosion in the use of telemedicine with a mixture of awe and alarm. On the one hand, they were saving lives. On the other hand, they were opening themselves to exposures under the Health Insurance Portability and Accountability Act. He just knew it.

He and his colleagues tried to do the right thing. But what they were doing, overwhelmed as they were, was simply not enough.


Within the space of two weeks, the torture suffered by Elizabeth Cunningham grew into a class action against Medwell.

In addition to the violation of her privacy, the investigation by Mr. Cunningham’s attorneys revealed the following:

Medwell’s telemedicine component, as needed and well-intended as it was, lacked a viable informed consent protocol.

The consultation with Elizabeth, and as it turned out, hundreds of additional patients in Maryland, Pennsylvania and West Virginia, violated telemedicine regulations in all three states.

Numerous practitioners in the system took part in teleconferences with patients in states in which they were not credentialed to provide that service.

Even if Evan hadn’t cracked open Dr. Johnson’s door and surreptitiously recorded her conversation with Elizabeth, the Medwell telehealth system was found to be insecure — yet another violation of HIPAA.

The amount sought in the class action was $100 million. In an era of social inflation, with jury awards that were once unthinkable becoming commonplace, Medwell was standing squarely in the crosshairs of a liability jury decision that was going to devour entire towers of its insurance program.

Adding another layer of certain pain to the equation was that the case would be heard in Baltimore, a jurisdiction where plaintiffs’ attorneys tended to dance out of courtrooms with millions in their pockets.

That fall, Rand sat with his broker on a call with a specialty insurer, talking about renewals of the group’s general liability, cyber and professional liability programs.

“Yeah, we were kind of hoping to keep the increases on all three at less than 25%,” the broker said breezily.

There was a long silence from the underwriters at the other end of the phone.

“To be honest, we’re borderline about being able to offer you any cover at all,” one of the lead underwriters said.

Rand just sat silently and waited for another shoe to drop.

“Well, what can you do?” the broker said, with hope draining from his voice.

The conversation that followed would propel Rand and his broker on the difficult, next to impossible path of trying to find coverage, with general liability underwriters in full retreat, professional liability underwriters looking for double digit increases and cyber underwriters asking very pointed questions about the health system’s risk management.

Elizabeth, a strong young woman with a good support network, would eventually recover from the damage done to her.

Medwell’s relationships with the insurance markets looked like it almost never would. &


Risk & Insurance® partnered with Allied World to produce this scenario. Below are Allied World’s recommendations on how to prevent the losses presented in the scenario. This perspective is not an editorial opinion of Risk & Insurance.®.

The use of telehealth has exponentially accelerated with the advent of COVID-19. Few health care providers were prepared for this shift. Health care organizations should confirm that Telehealth coverage is included in their Medical Professional, General Liability and Cyber policies, and to what extent. Concerns around Telehealth focus on HIPAA compliance and the internal policies in place to meet the federal and state standards and best practices for privacy and quality care. As states open businesses and the crisis abates, will pre-COVID-19 telehealth policies and regulations once again be enforced?

Risk Management Considerations:

The same ethical and standard of care issues around caring for patients face-to-face in an office apply in telehealth settings:

  • maintain a strong patient-physician relationship;
  • protect patient privacy; and
  • seek the best possible outcome.

Telehealth can create challenges around “informed consent.” It is critical to inform patients of the potential benefits and risks of telehealth (including privacy and security), ensure the use of HIPAA compliant platforms and make sure there is a good level of understanding of the scope of telehealth. Providers must be aware of the regulatory and licensure requirements in the state where the patient is located, as well as those of the state in which they are licensed.

A professional and private environment should be maintained for patient privacy and confidentiality. Best practices must be in place and followed. Medical professionals who engage in telehealth should be fully trained in operating the technology. Patients must also be instructed in its use and provided instructions on what to do if there are technical difficulties.

This case study is for illustrative purposes only and is not intended to be a summary of, and does not in any way vary, the actual coverage available to a policyholder under any insurance policy. Actual coverage for specific claims will be determined by the actual policy language and will be based on the specific facts and circumstances of the claim. Consult your insurance advisors or legal counsel for guidance on your organization’s policies and coverage matters and other issues specific to your organization.

This information is provided as a general overview for agents and brokers. Coverage will be underwritten by an insurance subsidiary of Allied World Assurance Company Holdings, Ltd, a Fairfax company (“Allied World”). Such subsidiaries currently carry an A.M. Best rating of “A” (Excellent), a Moody’s rating of “A3” (Good) and a Standard & Poor’s rating of “A-” (Strong), as applicable. Coverage is offered only through licensed agents and brokers. Actual coverage may vary and is subject to policy language as issued. Coverage may not be available in all jurisdictions. Risk management services are provided or arranged through AWAC Services Company, a member company of Allied World. © 2020 Allied World Assurance Company Holdings, Ltd. All rights reserved.

Dan Reynolds is editor-in-chief of Risk & Insurance. He can be reached at [email protected]