Privacy rules can interfere with virus contact tracing

Privacy regulations that ban employers from identifying workers who test positive for COVID-19 might be standing in the way of effective contact tracing, especially at sites where workers can't consistently distance from each other or get timely access to testing, representatives of farmworkers say.

Their concerns highlight a tension that often comes up in conversations about contact tracing in the workplace, which exists between public health efforts to slow the spread of the coronavirus on the one hand, and employee privacy rights on the other.

The contact tracing procedures followed by county public health departments aren't always able to move quickly enough to slow the spread of the virus once an employer reports an employee is infected, especially since cases started surging in California in recent weeks, said Ed Kissam, the trustee of a charity that supports farmworkers mainly in the San Joaquin Valley. The longer it takes county health officials to contact other workers who may have been exposed to the infected employee, the higher the possibility that those exposed workers are unknowingly spreading the virus to others as they continue to work and fail to self-isolate, Kissam explained.

Kissam has been advocating for agricultural employers to immediately test all their workers every time an employee tests positive for COVID-19, but the spread of the virus could also potentially be slowed if employers identified to their workers which employee has been infected so they can take action themselves, he argued. "If I knew it was my friend who was COVID-19 positive instead of someone on the crew, I could say, 'He kindly shared his lunch with me, so maybe that's problematic,'" Kissam said. "If you know the person's name, you as a worker at least have the sort of information that's useful for you to worry about your own safety."

In addition to guidelines by the Centers for Disease Control and Prevention, a host of statutes -- including the Americans with Disabilities Act, California Fair Employment and Housing Act, California Consumer Privacy Act, Confidentiality Of Medical Information Act, and Health Insurance Portability and Accountability Act -- variously regulate the types of medical inquiries employers can make about their employees, and the types of data they can disclose and to whom, said Lindsay L. Ryan, principal at Polsinelli. "Not all employers are going to be covered under those acts but those are acts that employers need to consider," she explained.

Justine M. Phillips, a partner at Sheppard, Mullin, Richter & Hampton who specializes in cybersecurity and employment, wrote in an email Tuesday it's fair to have concerns about privacy rights impacting contact tracing efforts, particularly in the context of the public health crisis. But, Phillips warned, "If we entirely set aside the laws and rules that govern our privacy during this time, it would fundamentally change how we respect and value human rights in our nation."

Phillips noted since the pandemic started, the Equal Employment Opportunity Commission and the state Department of Fair Employment and Housing have provided guidance on how ADA and FEHA's general application are relaxed. For example, she said, government entities are permitting employers to conduct temperature checks and viral testing on employees during the pandemic, even though they are normally prohibited from doing so.

The pandemic-specific guidance does not allow employers to disclose the identities of employees who have tested positive for COVID-19, but Ryan said some contact-tracing apps address Kissam's concern that not identifying infected employees could slow the efforts. These apps "might track which employees go into certain places within an employer's facility, and might either track where that employee travels in relation to other employees," Ryan explained. "If somebody self-reports as being positive on their mobile device ... it would send some sort of notice to other employees that, based on the data that's being tracked, they have been in close contact with for the past 14 days." This notice could be sent without identifying the name of the infected employee, Ryan added.

Apps may not practical for all workforces, but Ryan said some employers instruct employees to work in designated groups and limit their exposure to colleagues in other groups. If one employee becomes infected, Ryan explained, everyone else in the group can be warned they've been exposed to the virus, without the employer having to disclose the name of the infected employee.

While employee privacy rights are designed in part to protect them from retaliation, "what's ironic is confidentiality is putting a lot of workers in fear," said Irene de Barraicua, public relations manager of Lideres Campesinas, an organization that works with female farmworkers in the state. De Barraicua said she's heard from farmworkers who are informed by their employers that there's a positive case, but don't know which of their colleagues have been exposed.

But Phillips insists a balance can be struck. "If you have an employee who tests positive in the workplace and you then tell other people who may be exposed, you can potentially open that employee up to retaliation. ... We have an obligation in California and beyond to maintain a safe and healthy work environment," Phillips said, adding other data points besides an employee's identity can be used to help reduce spread.

"We want to do contact tracing, but on balance it can be done in a way that can continue to respect employees' privacy," she said. "I don't see privacy being ... an impediment."