HIPAA Doesn't Prevent Employers From Sharing COVID-19 Information, Experts Say

May 29, 2020

Employees at Kem Krest in Elkhart get temperature screenings upon entering the facility. Kem Krest does collect and share aggregate virus infection numbers internally. (Justin Hicks/IPB News)

John Suher Sr. has worked at Honeywell in South Bend for 23 years and is president of the UAW union for the plant. He told the Indiana Senate Democratic Caucus in a virtual press conference workers have been having "some major issues here with the company."

One of the biggest is that workers aren’t being given even basic information about COVID-19 cases in their plant.

“That’s all we’re asking," Suher says. "Just give us a number of how many people were infected or are infected at this point. We just want a number – we don’t want names. They refuse to give us this information.”

He says Honeywell defended their stance by pointing to privacy laws in the federal Health Insurance Portability and Accountability Act, or HIPAA. We reached out to Honeywell’s corporate office to confirm this, but got no response. 

As more Hoosiers are called back to work in Indiana’s “Back on Track” plan, many people want information about whether they’re working alongside coworkers with COVID-19. Many employers are equally concerned about sharing information out of fear it could violate a federal medical privacy law commonly called HIPAA. 

Tami Earnhart, a partner at Ice Miller LLP who specializes in labor law, says it’s not just Honeywell. She gets lots of questions from employers about HIPAA even though it doesn’t apply to them – only health care providers.

“So it’s a misunderstanding that many employees and sometimes employers have,” she says.

But she says there are disability laws and Indiana state civil rights laws that could keep employers from sharing people’s names alongside medical information. They may even need to keep medical files completely separate from personnel files. In many cases it could mean that sharing the number of workers with COVID-19 is just fine, just leave out the names. 

“So employers, when they do advise the rest of the workforce that there is somebody in the workforce has COVID[-19] then they shouldn’t be using their employees name without their employees permission,” she says.

Join the conversation and sign up for the Indiana 2020 Two-Way. Text "elections" to 73224. Your comments and questions in response to our weekly text help us find the answers you need on COVID-19 and the 2020 election.

Earnhart also notes there’s a big difference between naming a specific worker who tested positive for COVID-19 and simply sharing how many people have been affected by the virus, no matter how small the company.

“That’s not protected under any of the laws we’re talking about because it’s aggregate data and that kind of data can be shared – if the employer wants to share it," Earnhart says. "They’re not obligated to share it.”

Elizabeth Gray, researcher and professor of Health Policy and Management at George Washington University, says employers use HIPAA as an excuse against sharing information because they don’t understand how it works. However what they do hear are vague horror stories of hospitals and insurance companies getting enormous penalties. 

“It’s those kinds of things that I think terrify people because those are accidents," Gray says. "No one is sitting out there on the dark web trying to sell somebody’s information, and yet here are companies or organizations that are getting fined hugely.”

Gray understands that, amid a confusing swirl of information during the pandemic, employers might err on the side of caution and try to follow strict HIPAA standards even when it doesn’t apply to them. But she warns doing that blindly could severely damage their workers’ trust.

“You might not be able to give this information to me but you’re giving me a nonsense reason for it. That make it feel like you’re making everything up and I can’t trust what you say,” she says about how employees might feel. “So [for employers], there’s much better reasons and much better theories for them to rely upon, least of which is just saying that’s not something that we disclose.”

Earnhart, the labor lawyer, says the best way for Hoosier employers and employees to know those rules is to check government websites like the CDC and Department of Labor. Resource pages from industry organizations like the Indiana Chamber of Commerce can help too. And if all that fails to answer questions, it could be a good time to consult a lawyer.

Contact Justin at jhicks@wvpe.org or follow him on Twitter at @Hicks_JustinM.