Strategic HR Wheel of HR highlighting Health, Safety & Security

How Can I Protect Employee Privacy During COVID-19?

HR Question:

It seems like everyone is talking about the coronavirus – particularly who’s got it and who doesn’t.  As our company’s HR Manager, how can I protect employee privacy concerns during COVID-19?

HR Answer:

Protecting employee privacy during COVID-19 has become a challenge given the rapid spread of information (and disinformation) in this pandemic. The rumor mill may seem like it’s running rampant with the general population talking about concerns before managers or HR can get involved. Part of the barrier that many HR teams and managers are running into is that the Americans with Disabilities Act (ADA) prohibits an employer from inquiring about an employee’s health condition. This means that HR and managers need to approach potential COVID-19 situations with extreme caution. The Society for Human Resources Management (SHRM) has provided helpful guidance on this and many other FAQ’s related to the coronavirus.

Keep It Confidential

While an employer is not a covered entity under HIPAA, it’s important to remember that any health or medical information needs to be held in privacy.  If someone brings symptoms to a manager’s attention, that employee should be referred to Human Resources.  Managers should refrain from asking specifics like “what are your symptoms,” “have you been tested,” “when did you go to the doctor,” etc.  While the impulse may be to ask further medical questions, medical information should be handled by HR, just as they would any FMLA or ADA claim. An employee may bring something to their manager’s attention, but any information the manager receives should be on a need-to-know basis (e.g., will the employee miss work, any restrictions, etc.)

From an HR perspective, what should you do when an employee makes it known that they have been diagnosed, have symptoms as identified by the CDC, or have been exposed to COVID-19? It’s a tricky situation.

Initial Response

First and foremost, express sympathy and support. The employee may be just as scared, if not more so, than the rest of the team. Continue to focus on the facts, such as asking the employee who they may have come in contact with in the past 14 days. Keep in mind, there are still privacy concerns.

Stop the Spread

Secondly, the employee needs to take action to protect those they interact with often. It’s imperative that the employee remain away from the workplace until they have been symptom-free for 72 hours and at least 7 days have passed since the symptoms first appeared. Additionally, should testing be available in the area, two negative test results are also required. For more information, see the CDC guidance on discontinuing isolation for those who have been infected.

Purposeful & Planned Communication Approach

Thirdly, consider any communication that needs to be published – weigh who needs to know and what should be shared.  Those the employee may have come in contact with need to know they may have been exposed.  The answer to who needs to know will also depend on the size of your organization and proximity in the work environment.  If you are a small company where everyone works in an open space, you may need to communicate with the whole team.  If the employee in question works in a department at the other end of the building, with minimal interaction with other departments, that communication can be narrower in focus.

Given privacy concerns around COVID-19 (or any health-related information), it is not appropriate to disclose the name of the employee.  The message should be along the lines of, “The company has been made aware that an employee either has symptoms of, has been exposed to, or has tested positive for COVID-19.  We wanted to make you aware of this so you can take appropriate steps for your own health and safety.”

If you are made aware that employees are talking about someone’s medical condition (even if it’s their own), a gentle reminder of privacy would be appropriate.

In these difficult times, it’s essential to find the right balance of empathy and sharing information without causing panic. Approaching privacy concerns around COVID-19 with the same tact and confidentiality one would approach an FMLA or ADA concern is the best course of action. At the same time, you can be a steady and calm resource for those who need it.


During these uncertain times, you may need extra resources to help you navigate your business through the challenges you are facing. Contact us – we’re here to help!