COVID-19 and Privacy

EEOC Says ADA Bars Employee Antibody Testing, For Now

By Myrle Croasdale

Employers can check employees’ temperatures, and they can require a COVID-19 virus test. Both as a condition for returning to work.

But what they can’t do, at least for now, is ask them to submit to a COVID antibody test.

In June, the U.S. Equal Employment Opportunity Commission (EEOC) determined that under the Americans with Disabilities Act (ADA), an antibody test was a medical examination and that employees with these antibodies did not present a direct threat to others at work.

“The ADA at this time does not allow employers to require antibody testing before allowing employees to re-enter the workplace,” the EEOC announcement said.

The ADA governs disability-related inquiries and medical exams and prohibits employers from excluding employees with a disability from the workplace for health and safety reasons unless the employee’s health poses a direct threat to others.

“An antibody test at this time does not meet the ADA’s ‘job-related and consistent with business necessity’ standard for medical examinations,” the commission stated.

The key here, some experts told Digital Privacy News, is the “direct threat” issue.

Unless an antibody test is essential to workplace safety, requiring it would be a privacy violation. Others contended that once a reliable antibody test was available, the public-health benefit outweighed an individual’s right to privacy.

‘No’ for Now

The EEOC said it was following the Centers for Disease Control and Prevention’s (CDC) interim guidelines, which recommended that antibody test results “not be used to make decisions about returning persons to the workplace.”

The CDC said its recommendation was based on two factors: the lack of evidence that the existence of COVID-19 antibodies provided immunity and concerns about the reliability of current antibody test results.

The agency did stipulate that as the data evolved, it would update its interim guidelines and recommendations accordingly. Public-health advocates saw this as a positive, keeping the CDC open to changing its stance if the science justified it.

While a COVID virus test and temperature check are considered medical exams under the ADA, according to the EEOC, they meet the direct-threat exception.

Exposure to someone with an active coronavirus infection would be a direct threat to the health and safety of others at work.

Hope for Reopening

Antibody tests were first thought to be an avenue to reopening the economy. The idea was that those immune to COVID could safely return to work and go about their lives.

“Given what is going on with the pandemic, I’m not against suspending some of that privacy.”

John Loike, Touro College and University System.

Earlier this year, some cities bought antibody tests, thinking that if enough residents tested positive, businesses and public spaces then could safely reopen, according to news reports.

But once the reliability of antibody tests was called into question, those plans were set aside.

Employer interest in antibody testing may be waning, as well.

Before the EEOC decision, Mercer, a global human-resources consultancy, surveyed employers on returning to work. Just 4% of those responding said they planned to conduct COVID antibody screenings.

Privacy vs. Greater Good

Interest may re-emerge if a reliable antibody test becomes available. If it does, an employer’s right to require a COVID antibody test might be revisited, experts said.

John Loike, a biology professor at Touro College and University System in New York and bioethics columnist for The Scientist magazine, supports this on an even broader level.

“In an ideal world, we want to have privacy and confidentiality,” Loike told Digital Privacy News. “Given what is going on with the pandemic, I’m not against suspending some of that privacy.”

He said he’d like to see broad antibody testing and the certification of individuals.

Citing the wide use of masks on the East Coast and the subsequent reduction in new infections, Loike argued that antibody certification would work in the same way.

“The idea is that no vaccine is 100% effective,” he said. “If most of the population gets tested, we can see how safe it is.

“I think we need at least 60% for herd immunity.”

Track these certifications with a cell phone app, and “you can go to the airport or grocery shopping and see how many people there have immunity,” Loike added. “I think the public will take the chance if it helps and we could get over this.”

Digital-Privacy Hodgepodge

Others are not as comfortable with temporarily waiving individual privacy rights for antibody testing.

“There’s a real need to rethink how we handle medical-information privacy.”

Carmel Shachar, Harvard Law School.

Carmel Shachar, executive director of the Petrie-Flom Center for Health Law Policy, Biotechnology and Bioethics at Harvard Law School, said antibody testing and antibody-certification apps raised serious privacy concerns.

“If we had reliable antibody testing, we might see privacy exceptions for certain industries,” she told Digital Privacy News. “People who work in nursing facilities, it’s very important for them to not be a vector of COVID transmission.

“We’d know who is immune and won’t be spreading it from room to room.

“Certainly, for very vulnerable patients, we might need to know who has immunity,” Shachar said.

An antibody-certification app raises similar privacy concerns as contact-tracing apps, she said.

The federal Health Insurance Portability and Accountability Act (HIPAA) requires health plans, health providers and third parties working for these covered entities to protect the privacy of patients’ medical data.

HIPAA protections, however, are limited to these organizations.

“There’s a real need to rethink how we handle medical-information privacy,” Shachar told Digital Privacy News. “People think HIPAA is more protective than it is.

“There’s a whole host of health data from a Fitbit that’s not going to a medical provider — and it’s not protected by HIPAA,” she added. “That information can say a lot about your health status.

“Medical information in terms of employment can be HIPAA-adjacent and also outside of HIPAA.”

Myrle Croasdale is a Minnesota writer.

Fixing the Privacy Gap for Health Data

Tracing who has had contact with someone infected with COVID-19 or who has antibodies to the virus highlights privacy gaps in U.S. law.

The federal Health Insurance Portability and Accountability Act (HIPAA) requires all those involved in a patient’s medical care to keep that information private.

However, others are not required to comply with HIPAA.

Anyone who downloads a contact-tracing app has to agree to the app developer’s terms of use. The developer or tech company is the one who decides what, if anything, remains private.

Carmel Shachar, of the Petrie-Flom Center for Health Law Policy, Biotechnology and Bioethics at Harvard Law School, said this dilemma could be fixed.

What the U.S. needs, she said, is something similar to Europe’s General Data Protection Regulation (GDPR).

She’d like to see regulations not just address what HIPAA doesn’t protect, but extend the most-relevant HIPAA obligations to these apps, for example, to prevent tech and software companies from selling or using health-related data for marketing purposes.

Even better, Shachar said, would be to protect individual privacy in all digital surveillance and contact-tracing efforts, including those operated by HIPAA-covered entities.

The federal law would be the floor, and newer regulations would build on that.

Regardless, Shachar told Digital Privacy News, it would avoid creating silos of data based on the creator and implementer of an antibody or contact-tracing app.

— Myrle Croasdale

Sources: