Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

USA: COVID-19 return-to-work plans: Privacy considerations under the Americans with Disabilities Act

As we approach the start of a third year of living with the global COVID-19 pandemic, many US employers have brought some or all employees back to their facilities from remote work, while others are making plans to do so in the coming months. Despite the great progress that has been made in fighting COVID-19, however, new variants are appearing and surges of cases continue to occur, making it evident that this virus will be actively circulating for some time to come. Jill Chasson, Lawyer at Coppersmith Brockelman, examines the relevant legal provisions and privacy considerations in relation to COVID-19 and employees returning to the workplace.

Orbon Alija / Signature Collection /

Returning to the physical workplace means that US employers must continue their COVID-19 mitigation and management efforts in ensuring a safe place to work. In doing so, employers will likely encounter a variety of situations in which they have access to, and even copies of, medical information about employees. Understandably, employees may be concerned about providing such information to their employer. Some may even mistakenly believe that the Health Information Portability and Accountability Act ('HIPAA') precludes employers from asking for or collecting it.

Although HIPAA does not apply in these circumstances, the Americans with Disabilities Act of 1990 ('ADA') does. The ADA applies to all US employers with 15 or more employees and includes confidentiality requirements with respect to medical information that a covered employer may obtain about its workers. Smaller employers, while not subject to the ADA, should nonetheless look to its confidentiality rules as a best practice.

ADA Requirements Related to Medical Examinations and Inquiries

The ADA's core provisions prohibit discrimination against both qualified applicants and employees with disabilities and require that employers provide reasonable accommodations to those individuals. However, the ADA also includes certain provisions that apply more generally. Among these are restrictions on when employers may ask disability-related questions, require applicants or employees to undergo medical examinations, and directives on how employers must handle the information they obtain from such inquiries.

For applicants, an employer may ask medical questions or require a medical examination after an offer of employment has been made, so long as all new hires in the same job category are subject to the same inquiry or examination. The standard is more stringent for existing employees: medical inquiries or exams must be job-related and consistent with business necessity.

In all cases, information obtained by the employer regarding the medical condition or history of any applicant or employee 'must be collected and maintained on separate forms and in separate medical files and be treated as a confidential medical record'.1 In guidance specifically related to the COVID-19 pandemic ('the Guidance'), the U.S. Equal Employment Opportunity Commission ('EEOC'), which enforces the ADA, has confirmed that "With limited exceptions, the ADA requires employers to keep confidential any medical information they learn about any applicant or employee".2

These 'limited exceptions' are described in the ADA's regulations, which allow for only the following types of disclosures:3

  • supervisors and managers may be informed regarding necessary restrictions on the work or duties of the employee and necessary accommodations;
  • first aid and safety personnel may be informed, when appropriate, if the disability might require emergency treatment; and
  • government officials investigating compliance with the ADA shall be provided relevant information on request.

The ADA's Application to Return-to-Work Plans

How might employers come into possession of medical information as they bring employees back into the workplace? And how can they make beneficial use of that information to keep their workplaces safe without running afoul of the ADA's privacy requirements? Consider the following scenarios.

Screening Measures and Testing

Because the COVID-19 virus is still circulating widely, procedures such as temperature checks, questions about COVID-19 symptoms or diagnosis, and COVID-19 testing feature in many employers' plans for maintaining a safe and healthy workplace. Some or all of these measures may be required of anyone coming on site, including employees, potential new hires, and vendors or other visitors.

Taking an employee's temperature, asking about symptoms of a potential illness, and administering a test for that illness are actions that are considered medical exams under the ADA. However, the EEOC has affirmed that these inquiries are permissible during the pandemic so long as employers follow reliable public health guidance, such as that which comes from the U.S. Centers for Disease Control and Prevention ('CDC'), and maintain the confidentiality of the information received. Such inquiries are considered job-related and consistent with business necessity because an individual with COVID-19 poses a direct threat to the health or safety of others and may be kept out of the workplace on that basis. These screening steps also may be taken with applicants after a conditional offer of employment has been made, consistent with Sections A, C, and G of the Guidance.

To minimise potential privacy issues associated with screening measures, employers should consider not recording individuals' exact temperature readings or specific symptoms, and instead keeping a log only of whether the person successfully passed the screening on a given day. Employees whose answers suggest possible COVID-19 infection can then be sent home, without sharing specific medical information about them in the workplace.

A different approach is warranted for information related to COVID-19 test results, regardless of whether the test is administered by the employer or obtained elsewhere by the employee. This is because a positive result has direct implications for others in the workplace who may have been exposed to the infected person. In particular, the CDC recommends that individuals quarantine and/or get tested, depending on vaccination status, following close contact with someone who has COVID-19.4

Although COVID-19 test results must be kept confidential to comply with the ADA, the EEOC has opined that in the circumstances of a pandemic, this confidentiality requirement does not prevent an employer from notifying public health officials of an employee's positive test result, or from making the inquiries and disclosures necessary to identify exposed employees and notify them. The EEOC cautions, however, in Section B.5 of the Guidance, that employers 'should make every effort to limit the number of people who get to know the name of the employee' who has tested positive. While recognising that other employees may sometimes be able to correctly guess the infected employee's identity, the EEOC further advises that employers still should avoid confirming the person's identity.

Vaccination Policies

Return-to-work plans have been aided by the widespread availability of COVID-19 vaccines, though challenges remain in persuading some individuals to get vaccinated. The Biden Administration has attempted to boost the vaccination rate in the US through the issuance of several sets of requirements applicable to different segments of the workforce, but court rulings have stalled that effort at least temporarily. On the other hand, private employers’ vaccination policies have generally been upheld by courts.

Whether an employer adopts a vaccination policy voluntarily or due to a federal requirement, it will be maintaining a record of the vaccination status of its employees. This will necessitate asking employees to show or provide copies of vaccination cards or other documentary proof of having received a COVID-19 vaccine, or to confirm that they have not received a vaccine (which will trigger other mitigation measures).

In Section K of its Guidance, the EEOC advises that asking about an applicant's or employee's vaccination status and/or requiring proof of vaccination are not disability-related inquiries that implicate the ADA, because these limited questions are not likely to elicit information about a disability. However, the information and documentation collected about vaccination, whether in hard copy or digital form, must be stored confidentially in accordance with the ADA. Many employers already have established procedures for secure, separate storage of medical information because they receive it in other circumstances, such as an employee's requests for a medical leave of absence, or documentation of a workplace injury. Vaccination-related information can be stored with this other employee health information.

Reasonable Accommodations

Under the ADA, employers are required to make reasonable accommodations for employees with disabilities when doing so does not create an undue hardship for the employer. Employees with medical conditions or disabilities that place them at higher risk for a severe case of COVID-19 may ask for accommodations to help reduce that risk; for example, by moving to an area of the office that minimises interaction with others or continuing to work remotely rather than returning to the workplace. In many such situations, the medical condition and need for accommodation may not be obvious, which means the employer may ask for documentation from a healthcare provider confirming the employee's condition and recommended accommodation(s).

For the purposes of the ADA, medical information includes the fact that an individual has requested or is receiving a reasonable accommodation. Thus, all information and documentation submitted by the employee in support of an accommodation request is covered by the ADA's privacy requirement. Likewise, any internal documentation the employer may create regarding the granting or denial of an accommodation request also must be kept confidential and not placed in the employee's personnel file.

The confidentiality requirement also prohibits an employer from discussing with other employees the fact that an accommodation was granted, or what the specifics of that accommodation are. If asked by other employees about why a certain worker is receiving what is perceived as 'special treatment', it is recommended that the employer respond in a general way, such as by pointing out that the company strives to assist any employee who may be facing challenges at work, or that it respects the privacy of all employees by not discussing their personal circumstances.

Some employees may have disabilities or health conditions that prevent them from getting a COVID-19 vaccine or warrant a delay in receiving it. These employees may request to be exempted from an otherwise required COVID-19 vaccine. This is a type of request for accommodation. Here, too, any information or documentation received in connection with such a request must be maintained confidentially. This includes restricting the disclosure of exemption-related information to those making decisions about whether to grant exemptions, and to supervisors and managers who may need to be informed of any restrictions on an exempted employee's duties, required alternative mitigation measures, or other accommodations.

Employees Who Become Ill

Despite the various steps that businesses and workers are taking to limit the spread of the virus, some employees have contracted or will contract COVID-19. An employee who tests positive, even without symptoms, will need to be absent from the workplace until such time as public health guidance indicates they may end isolation - generally at least ten days, according to the CDC. Those who have weakened immune systems, experience severe symptoms, or are hospitalised may need to be away from work even longer.

Employers should ask the returning employee to provide documentation from a medical provider indicating that the employee is fit to return to work, with or without restrictions. A fitness-for-duty release also may be required under the employer's sick leave or other time off policy. Additionally, if the employer is covered by the Family and Medical Leave Act ('FMLA') and the employee is eligible for FMLA leave, the employee can, and should, be asked to provide a medical certification to support the leave and a release to return to duty. All of these forms of medical documentation must be stored in a separate, confidential file, in accordance with the ADA's privacy requirement.


COVID-19 has created unprecedented challenges for businesses as they seek to resume and grow their operations while also ensuring that staff have a safe place to work. Evolving public health and legal guidance only further complicates matters. One constant in this environment, however, is the ADA's confidentiality requirement. Employers must ensure that as they come into possession of new forms of employee medical information, they follow EEOC guidance and best practices for protecting the privacy of that information.

Jill Chasson Lawyer
[email protected]
Coppersmith Brockelman PLC, Arizona

1. 29 CFR § 1630.14(b)(1) and 29 CFR § 1630.14 (c)(1)
2. Available at:
3. 29 CFR § 1630.14(b)(1) and 29 CFR § 1630.14 (c)(1)
4. Available at: