Most U.S. colleges and universities plan to reopen their campuses, wholly or in part, for the Fall 2020 Semester. Screening returning students and employees for COVID-19 infection will be a necessary component of reopening campuses responsibly and safely. Such screening will certainly involve solicitation of confidential medical information and may include testing for the virus. Higher education institutions will need to comply with numerous federal, state and local laws and regulations in obtaining and using the data that such screening generates.
Among the key laws and regulations a college or university should take into consideration when adopting a COVID-19 compliance solution are:
Privacy Laws and Regulations
HIPAA – The Health Insurance Portability and Accountability Act
Since adoption of this federal law in 1996, HIPAA has become widely known and recognized in large part because all persons receiving medical care in the United States must be regularly informed of their privacy rights regarding their protected health information. As a result, many persons and entities–understanding that HIPAA provides broad protections for privacy and security of such information–may assume that it applies in situations where it does not. HIPAA’s privacy and security provisions govern “covered entities,” a term that encompasses health care providers, health insurance plans and business associates of such entities. Except in narrow circumstances, HIPAA is unlikely to apply to data obtained by colleges and universities through COVID-19 screening from students or from employees. That said, employers have a legal obligation under the Americans with Disabilities Act to maintain confidentiality of medical information they obtain about applicants or employees, to collect such information on separate forms, and to maintain it in separate files.
FERPA -The Family Educational Rights and Privacy Act
Generally, an educational agency or institution’s use and storage of a student’s personally identifiable information (PII) that is health-related is regulated under FERPA rather than under HIPAA.[i] The FERPA prior consent requirement is subject to statutory exceptions, notably the “health or safety emergency” exception, which allows the
[i] https://www.hhs.gov/hipaa/for-professionals/faq/518/does-ferpa-or-hipaa-apply-to-records-on-students-at-health-clinics/index.html
agency or institution to disclose PII from student education records to a public health agency if the public health agency’s knowledge of the information is necessary to protect the health or safety of students or other individuals. The health or emergency exception will probably not apply, however, in situations where the institution needs to disclose PII to a clinical site.[i] As a result, FERPA-compliant authorizations will be required in conjunction with the administration of COVID-19 screening.[i]
The Clery Act
The Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act (“Clery Act”) is a federal statute imposing recordkeeping and notification requirements on institutions of higher learning in regard principally to campus crime. Among other provisions, the Clery Act requires a university to issue a “timely warning” to the campus community when a significant emergency or a dangerous situation on the campus involves an immediate threat to the health or safety of students or employees.
The U.S. Department of Education considers an “outbreak of meningitis, norovirus or other serious illness” to be an example of a situation warranting a timely warning.[i] The department has also indicated that COVID-19 constitutes a “serious illness,” thus requiring timely warning. Some commentators suggest that colleges and universities may need to issue follow-up notices to the campus community where they develop a “hot spot,” and the Department of Education guidance may be modified as the crisis continues.
Discrimination or Harassment on the Basis of National Origin, Race, or Other
Protected Characteristics
Title VI of the Civil Rights Act of 1964 (Title VI) prohibits race, color and national origin discrimination by colleges and universities receiving federal funds. Title VII of the Civil Rights Act (Title VII) prohibits discrimination by employers based on race, color, national origin, religion and sex (including pregnancy.) The Age Discrimination in Employment Act (ADEA) bars discrimination in employment based on age (40 or older.) Each of these federal laws may give rise to claims against an educational institution based on how it uses the information obtained through COVID-19 screening.
In light of foregoing anti-discrimination laws and in the context of COVID-19 screenings, it will be important for institutions to ask the right questions and make decisions based on valid, defensible grounds. For example, persons being screened may be asked whether they have traveled to other countries, such as China, where there have been significant outbreaks, or whether they have been in close contact with persons who have traveled to such places. However, they cannot be asked if they are of Chinese origin, and admission or employment decisions can be based on the former but not on the latter considerations.
One likely area of particular sensitivity will involve medical conditions that may constitute a disability and may be disclosed in the screening process. In the employment context, the U.S. Equal Opportunity Employment Commission (EEOC), in a recent COVID-inspired update to guidance issued in 2009 during the H1N1 pandemic, has advised that an employer may not ask employees who do not have influenza symptoms whether they have a medical condition that under Centers for Disease Control (CDC) guidance would make the employee particularly vulnerable to COVID-19 complications.
That said, the EEOC also recognizes that if the pandemic becomes sufficiently severe, employers may have sufficient objective information from public health authorities to conclude that employees will face a direct threat if they contract COVID-19. In that case the employer may make disability-related inquiries and require medical examinations of asymptomatic employees to identify those with higher risk of COVID-19 complications.
The EEOC’s flexibility on this point heightens the need to stay current on regulatory guidance as the pandemic progresses.
The EEOC does provide useful direction on what inquiries an employer may make, and when. Noteworthy guidance includes:
- During the pandemic, employers may ask employees who call in sick if they are experiencing symptoms associated with COVID-19, which the CDC has identified as fever, chills or repeated shaking with chills, cough, shortness of breath or difficulty breathing, muscle or body aches, headache, new loss of taste or smell, and sore throat. EEOC recognizes that this list of symptoms is expanding as providers learn more about the illness, and recommends that employers stay current on CDC and other health authority guidance.
- Employers may measure employees’ body temperatures during the COVID-19 pandemic. Note, however, that the EEOC cautions that some people with COVID-19 do not have a fever.
- Employers may require employees to stay home if they have COVID-19 symptoms.
- Employees returning to work may be required to submit fitness for duty certifications from health care professionals.
- In hiring, an employer may screen job applicants for COVID-19 symptoms and/or take an applicant’s temperature, but only after making a conditional job offer. An employer may delay the start date for a new employee who displays COVID-19 symptoms or, when it needs an applicant to start work immediately, withdraw the offer. However, an employer may not delay the start date or withdraw an offer merely because an employee discloses information that puts him or her in a heightened risk category, such as being over the age of 65 or pregnant.
- All medical information about employees or applicants (including temperature measurement) must be collected and maintained on separate forms and in separate files and must be treated as a confidential medical record.
The U.S. Department of Education’s Office for Civil Rights (OCR) has issued a reminder[i] that in complying with CDC recommendations regarding COVID-19, schools, colleges and universities must:
- Take appropriate action to investigate reports of bullying or harassment of students based on actual or perceived disability, race, color or national origin.
- Avoid discrimination on the basis of race, color or national origin when assessing individuals, and may not rely on stereotypes related to race, color or national origin in identifying students who may be at risk for coronavirus infection.
Disability and other Discrimination
The Americans with Disabilities Act (the “ADA”) imposes broad protections against discrimination in employment, accommodations and education for persons with disabilities. Section 504 of the Rehabilitation Act of 1974 prohibits discrimination on the basis of disability by any program or activity that receives federal funding. Both the ADA and Section 504 may be relevant in COVID-19 screening. Broadly speaking, these statutes will prohibit using the results of the screening as a basis for disability discrimination.
(a) Students. In the student context, an educational institution may not discriminate on the basis of disability in admissions, accommodations or instruction. There is a robust and extensive history of litigation against educational institutions centered on claims that a student was not admitted because of a disability, was not able to access housing, classrooms or services because of a disability, or was not able to meaningfully participate in learning opportunities because of a disability. In every instance, the key questions are (1) whether the student actually had (or was regarded as having) a condition that qualifies as a disability; (2) whether the disability could reasonably be accommodated by the institution without undue hardship; and (3) whether the institution did in fact provide reasonable accommodation. Thus, refusing admission to a student because of a learning disability would be discriminatory unless the learning disability were of such a nature and extent that made the requested accommodations an undue hardship for the institution.
(b) Employees. Any employer who has more than 15 employees and any employer providing programs or services receiving federal funding will be prohibited either by the ADA, or by Section 504 (or by both), from discriminating against employees on the basis of disability. Again, the analysis in the event of dispute is whether the employee has or is regarded as having a condition that qualifies as a disability, whether the disability can be reasonably accommodated by the employer without undue hardship, and whether the employer has in fact provided reasonable accommodation.
General Liability Concerns
College and universities will want to reintegrate faculty and staff to on-campus learning in a way that protects their communities from escalations in COVID-19 infection. Indeed, they may well have a legal obligation to do so. With respect to the legal duties owed to students to protect their safety, courts have split on whether or not a college or university has a special relationship with its students such that the school owes a duty of care to the students. The prudent course is for colleges and universities to assume that they have the duty to protect students from foreseeable risks that may arise through attending classes and living in dorms. The COVID-19 virus will likely be considered a foreseeable risk by the time institutions begin to reintegrate students back into campus settings.
The murkiness of potential liability issues enforces the need to stay current on industry trends and on governmental guidance, both of which are rapidly evolving.
Data Privacy
Given the numbers of individuals to be screened for COVID-19 in a compact time period and the urgency of detecting potential infections efficiently and swiftly, institutions will no doubt turn to computer-based tools to assist with screening. As with any software solution, it’s important that the solution provider is committed to maintaining compliance with data privacy rules and regulations, as well as transparency regarding user data practices. The regulatory landscape is extensive and in a constant state of evolution, ranging from the General Data Protection Regulation from the European Union to a patchwork of domestic state laws, and numerous federal privacy bills under consideration. As a state law example, the California Consumer Privacy Act provides users of a software solution with a variety of rights in the personal data collected through the solution, such as the right to know what data is collected and whether it will be used or sold, and in many circumstances, the right to request deletion of personal data. These types of laws require a screening solution to be designed with privacy in mind, followed by the development of a robust framework to timely and appropriately respond to consumer data requests. Institutions or the entities providing screening on the institutions’ behalf should also inform users through their website terms of use and privacy policies that detail what types of data will be collected, how the data will be used, and whether the data will be shared with third parties.
State and Local Laws and Regulations
While this discussion generally highlights federal legal requirements, educational institutions will need to stay current on state and local laws and regulations applicable to COVID-19 screening, including rapidly evolving public health guidance from state and local government.
The information contained within this article is provided solely for informational purposes, and should not be construed as legal advice. No reader should act or refrain from acting on the basis of any information included in this article without seeking appropriate legal or other professional advice regarding your organization’s specific facts and circumstances.
Footnotes:
[i] For more detailed information about how FERPA applies to communications related to COVID-19, see the US Department of Education Student Privacy Policy Office’s publication, FERPA & Coronavirus Disease 2019 (COVID-19) Frequently Asked Questions (FAQs): https://studentprivacy.ed.gov/sites/default/files/resource_document/file/FERPA%20and%20Coronavirus%20Frequently%20Asked%20Questions.pdf .
[i] The U.S. Department of Education Handbook for Campus Safety and Security Reporting (2016), p. 6-2.
[i] Fact Sheet: Addressing the Risk of COVID-19 in Schools While Protecting the Civil Rights of Students (March 16, 2020) https://www2.ed.gov/about/offices/list/ocr/docs/ocr-coronavirus-fact-sheet.pdf. See also March 4, 2020 Letter to Education Leaders from Kenneth L. Marcus, Director of OCR, written in response to widespread reports of harassment of students of Chinese or, more broadly, Asian descent. https://content.govdelivery.com/accounts/USED/bulletins/27f5130