Quiz: Spot the Privacy Violation

SITUATION

Khantay Jeuss notifies her supervisor that she’s just tested positive for COVID-19 coronavirus. The supervisor orders her to go home immediately, talk to a doctor and stay in self-isolation for at least 14 days. But before she leaves, he asks Khantay for the names of any employees with whom she’s had close contact, i.e., within 6 feet/2 meters, in the past 48 hours. He then calls every co-worker listed, lets them know that Khantay has COVID-19 and orders them to also go into self-isolation for 14 days.

QUESTION

What, if anything, did the supervisor do wrong’
A. Order Khantay to go home and self-isolate
B. Order Khantay to reveal the names of co-workers with whom she had close contact
C. Tell the listed co-workers that Khantay has COVID-19
D. Order the potentially exposed co-workers to go home

ANSWER

C. The supervisor did everything right except for disclosing Khantay’s illness to her co-workers.

EXPLANATION

The fact that Khantay tested positive for COVID-19 is personal information that can’t be disclosed without Khantay’s consent. However, consent isn’t required if the disclosure serves a legitimate employment purpose and the personal information disclosed is limited to the minimum necessary to accomplish that purpose.

The supervisor disclosed Khantay’s diagnosis to her co-workers to protect their health and safety and ensure social distancing during the pandemic. And while that’s a legitimate purpose, the supervisor could have achieved that objective simply by notifying Khantay’s colleagues that someone with whom they had close contact tested positive without mentioning Khantay by name. So, C is the right answer.

WHY WRONG ANSWERS ARE WRONG

A is wrong because ordering employees and others who are confirmed to have (or even just exhibit symptoms of) COVID-19 is something employers are required to do under current public health guidelines.

B is wrong because the guidelines also call on employers to identify the people in the workplace with whom the person with COVID-19 has had close contact within the past 48 hours of testing positive.

D is wrong because, once more, the guidelines mandate that employers bar entry to individuals that have had close contact with somebody who has COVID-19 within 48 hours. Exception: Under revised CDC guidelines, health care and critical infrastructure workers that are ‘potentially exposed’ the way Khantay’s colleagues were, can keep working as long as they’re asymptomatic, wear a respiratory mask at all times, follow social distancing protocols and self-monitor. But when and if they exhibit COVID-19 symptoms, they have to go home and self-isolate.