Can we require workers to tell us what allergies they have so we can make appropriate arrangements in our emergency response policy?
Yes, as long as you ask the right way.
Information about a worker’s medical allergies is personal health information (PHI) that you generally can’t collect under privacy laws. One way to get around that problem is to ask workers to disclose their allergies without disclosing their identities. That’s because for medical information to be PHI, it must be traceable to an identifiable individual. So, information disclosed on an anonymous basis isn’t privacy-protected.
If you do need personally identifiable information, e.g., you must know which workers have which allergies, you can still collect the information as long as:
- You do it for a legitimate purpose, which would include preparing an emergency response plan;
- Collecting the information is reasonably necessary to carry out the purposes;
- You ask for only the minimum information you need to accomplish the purpose; and
- You notify workers why you’re collecting the information and how you intend to use it; and
- Keep the information secure and confidential and refrain from using or disclosing it for any other purpose.