Wait, Is That a COVID-19 Record?

It’s no surprise that a global pandemic has created a lot of records, along with many questions surrounding these records. As organizations adapt to the new and constantly changing COVID-19 landscape, new processes and record outputs abound. We often get questions from our clients asking “is this a COVID-19 record?” and if yes, “how long should we be keeping this record?” Explicit authorities on company recordkeeping obligations have been slow to trickle down and are a bit of a patchwork with federal and state guidance provided only here and there.

This blog surveys a few of the common recordkeeping questions we’ve received and provides guidance on addressing COVID-19 records within your records retention schedule.

Is a confirmed COVID-19 case recordable?

Answer:  Maybe.

For U.S. Organizations:

The U.S. Occupational Safety and Health Administration (OSHA) has clarified that COVID-19 may be a recordable illness for covered employers if a worker is infected as a result of performing their work-related duties. This seems straightforward enough, but there are various criteria to determine whether the illness is recordable. For COVID-19 to be a recordable illness, the following must be met:

1. The case must be a confirmed case of COVID-19. Per the Centers for Disease Control (CDC), a confirmed COVID-19 case means laboratory confirmation of an individual’s test, with at least one respiratory specimen that has tested positive for SARSCoV-2, the virus that causes COVID-19.[1]
2. The case must be work-related as determined by a work-related analysis which includes a number of questions designed to determine whether the case is likely work-related;[2] This analysis is important since only work-related illnesses must be recorded and reported to OSHA.[3]
3. The instance involves one or more of the general recording criteria including medical treatment beyond first aid or considering the employee’s number of days away from work. OSHA’s definition of a recordable illness includes “both acute and chronic illnesses, such as, but not limited to, a skin disease, respiratory disorder or poisoning.” This definition is limited to abnormal conditions or disorders that exclude the common cold and the seasonal flu.[4]

By OSHA’s own admission, arriving at a work-related determination can be difficult given the ubiquity of community spread.[5] Nonetheless, any recordable COVID-19 illnesses must be retained for a period of 5 years consistent with the OSHA 300 log recordkeeping requirement. Similarly, it would be prudent to keep the work-related analysis for the same period of time in case of an audit.[6]

But what about organizations with international operations?

Organizations with international operations should consult jurisdiction-specific requirements. Research specific to the jurisdictions of your company’s operations is prudent to ensure appropriate retention periods are consulted as well as restrictions on the collection and retention of this class of employee health information. For example, the French CNIL prohibits employers from storing files related to information collected during automated processing of temperature screening of employees. However, CNIL states that the “data protection law does not apply to manual verification of temperatures where no information is retained.”[7]

How long do we need to keep temperature checks of employees taken for building entry purposes?

Answer: Possibly as long as the duration of employment plus 30 years if it meets the definition of a medical record, but a much shorter duration if not.

Employee temperature checks are not usually permitted, but exceptions have been made during the pandemic. Per Equal Employment Opportunity Commission (EEOC) guidelines, employee temperature checks are permitted to determine whether an employee should be excluded from the workplace in the interest of public health.[8] Temperature checks may constitute a medical record,[9] and thus be subject to a 30-year retention period.[10] The definition of an employee medical record under OSHA is very particular:

[A] record concerning the health status of an employee that is made or maintained by a physician, nurse or other healthcare personnel, or technician, including medical and employment questionnaires or histories, the results of medical exams, lab test results, medical opinions/doctor’s recommendations, first aid records, employee medical complaints, and descriptions of treatment or prescriptions.[11]

If this information is collected by an individual that doesn’t meet the above criteria, then it is unclear whether it constitutes a medical record subject to a 30-year retention period.[12]

Privacy Considerations

Determining the appropriate retention period for any COVID-19 related record is important for a number of reasons, including privacy considerations. Given the sensitive nature of health information, employers often minimize the amount of health information they collect. For example, when collecting employee health questionnaires, rather than record an employee’s temperature, employers may record a “yes” or “no” response to the question of whether the temperature meets the threshold for a fever.

Zasio recommends minimizing or even eliminating the amount of personal information an employer collects in proportion to the purpose for which it is collected. If collecting information constituting an employee’s medical record is unnecessary, then collecting a minimal amount of information may be considered more transitory in nature.

Conclusion

The advent of COVID-19 records presents an opportunity for us in the records and information management industry to put our skills to the test. Determining how to categorize these records and assessing the appropriate retention period requires an analysis of a number of factors; it is important to consider the business process(es) associated with the records, the purpose for which the record was created or is needed, business and operational considerations, along with an understanding of the relevant laws and regulations, including privacy. To top it off, organizations grapple with the potential of long-term risks and this certainly plays a part in how COVID-19 related records are being maintained.

For guidance and assistance navigating the complexities of your organization’s COVID-19 related records, please contact Zasio for assistance.

[1] https://www.cdc.gov/coronavirus/2019-ncov/hcp/testing-overview.html

[2] https://www.osha.gov/memos/2020-05-19/revised-enforcement-guidance-recording-cases-coronavirus-disease-2019-covid-19#_ftn4

[3] 29 CFR 1904.4

[4] 29 CFR 1904.7

[5] See Occupational Safety and Health Administration, May 19, 2020 Memorandum for Regional Administrators State Plan Designees, accessed at: https://www.osha.gov/memos/2020-05-19/revised-enforcement-guidance-recording-cases-coronavirus-disease-2019-covid-19

[6] 29 CFR 1904.30

[7] https://www.dataguidance.com/opinion/france-cnil-issues-guidance-employers-personal-data-collection-during-coronavirus-lockdown

[8] https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act#q7

[9] 1910.1020(c)(6)

[10] 1910.1020(d)(1)(i)

[11] https://www.osha.gov/sites/default/files/publications/OSHA4045.pdf

[12] Id.

Disclaimer: The purpose of this post is to provide general education on Information Governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.