In "ordinary" times, employers should tread carefully when taking employees' temperatures. While a seemingly simple step to ensure workplace safety during the COVID-19 epidemic, there are numerous potential legal implications associated not only with the act of measuring body temperature, but also with regard to how this information is documented, stored, used, disseminated, and ultimately, destroyed. Along the way, employers will need to carefully weigh federal and state compliance obligations. These obligations arise not only from laws that relate to medical conditions in the workplace, like the ADA, but also under COVID-19 related executive orders, workplace safety regulations, and data privacy laws.

This is especially true for employers of essential or critical infrastructure employees. According to guidance issued by the Centers for Disease Control (CDC) on April 9, 2020, such employers are encouraged to implement body temperature screening measures as part of their process to keep or return employees to work. The newest guidelines mention such screenings, but provide limited guidance on how to conduct them properly.

Recent EEOC guidance issued on April 9, 2020, and during a webinar (transcript here) on March 27, provides some insight into ADA-related confidentiality concerns and several scenarios involving body temperature screening.

The intent of this 2-part briefing is to highlight some of the current rules around appropriate and legally compliant workplace body temperature screenings. Part I will examine disability protections and the ADA, OSHA concerns, state measures, and data privacy concerns. Part II will look at related wage and hour issues. Some of these rules are temporary measures allowed under special, COVID-19 related guidance. As always, state-by-state concerns persist, so be sure to consult with legal counsel prior to implementing any plan.

Disability Protections and the ADA

The Equal Employment Opportunity Commission (EEOC) is the federal agency which enforces the ADA. The EEOC issued pandemic related guidance in 2009, which it updated on April 9, 2020. Under current guidance, the EEOC provided special dispensation to employers to take the body temperatures of employees. In item #7 of its pandemic-related FAQ guidance, the EEOC states:

Because the CDC and state/local health authorities have acknowledged community spread of COVID-19 and issued attendant precautions as of March 2020, employers may measure employees' body temperature. As with all medical information, the fact that an employee had a fever or other symptoms would be subject to ADA confidentiality requirements.

Any documentation connected with a medical examination or inquiry must be kept confidential. Such documentation can include, but is not limited to, a body temperature log, a statement from an employee that they suspect they have or actually have COVID-19, and any documentation related to questions asked of the employee about their health. Medical documentation should be accessible only on a "need to know" basis, which typically means that access is closely controlled by human resources and/or management. Documentation related to employee temperatures, insofar as it is stored at all, should be kept in separate, confidential files, located in an area to which access is strictly controlled (e.g., which is locked). In this case, separate means that the medical documentation may not be stored in the "regular" personnel file.

Additionally, employers should not be too quick to "diagnose" an employee with COVID-19. An elevated body temperature reading could be caused by any number of non-communicable medical conditions that may also be covered as a disability under the ADA. When an employee appears at work with an elevated body temperature that would otherwise exclude them from work, it is important for the employer to follow up with the employee if the employee indicates that the high temperature could be the result of another, non-COVID-19 related medical condition. In that event, the employer may need to follow the ADA interactive process to determine (a) whether the employee is safe to work and (b) whether any accommodations need to be made (e.g., an exception to the body temperature related workplace admittance policy). Employers who are particularly sensitive and/or susceptible to ADA claims, or who have large workplace populations with known disabilities, may wish to issue some documentation at the time of a "positive" (feverish) temperature reading directing employees with disabilities that cause such elevated readings to inform human resources or other responsible departments.

In its March 27 webinar, the EEOC also provided some scenarios that provide more guidance for employers. In one scenario, an employee refused to undergo body temperature screening. The EEOC explained that an employee can be excluded from the workplace based on a failure to undergo screening, and that such screening may also be a pre-employment condition.

In the next scenario, the EEOC addressed when an employer wants to test only a specific employee, rather than an entire category of employees or a worksite. In that situation, the EEOC explained that an employer may take the temperature only if there is "reasonable belief based on objective evidence." The EEOC provided limited examples of what this means. It indicated that an employer may have a reasonable belief based on objective evidence if an employee has a hacking cough, but that would not be the case if the employee simply "appears distracted." The examples do appear to communicate that if an employee exhibits a common symptom of COVID-19, this may give an employer a reasonable belief based on objective evidence, and thus allow for a one-person body temperature screening.

Workplace Safety

At the federal level, workplace safety is regulated and enforced by the Occupational Safety and Health Administration (OSHA), a division of the Department of Labor. OSHA's regulatory guidance reaches into many aspects of the workplace, from general to specific, but OSHA has not yet released guidance specific to the taking of body temperatures in the workplace.

However, OSHA has responded to the COVID-19 epidemic by indicating that employers must continue to abide by the "General Duty Clause" of the Occupational Health and Safety Act of 1970. In other words, employers must continue to provide a workplace that is "free from recognized hazards" that may cause injury or harm. With respect to COVID-19, this certainly means that employers must respond to COVID-19 when it is identified in the workplace or among an employer's workforce. But to what extent must employers be proactive in preventing its transmission?

Unless and until specific guidance is issued, employers should consider guidance issued jointly by the CDC and OSHA in order to answer this question. Although the guidance does not specifically address the taking of body temperatures, it prompts employers to classify their employees with respect to the level of risk associated with their contracting or being exposed to COVID-19. For employees whose job duties or other circumstances lend themselves to a "high" or "very high" risk classification, employers may wish to implement more frequent body temperature measurement plans with respect to those workers.

In addition, employers may also wish to assess the risk rating that could be applied to the employees who are taking body temperatures. These individuals are likely to have a higher risk of exposure to COVID-19 because they encounter many employees as they are entering the workplace and before they have been screened. In addition, such employees are at elevated risk to pass on the virus for the same reason. Moreover, we may not know whether the employees taking body temperatures have COVID-19, because many carriers present as asymptomatic.

In settings where employees who are taking body temperatures are at "high" or "very high" risk, employers may wish to consult with legal counsel with respect to OSHA guidance on the use of Personal Protective Equipment (PPE), especially as it relates to respiratory protection.

OSHA and the CDC also maintain special, separate guidance related to industries most heavily affected by COVID-19, such as healthcare. For industry-specific guidance, be sure to check with an attorney. In addition, OSHA currently recognizes 28 "state" occupational safety and health plans, meaning that a number of states have their own workplace safety requirements. Since state requirements may be more stringent than federal requirements, employers must ensure that they take state-specified measures into account when developing a plan to measure body temperatures.

State Temperature Taking Measures

Though OSHA has not yet addressed temperature taking in the workplace, some state governments have taken the lead. For example, Ohio and Delaware have issued public health directives that specify the correct procedures for measurement of body temperatures in the workplace.

The State of Delaware's measures may be "mandatory" (for certain high-risk industries) or "recommended" (for all other businesses). Even if an employer is not doing business in the State of Delaware, the measures prescribed by that state may provide valuable insight. The same is true for the Ohio public health guidance.

The orders share some common elements that are likely to enhance any employer's body temperature screening plan. For example:

  • Touchless thermometers should be used, if possible, to avoid transmission of COVID-19.
  • At minimum, employees who take temperatures should wear face masks and gloves.
  • Employees who are designated to take temperatures should be provided with operator manuals for the thermometers and be required to read them.
  • Employees should be expressly informed of hygienic measures, like sterilizing the thermometer (if necessary and/or not touchless), proper removal of sweat and/or other debris from foreheads of employees (again, if necessary), and what to do with contaminated materials, such as if the thermometer is dropped or becomes soiled.
  • The employer should designate an appropriate temperature range within which to "flag" employees. 100.4℉ is generally considered to be a "fever," but employers may set lower ranges within reason, such as 100.0℉-100.4℉.
  • Employers should consider implementing a brief questionnaire to evaluate risk factors for COVID-19 along with the body temperature screening.
  • If not using a touchless thermometer, and if the operator manual is unavailable, the employer should, according to the Delaware order, at minimum specify that thermometers must be (a) rinsed with clean water, (b) swabbed or wiped with alcohol, and (c) rinsed under clean water once more, before being re-used.
  • Employers may also consider allowing employees to take their own temperatures from home, especially if no thermometers are available for workplace screening. In that case, this CDC guide designed for individuals to conduct personal health checks includes a useful step-by-step guide to taking your temperature on p. 6. The same guidance has information on temperature logs (on p. 7).

Data Privacy

If employers are not documenting employee temperatures, data privacy concerns and ADA confidentiality requirements may not be a major concern. That said, all employers should carefully consider their process for body temperature screening. For instance, will the screening occur in a private place out of sight and hearing of other employees? If not, how do screeners relate to any given employee that their body temperature is elevated, and they are being excluded from the workplace? What about possible confrontations from workers who refuse screenings or insist that the reading is incorrect?

However, for employers who are creating any written documentation about body temperature or COVID-19, including any documentation related to a "negative" (non-feverish) reading, data privacy concerns must also be addressed.

Protected documentation may be as simple as a "log" of employees screened. A log containing employee temperature readings is confidential medical information, but it can also be useful if an employer is later asked to provide evidence that it properly addressed workplace safety concerns related to COVID-19. In other words, there are compelling reasons to create and keep such a log that may outweigh the associated administrative inconvenience and legal risks. This briefing has already discussed ADA confidentiality provisions. There are other privacy rights that may apply to medical documentation related to employees' body temperatures. Most of these implications arise under state law.

For instance, in the State of California, h3 constitutional privacy rights and the California Consumer Privacy Act (CCPA) dictate a cautious and methodical approach to implementing body temperature screenings. Under the CCPA, it is possible that employees must be provided with a "Notice at Collection" when their temperatures are taken. In addition, California courts often interpret the State constitution in such a way as to provide h3 individual privacy rights. As such, it may be advisable to implement a written program prior to conducting screenings, such that employees will have been properly informed and "warned" of the parameters of the program prior to permitting the screening to take place.

In other states, recent data privacy legislation has added layers of protection to "protected information" or "personal identifying information," which usually includes medical documentation. It may be possible, with the assistance of legal counsel, to exclude any body temperature related documentation from the coverage of these laws by, for example, excluding the names of the employees from the log. However, state laws vary and, in some places, even employee numbers, when related to a body temperature reading, may apply special data privacy rules to documentation.

Even in states without specific data privacy laws, recent court decisions have shown that employers may still be held to be negligent when they do not take reasonable steps to ensure that confidentiality and security of the personally identifying information that they store, use, and disseminate. For instance, a healthcare provider in Pennsylvania was recently held to be negligent (and therefore liable for damages) for failing to properly protect medical data related to its patients, even though Pennsylvania did not enact a specific data privacy law.

At minimum, employers should consider taking the following steps:

  • Evaluate the applicability of any state data privacy laws;
  • Carefully develop a written program for body temperature screening;
  • Notify employees of the program as required;
  • Prepare any required notices for distribution, such as the "Notice at Collection" for California employees;
  • Train employees who are completing logs to properly maintain confidentiality of the log; e.g., by keeping it covered, not leaving it unsecured, not taking it out of the workplace, not making copies, etc.
  • Make appropriate arrangements for storage of the documentation, or plan for immediate and proper destruction;
  • In the event that information is stored electronically, consult with information technology and privacy experts to ensure that the data enjoys reasonable security and privacy protections;
  • If retained, determine conditions, if any, under which information might be shared, such as with OSHA or a local safety enforcement agency, and consider whether to include such conditions in a notice to employees, if required; and

Set a timeline for destruction of documents, respecting certain document retention guidelines (for instance, some documentation required to apply for a tax credit with the IRS for paid leave may have to be retained for up to 4 years).

Less often, the specific circumstances related to an employer require that employer to treat some medical documentation related to employees as protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA). Although medical documentation held by an employer in the scope of employment is generally not covered by HIPAA, some employers, especially those with self-funded health benefits, may need to assess whether medical documentation related to temperature readings qualifies as PHI under HIPAA, thus requiring specific privacy and security protocols.

Briefly Stated

Body temperature screenings may be a useful tool for employers to consider in keeping their workplaces safe and creating documentation to demonstrate that they took reasonable safety precautions to avoid transmission of COVID-19. This is especially true for employers who must ask their employees to continue physically working together due to business demands, sometimes over the objections of their workforce. When considering implementing a body temperature screening program, ask the following questions:

  • Are there state or local compliance obligations which I must address? If so, I should consult with legal counsel.
  • Will I create a record of temperatures? If so, how will I keep this information confidential? When will I destroy it?
  • Am I designating employees to take temperatures? If so, how will I properly train these employees so that they maintain confidentiality and keep themselves, and the workers to whom they are exposed, safe?
  • What are the next steps when an employee's temperature reads as higher than the level I've set? With whom is this information communicated and what do I tell the employee? How do I ensure discretion?

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.