Coronavirus Update for March 19: A Note on Confidentiality and Privacy Rights
Dear Campus Community,
Following our first confirmed cases the university has received a number of questions regarding privacy issues. To ensure the University complies with state and federal privacy rights of University employees and students, all employees are asked to review and follow the guidance provided in the FAQs Regarding Confidentiality During a Pandemic. Concerns or questions about privacy and confidentiality can be sent to Compliance.matters@wwu.edu
FAQs Regarding Confidentiality During a Pandemic
1. Is the University’s knowledge that an employee or student has COVID-19 subject to HIPAA’s privacy or FERPA restrictions?
HIPAA: No. The University is not subject to the Health Insurance Portability and Accountability Act (HIPAA) and HIPPA usually will not be implicated. The University does have restrictions regarding disclosures of personal health information (PHI) under the American’s with Disabilities Act (ADA), state laws RCW 49.60 and RCW 70.02, and the state and federal Family Medical Leave Act (FMLA).
FERPA: Yes, the University is subject to privacy rules under the Family Educational Rights and Privacy Act (FERPA).
Exceptions: Privacy laws that protect personal health information make an exception when disclosures are necessary to prevent or lessen a serious and imminent threat to the health and safety of others. The current COVID-19 situation is an example of when this exception is made.
2. Must an employee or student report if they have been diagnosed with COVID-19 or are experiencing symptoms?
Yes. Employees, supervisors and students are expected to follow the University’s Reporting Communicable Diseases Policy (POL-U1000.12). University administrators will work with the local Public Health Department in responding to reported cases which will include instructions for the University regarding how and to whom to communicate with potentially exposed individuals. Supervisors will receive instruction on communicating reported cases to those with a need to know. In addition to following the reporting requirements of the policy, employees and students may disclose their own condition to others as they choose.
3. May an employer disclose an employee’s actual or probable COVID-19 diagnosis to others?
Yes, but to employees and students only to the extent necessary to adequately inform them of their potential exposure or as otherwise directed by the CDC or another public health authority. Otherwise, the CDC has said employers should follow the ADA’s confidentiality requirements, which significantly limit the disclosure of information. Employers can communicate to non-exposed employees and students that there has been a COVID-19 diagnosis, without sharing additional identifying information.
The University will follow communication instructions to employees and students received by the public health authority to ensure those with a need to know receive the information necessary to take appropriate action.
Those who receive specific details of an employee or student because they have a need to know are asked to refrain from using the individual’s name or other identifying information in subsequent conversations especially electronic communications (email, TEAMS, etc). Verbal communication should be used when there is a need to identify the individual. Administrators are to remind each other of the need to protect the individual’s privacy.
In Good Health,
Chyerl Wolfe-Lee
Assistant Vice President for Human Resources