On April 10, 2020, OSHA issued additional guidance for employers on their obligations to record COVID-19 cases which can be found here.
Prior to this guidance, OSHA made clear that COVID-19 cases may be recordable if a worker is infected as a result of performing work-related duties. Thus, employers would need to record COVID-19 cases if all of the following conditions are met:
- The case is a confirmed case of COVID-19 (see CDC information on persons under investigation and presumptive positive and laboratory-confirmed cases of COVID-19);
- The case is work-related (as defined by 29 CFR 1904.5); and
- The case involves one or more of the general recording criteria set forth in 29 CFR 1904.7 (e.g., medical treatment beyond first aid, days away from work).
Given the outbreak of COVID-19 cases across the country, many employers have understandably struggled with determining whether confirmed cases are work-related for purposes of recording. In the new guidance, OSHA states that employers in the healthcare industry, emergency response organizations (e.g., emergency medical, firefighting, and law enforcement services), and correctional institutions must continue to make work-relatedness determinations. However, OSHA will not enforce its record keeping requirements for other employers to make the same work-relatedness determinations, except where:
- There is objective evidence that a COVID-19 case may be work-related. This could include, for example, a number of cases developing among workers who work closely together without an alternative explanation; and
- The evidence was reasonably available to the employer, e.g., information given to the employer by employees, as well as information that an employer learns regarding its employees’ health and safety in the ordinary course of managing its business and employees.
This guidance helps employers narrow the circumstances when confirmed COVID-19 cases need to be recorded. If the employer is required to record under the new guidance, cases should be recorded as a “respiratory illness” and be sure to consider the additional privacy issues arise. Generally, OSHA requires the employee’s name to be entered on the OSHA 300 log. However, there are exceptions for a “privacy case” set forth in 29 CFR 1904.29 (b)(7) (i) – (vi). Although the regulation identifies certain infectious diseases within the exception, i.e., HIV infection, hepatitis, or tuberculosis, the regulation also makes clear that the enumerated exceptions are meant to be a complete listing of exceptions. As COVID-19 is not on the list, it does not qualify as a privacy case, per se. Notwithstanding this fact, the regulation further state that other “illnesses” may exclude the employees name if the “employee voluntarily requests” that his/her name not be entered on the log. See 29 CFR 1904.29(b)(7)(vi). Thus, employers should ask the employee whether he/she would like his/her name redacted from the OSHA log. If so, the employer should enter “privacy case” in the space normally used for the employee’s name and additional record keeping obligations will be triggered, e.g., keeping a separate, confidential list of the case numbers and employee names for these privacy concern cases.
OSHA has further made clear in a prior interpretation that general privacy concerns under the Health Insurance Portability and Accountability Act (HIPAA) do not provide a basis for employers to remove employees’ names from the log if they are not otherwise permitted to do so under OSHA. See here.