Employers balance coronavirus disclosure with privacy

With help from Darius Tahir (@dariustahir)

Editor’s Note: Morning eHealth is a free version of POLITICO Pro eHealth’s morning newsletter, which is delivered to our subscribers each morning at 6 a.m. The POLITICO Pro platform combines the news you need with tools you can use to take action on the day’s biggest stories.Act on the news with POLITICO Pro.

Quick Fix

— Employers balance coronavirus disclosure with privacy: It’s not always clear what employers should tell their workforce when one employee says they’ve been exposed to the virus, legal experts tell us.

— Telehealth groups ask for more leeway: Virtual care advocates slipped a telehealth provision into the emergency funding package enacted last week. But it’s not enough to meaningfully expand the technology’s use in coronavirus response, they say.

— Coronavirus stresses antiquated health IT: The U.S. health care system is on the leading edge of many technologies, except, crucially, when it comes to information sharing.

eHealth tweet of the day: Josh Barocas @jabarocas “CALMING REMINDER: This is not the end of days! We can all work together to ensure that our communities are safe. The more we remain calm, follow advice from TRUSTED HEALTH PROFESSIONALS, the sooner we will gain a handle on the spread of #SARSCoV2 & #COVID19. Distance=togetherness”

It’s FRIDAY at Morning eHealth, where your author is soliciting advice for staving off cabin fever while teleworking. Tips go to [email protected]. Tweet the team at @dariustahir, @ravindranize, @POLITICOPro and @Morning_eHealth.

Driving the Day

WHAT CAN YOU SHARE IF YOUR EMPLOYEE TESTS POSITIVE? — Numerous privacy lawyers tell us they’re seeing a growing number of frantic requests from employers about disclosure protocol related to the coronavirus outbreak. “The question we’re getting all the time [is], ‘One of my employees tested positive. What I can do about that, what can I share?’” said Kirk Nahra, chair of WilmerHale’s Cybersecurity and Privacy Group.

Federal labor law requires businesses to provide a safe work environment, so employers may feel it’s necessary to inform others to self-isolate if a coworker has symptoms or tests positive for coronavirus. But if those disclosures contain too much information, the exposed employees may face stigma.

“If you don’t share information, and something bad happens as a result of it, that’s a problem,” Nahra said. “If you do share, and you violate a privacy rule, that’s potentially a problem.”

... Matt Fisher, a privacy lawyer with Mirick O’Connell, recommends affected employers send a “generalized message about precautions” but “not calling out the individual.”

But it might still be possible to identify them. If an employee noticed that their deskmate is absent after a warning email, for instance, “you can probably gather that that is the person,” said Amber Clayton, director of trade group Society for Human Resource Management’s knowledge center. Employers are “trying to figure out what we can and can’t do, or what we should and shouldn’t do,” she added. “Things are fluid.”

A complex maze of federal and state laws might determine what an employer does.

... The HHS Office for Civil Rights, the agency enforcing the HIPAA privacy law, reminded health care providers, insurers and their associates last month that coronavirus disclosures should be limited to the “minimum necessary” amount of information to prevent a serious and imminent public health threat. But that law may not apply to employers, unless they’ve partnered with a payer such as an insurance company.

The Americans with Disability Act generally requires that employers keep applicants’ and employees’ medical information confidential. The Equal Employment Opportunity Commission clarifies when employers can ask about travel or symptoms — such as if they’re advised by CDC or state and local public health officials during a pandemic — but doesn’t directly address what employers can share with others about a case if a patient reports their status, Clayton said. And the Family Medical Leave Act gives employees unpaid and job-protected leave for certain family and medical reasons, and also prevents employers from disclosing the medical history of employees and their families, she added.

TELEHEALTH GROUPS WANT TWEAKS TO CORONAVIRUS PACKAGE — Several health technology lobbying groups who called for Medicare to waive reimbursement restrictions on telehealth during the coronavirus outbreak are now urging Congress to tweak the language to allow more providers to participate in screening and treatment. (The provision they’d originally called for would have allowed HHS secretary Alex Azar to waive Medicare reimbursement restrictions on telehealth for all national and public health emergencies, but what made it into the supplemental funding package last week was narrowly applied to this outbreak.)

..."[A]fter feedback from health care providers, telehealth leaders, and other stakeholders working to combat the virus, we ask for your support in addressing barriers” including by clarifying that the telehealth authority can be used to waive reimbursement “for all medical conditions during the public health emergency, not just those associated with treatment for COVID-19 patients,” reads the letter signed by among others, the Alliance for Connected Care, the Association of American Medical Colleges, the American Academy of Family Physicians, the American Psychiatric Association, the American Telemedicine Association, AMGA, the Connected Health Initiative, the eHealth Initiative and the Health Innovation Alliance.

They also requested changes to guardrails in the provision that would require the clinician to have billed the patient within the past three years, meaning they would need to have a pre-existing relationship. That provision “presents providers with a new set of burdensome compliance risks at a time when all efforts should be focused on combating the spread of COVID-19,” they wrote.

Sign up for POLITICO Nightly: Coronavirus Special Edition, your daily update on how the illness is affecting politics, markets, public health and more.

In other congressional telehealth news, Sens. John Thune (R-S.D.) and Ben Cardin (D-Md.) and Reps. Adrian Smith (R-Neb.) and Ann Kuster (D-N.H.) have reintroduced the Reducing Unnecessary Senior Hospitalizations Act, which would allow Medicare to contract with medical groups to use telehealth and on-site staff to provide acute care to skilled nursing facilities.

Telehealth in the journals: In case you missed it this week, a perspective in the New England Journal of Medicine by Judd Hollander and Brendan Carr points out that telehealth not only minimizes coronavirus exposure to and by patients, but can also protects clinicians.

“Reports that as many as 100 health care workers at a single institution have to be quarantined at home because of exposure to Covid-19 have raised concern about workforce capacity,” they write. Institutions with telehealth capacities let quarantined physicians handle some responsibilities and free up others to do in-person care. Still, they add, “other health professionals (nurses, medical assistants, physician assistants) also contribute to in-person care, and telemedicine cannot replace them all.”

Telehealth on the campaign trail: 2020 Democratic frontrunner Joe Biden on Thursday offered a detailed new roadmap for stemming the coronavirus, including telehealth and better data sharing, our POLITICO colleague Adam Cancryn writes. The former Vice President laid out a multipart plan for combating the disease that includes guaranteeing no-cost tests to anyone who needs it and rushing resources to providers on the front lines of the response. It also proposed ramping up virtual care in emergency rooms and ICUs, among other steps. (Adam also wrote about 2020 rival Bernie Sanders’ warning about the crisis, which he said was “on a scale of a major war,” and that “we must act accordingly.”)

CORONAVIRUS CRISIS BRINGS HEALTH IT CHALLENGES TO LIGHT—Antiquated health IT systems could add yet another snarl to the already troubled effort to test for coronavirus, eHealth’s Darius Tahir writes. Needing to process thousands of coronavirus tests a day will test the ability of providers, labs, and public health officials to keep track of all the results; since results aren’t automatically downloaded into physicians’ records, they may need to log into laboratory web portals or turn to faxes and phones to retrieve them.

“There is no infrastructure in the USA for tracking the number of tests ordered for just about anything,” said Brian Dixon, an informatics expert with Regenstrief Institute, a nonprofit health research organization. Dixon said that with private lab testing of coronavirus coming online, keeping track of the results will become much more difficult.

“When state health labs and CDC run all the tests, they can monitor who and how many have been tested,” he said. “Now that the test kits are in the wild, it is unknown.”

LET’S NOT FORGET ABOUT INTEROP — It might feel like a year ago, but the Trump administration finalized its interoperability and information blocking rules on Monday, and comments are still rolling in as groups wade through the more than 1,200 pages. If you’re behind, ONC’s Steve Posnack highlighted key aspects of that agency’s rule in a blog post this week. And here’s a rundown on CMS’ rule from Crowell & Moring’s Jodi Daniel, Maya Uppaluru and Stephanie Willis.

... In a release, AMGA urged CMS to build on its efforts to give patients their own claims data by working to give providers access to the same information for population health. They argued that better visibility into claims data would help provider groups transition to value-based care.

... And in another NEJM perspective published this week, Ken Mandl, who heads the Computational Health Informatics Program at Boston Children’s Hospital, and Isaac Kohane, chair of the Department of Biomedical Informatics at Harvard Medical School, deemed ONC’s rule a “momentous milestone on the road to a data-driven health system.” But they warned that with “vastly increased data liquidity and patient control of health information, we will also have to address cybersecurity, privacy, and insurability risks.”

What We're Reading

— The Verge’s Casey Newton profiles Google’s efforts to crack down on coronavirus misinformation.