Medical Privacy Laws Leave Employers Walking Fine Line To Protect Workers From COVID-19

CHICAGO (CBS) -- It's a complaint that comes into our newsroom often; many viewers feel their bosses aren't being transparent enough about COVID-19 in the workplace.

Sure, employers can and do cite privacy laws, but the Morning Insiders were curious; what are a company's legal obligations during the pandemic?

More than half a year has zoomed, with more than half of the offices in downtown Chicago sitting empty, but as working remote slowly phases out, quickly bubbling up are concerns about return-to-work policies.

Is a company really allowed to ask about your health before you step back inside?

CBS 2's Lauren Victory asked a legal expert, Northwestern University law professor Daniel Rodriguez.

"The employer has every right, and indeed I would go so far as to say an ethical duty, to ask the kinds of questions and to probe," he said.

Of course, bosses need to balance screening procedures with legal obligations, including the prevention of discrimination.

Here's what won't work, according to Rodriguez:

"Employees that are over 60 are at greater risk of becoming sick, so I'm going to take their temperature, but not going to take the temperature of folks who are in their 40s," he said.

Then there's navigating the the Health Insurance Portability and Accountability Act (HIPAA), medical privacy protections that can roll into play for this next scenario.

What does an employer legally have to tell his or her employees about whoever it is that contracted COVID-19?

"That's interesting. The thin answer to your question is: not much," Rodriguez said.

Let's head down the tracks of a specific example, relevant to commuters.

Metra's COVID-19 policy notifies the specific department of a co-worker's positive case, but does not disclose a name.

CTA more vaguely pointed to contact tracing guidelines from the Centers for Disease Control and Prevention. The CDC notes the importance of confidentiality.

Then there's Pace Bus. The suburban transit provider doesn't name names, but actually lists COVID cases on its website; including position, location, date notified, and last time worked.

"Different companies perceive their obligations not only legally, but ethically and morally, in different ways," Rodriguez said.

Pace might have found a middle ground in all of this, according to Rodriguez.

As companies grapple with the right to privacy and the right to keep employees protected, the professor said he looks to lawmakers.

"So HIPAA, as much as it is a comprehensive statue dealing with healthcare data, couldn't possibly have anticipated all the twists and turns of this crisis," Rodriguez said.

He also said he hopes Illinois state legislators can modify state laws to make it easier for employers to walk the fine line of ensuring privacy rights and protecting employees.

Rodriguez said he won't be surprised to see lawsuits over privacy issues and COVID-19.