Coronavirus/COVID-19: Key Privacy and Security Considerations

The outbreak of COVID-19 has dramatically changed the economy and working landscape of the United  States and many other countries across the world. Companies suddenly find themselves dealing with a host of privacy issues and questions about sharing information with employees, customers and others. In addition, transitioning to a remote workforce can create privacy and data security concerns.

Hunton Andrews Kurth LLP has assisted and continues to assist clients in navigating this new paradigm. This includes advising on:

• Developing questionnaires for employees and visitors to their facility regarding their travel history, health status and potential exposure to COVID-19;
• Whether companies are permitted or required to share information with state and federal public health authorities and detailing what specific information can be shared;
• Employee communications on COVID-19 exposure at a company’s office or facilities;
• Using and disclosing health information in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and applicable state health privacy laws;
• Online privacy issues associated with developing company websites on which employees may communicate personal information;
• Public-private partnerships that are addressing the COVID-19 pandemic;
• Whether employees can monitor individuals’ temperatures as they enter a facility (and prevent people from entering if they have a fever);
• The development and use of mobile applications to track potential COVID-19 exposure;
• Conducting privacy and information security risk assessments;
• Contractual restrictions that apply to the use and disclosure of information related to COVID-19;
• State information security laws or regulations that obligate entities to safeguard personal information;
• Data security issues pertaining to employees working remotely, including monitoring and data loss prevention; and
• International data transfer mechanisms that enable companies to legally transfer health data across a company’s global locations.