Tag Archives: return to work

By Willem Ryan

With significant clusters of COVID-19 infection among employees—16,000 cases and 86 deaths documented by the CDC through May 2020 — the food processing and distribution industry faces significant challenges in reopening their facilities and ramping up to full capacity. Technology for health and safety access governance and intelligence, along with guidelines from the CDC and OSHA, can help support food companies in the automation of certain compliance activities and a safe return-to-work strategy.

Designated part of the essential critical infrastructure by the federal government at the onset of the pandemic in the spring of 2020, the food supply chain needs active solutions to protect its workforce. But there’s more to this back-to-work transition. Workers need to feel safe and trust that new security, safety and compliance processes have their best interests in mind—transferring to an overall positive experience with their employer.

In the age of contagion, the food industry requires ways to communicate better with the workforce, identify and isolate areas of contagion and also deal with the lingering presence of potential bioterrorism, insider threat and cyber-attack. It’s a multi-faceted and complex workspace we’re reentering, one that takes coordination of technology, people and processes. Without it, food suppliers risk plant shutdowns and loss of business continuity.

Bioterrorism and insider threat remain an active part of the supply chain landscape. In fact, according to a June 2020 Wall Street Journal Pro Research Survey of cybersecurity executives at nearly 400 companies, 67% were concerned about malicious insiders. Remote workers and lax controls have exacerbated the situation and rising threats include malicious employees, accidental negligence, contractor or vendor misuse and account compromise.

The Landscape of Collaboration

The ongoing coordination between human resources (HR) and security is a collaborative effort that bolsters food defense in a COVID-19 world. Fueled by digital transformation, converged physical security and HR management solutions are wound together tightly in a coordinated and analytical approach to keep food industry employees safe and operations running smoothly.

These departments, once siloed and co-existing without direct interaction, are benefiting from software’s move to the cloud and open operating platforms, which provides increased opportunity for real-time integration of HR, security and facilities technologies. Moving to a converged approach across all departments, including HR, IT/cyber and operational technology (OT)/SCADA—can effectively secure our most critical food production and distribution resources while actively enforcing compliance and company policies, including COVID-19 mandates. In addition, physical security access governance, in a holistic manner, protects food industry workers and processes from compromised identities, systems and insider threats.

HR and physical security now have the ability to share data-insights to prevent, detect and mitigate the spread of contagions. With this convergence, organizations have the information they need to actively defend and protect the workforce, focusing on the human side of security to yield a positive experience.

Food security, collaboration — The ongoing coordination between human resources and security is a collaborative effort that bolsters food defense in a COVID-19 world. Shutterstock image courtesy of AlertEnterprise.

Enabling a Safe and Healthy Return to Work

This time of unprecedented change has triggered a tectonic shift in the way organizations have been dealing with the health, security and safety of their workforce. Sensing a coming tsunami, HR, corporate real estate and physical security leaders are realizing that they must stop operating in silos and embrace a holistic approach. Enterprise response and recovery plans have become a major catalyst for converged security, as it has proven to be the most effective way to manage workspace access, enforce workforce security, safety and privacy.

Reopening with Technology at Your Back

Physical identity access management (PIAM) software, including visitor identity management (VIM) are convergence platforms that deliver identity and access governance, health and safety intelligence and compliance validation across the enterprise. PIAM provides a safer work environment by managing physical, logical and operational technology access for employees and visitors, actively enforcing company policies, compliance and industry regulations with built-in best practices and regulatory controls. Automated policy-driven background checks yield real-time vetting of visitors, contractors and employees while validating and identifying any policy violations. PIAM and VIM keeps facilities and workers safe, making sure the employees and visitors only have access to the areas, data and assets they need, including vital food processing areas where deliberate sabotage needs to be kept at bay.

While prevention of bioterrorism and insider threat is ongoing at food distribution, production and processing facilities there’s been a notable shift during the pandemic that focuses on the health and safety of workers. Security is no longer simply about keeping the bad guys out; it’s about safety and protecting workers from unsafe behavior.

Workforce health and safety access governance software solutions help organizations open safely in a frictionless, controlled and secure way by automating and enforcing COVID-19 related policies and procedures. Automated batch email/text notifications with self-service links send requests to the remote workforce for self-attestation and self-reporting offsite and enable access by the worker to the facility based on health, travel and other company policies.

Here’s how it works: An employee completes the self-reporting health and travel questionnaire through a mobile app, which triggers automated workflows based on those answers. These health questionnaires collect data and document employee activity during lockdown, including infection, symptoms or exposure. The employee’s self-attestation request comes to the manager for action, and based on answers the worker is considered high risk and per policy their access to the facility is revoked for 14 days while they are in quarantine. A similar self-attestation and workflow then applies to reinstatement for the employee. This reporting and workflow can be configured specifically to the facility. Enterprises can further customize their visitor identity management to provide clear communication of current policies during the outbreak, reinforcing WHO best practices.

Focus on Health and Safety

Health and safety access governance and intelligence provides prescreening support of workforce site entry with automated policy enforcements. Pre-registered and onsite visitors/contractors check-in/check-out with prescreening, watch list and other checks prior to access. In the production or distribution facility, health and safety analytics track confirmed or potentially exposed COVID-19 workers, identify exposed areas for lockdown and/or sanitization, social distancing violation, location heat map and other actionable health & safety analytics.

PIAM also allows you to automate your communications and deliver clear expectations and procedures to your workforce, visitors and contractors pre-visit and onsite—adding to a seamless experience.

Security convergence delivers a comprehensive, holistic solution across the entire food value chain, from sourcing to production to retail distribution. Human resources and physical security have teamed up—yielding real-time data that can prevent, detect and mitigate the spread of contagions. With this convergence comes greater situational awareness that defends and protects the workforce, with a strong focus on safety and building trust between worker and employer.

June 8, 2020

FST Soapbox

The COVID-19 Record Retention Conundrum

By Melanie Neumann, JD, MS

2 Comments

During this global pandemic, the U.S. Equal Employment Opportunity Commission (EEOC) green-lighted employers to take temperatures checks of employees and to administer COVID-19 testing for workers prior to returning to work without running afoul of the Americans with Disabilities Act (ADA). This appears straight-forward upon first reading, however, several practical uncertainties about implementation, including confidentiality, discrimination, and how long to retain records remain.

As such, deciding whether to take temperatures and/or require COVID- 19 testing as a return to work strategy is more complicated than it may seem.

Temperature Screening & Testing Considerations

Temperature screening and COVID-19 mandatory testing are both permitted medical examinations during this pandemic but are otherwise prohibited during non-pandemic times. Before adopting, employers should understand the requirements impacting the records these tests generate, including the need to protect confidentiality and to retain records for longer than one may expect.

Temperature Screens
Under normal circumstances, temperature checks are considered a prohibited medical examination under the ADA. During a pandemic, however, the Equal Employment Opportunity Commission (“EEOC”) makes an exception, allowing employers to take temperatures/use temperature checks and exclude employees from the workplace should temperatures exceed public health recommendations. If employers keep records of temperatures, they must retain these records per applicable regulations. This is important because an “employee medical record” would likely result if employers take employees’ temperatures or collect temperature related records. As we will see below, there are regulatory requirements that require how we conduct these screens, and where and for how long we must retain them.

COVID-19 Testing

COVID-19 testing also constitutes a permissible medical exam under ADA during this pandemic, per the EEOC-issued guidance regarding mandatory employee testing.

For medical examinations to be allowed under the ADA, the test must be “job related and consistent with business necessity,” and employers must treat information as a confidential medical exam.

The initial guidance acknowledged that the spread of COVID-19 is a “direct threat,” hence meeting the requirement that a medical exam be “job related and consistent with business necessity” and that temperature screenings were therefore appropriate. For the same reasons, in updated guidance released at the end of April 2020, the EEOC expanded that guidance to clarify that employers may choose to administer COVID-19 testing to employees before they enter the workplace to determine if they have the virus for the same reasons.

When reading the EEOC’s language closely, the permission granted by EEOC appears to be for diagnostic tests, as the guidance states testing is to determine if employees have the virus before allowing employees to return to work. It is unclear whether antibody testing is included in the above analysis because antibody tests do not determine if someone is currently infected.

In addition, there are other considerations employers should assess before adopting a testing protocol. EEOC reminds employers that they must review the accuracy and efficacy of the selected test per FDA and CDC recommendations. Moreover, pragmatic considerations, such as how to maintain social distancing and employee privacy, determining who will perform the testing and at what the frequency, not to mention evaluating whether there is enough test capacity to perform employee-wide testing at a meaningful cadence should be evaluated.

Records Management & Retention

There is another often over-looked question: What do employers do with documented test records? This question applies whether the employer conducts the test, requires tests from employee’s healthcare providers to be off work to self-isolate, or as a return to work requirement.

It was clearly outlined above that temperature records and COVID-19 test records constitute employee medical records. Why is this important? Because there are specific requirements relating to employee medical records, including what appears to be a surprisingly long retention requirement.

Where to retain: An employer should store all medical information related to COVID-19 in existing medical files, separate from the employee’s personnel file, per the ADA, limiting access to this employee confidential information. This includes an employee’s statement that he has COVID-19 or suspects he/she has the disease, or the employer’s notes or other documentation from questioning an employee about symptoms.

How long to retain: That is the 30-year question. The Department of Labor’s Occupational Safety and Health Agency (OSHA) provides retention requirements for employee medical records in certain situations for a period of an employee’s employment plus 30 years.

While COVID-19 test results and temperature screening documentation are deemed medical examinations under the applicable regulations, are the documented results deemed medical records? We turn to applicable EEOC OSHA regulations in section 1910.1020 for answers.

OSHA Requirements

The OSHA general duty clause, section 5(a)(1) requires employers to furnish to each of its employees a workplace free from recognized hazards that are causing or likely to cause death or serious physical harm. COVID-19 appears to rise to this threat level. But is that fact alone dispositive to falling under the applicable OSHA retention requirements?

OSHA regulation section 1910.1020 requires employers to retain employee exposure or employee medical records relating to employee exposure to certain hazards. This section applies to each general industry, maritime and construction employer who makes, maintains, contracts for, or has access to employee exposure or medical records, or analyses thereof, pertaining to employees exposed to toxic substances or harmful physical agents (Emphasis added).

Is SARS-CoV-2, the virus that causes COVID-19, considered a “toxic substance or harmful physical agent?”

Most would quickly assume the answer is ‘yes’. But it may not be as clear as the black and white letter of the law would hope. Let’s review some key definitions in the applicable regulation to help shed more light on this question.

What are Toxic Substances or Harmful Physical Agents?

The record retention requirement pivots on the last phrase of 1910.1020, that is “…pertaining to employees exposed to toxic substances or harmful physical agents.”

Toxic substances or harmful physical agents are defined as follows;

1910.1020(c)(13) “Toxic substance or harmful physical agent” means any chemical substance, biological agent (bacteria, virus, fungus, etc.), or physical stress (noise, heat, cold, vibration, repetitive motion, ionizing and non-ionizing radiation, hypo – or hyperbaric pressure, etc.) which:
- 1910.1020(c)(13)(i) is listed in the latest printed edition of the National Institute for Occupational Safety and Health (NIOSH) Registry of Toxic Effects of Chemical Substances (RTECS) which is incorporated by reference as specified in Sec. 1910.6; or
- 1910.1020(c)(13)(ii) has yielded positive evidence of an acute or chronic health hazard in testing conducted by, or known to, the employer; or
- 1910.1020(c)(13)(iii) is the subject of a material safety data sheet kept by or known to the employer indicating that the material may pose a hazard to human health. (Emphasis added by author).

The use of “or” clarifies that only one of the criteria need to be met. Based on the above, while subsections (c)(13)(i) and (c)(13)(iii) do not appear relevant, subsection (c)(13)(ii) appears to apply as SARS-CoV-2 has shown to result in acute health hazard, resulting in the disease COVID-19. Whether there is a chronic health impact remains to be seen given the novelty of this virus. That said, acute health impact appears sufficient to determine SARS-CoV-2 as a “toxic substance or harmful physical agent” for purposes of this analysis.

This alone doesn’t automatically place an employer in a 30-plus year requirement to retain employee medical records. What constitutes an “employee medical record” and “employee exposure record” for purposes of this regulation must be further understood before determining appropriate retention.

What are Employee Medical Records and Employee Exposure Records?

“Employee medical records” are defined in section 1910.1020(c)(6), and means a record concerning the health status of an employee that is made or maintained by a physician, nurse or other healthcare personnel, or technician, including: Medical and employment questionnaires or histories, the results of medical exams, lab test results, medical opinions/doctor’s recommendations, first aid records, employee medical complaints, and descriptions of treatment or prescriptions.

Section 1910.1020(d)(1)(i) goes on to specifically prescribes a minimum of a 30-plus year retention period as follows: “The medical record for each employee shall be preserved and maintained for at least the duration of employment plus thirty (30) years.”

“Employee exposure records,” are defined in subsection 1910.1020(d)(1)(ii), as: “Each employee exposure record shall be preserved and maintained for at least thirty (30) years,…”. Some exceptions are listed in this subsection for records relating to health insurance claims, first aid records and records relating to employees working less than one year.

What Constitutes Employee Exposure?

One must also look at what “employee exposure” means in light of this regulatory requirement to determine applicability of the 30-plus year retention.

1910.1020(c)(8) defines “exposure” or “exposed” to mean that an employee is subjected to a toxic substance or harmful physical agent in the course of employment through any route of entry (inhalation, ingestion, skin contact or absorption, etc.), and includes past exposure and potential (e.g., accidental or possible) exposure, but does not include situations where the employer can demonstrate that the toxic substance or harmful physical agent is not used, handled, stored, generated, or present in the workplace in any manner different from typical non-occupational situations.

Conclusion

Short of additional guidance issued by Department of Labor’s OSHA, ultimately this will likely be decided by the courts when the first lawsuit on this topic arises, known as decision via case law. What do employers do in the interim while these shades of gray are not yet adjudicated? It is recommended to err on the side of caution. Find ways to adjust your company’s record retention procedures and systems to be able to accurately retain these records for the duration of your employee’s employment plus 30 years.

Resources

OSHA Laws & Regulations. OSH Act of 1970. SEC 5. Duties. Retrieved from https://www.osha.gov/laws-regs/oshact/section5-duties
OSHA Standards. Part 1910, Standard 1910.1020. Retrieved from https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.1020
OSHA. Access to Medical and Exposure Records. (2001). U.S. Department of Labor, OSHA. Retrieved from https://www.osha.gov/Publications/pub3110text.html
U.S. Equal Employment Opportunity Commission. “What You Should Know About COVID-19 and the ADA, the Rehabilitation Act, and Other EEO Laws”. (Updated May 7, 2020). Retrieved from https://www.eeoc.gov/wysk/what-you-should-know-about-covid-19-and-ada-rehabilitation-act-and-other-eeo-laws. See A. 6 and B.1.

Tag Archives: return to work