What Should You Do When a Resident Has a Confirmed Case of COVID-19?

SITUATION: You just found out that Ann Smith, one of your residents, has tested positive for COVID-19 and is now in self-isolation for 14 days. You immediately report the case to the local health authorities. You post signs and notices in common areas alerting other residents that a building resident has been confirmed as having COVID-19. You tell maintenance staff who had contact with Ann in the past 48 hours that a resident they recently encountered has COVID-19 and advise them to get tested or go into precautionary self-isolation. Finally, you email Ann’s neighbors to tell them she has COVID-19 and advise them to stay away from her until she safely re-emerges from self-isolation.
QUESTION: Which of your response actions was illegal?
A.    Reporting Ann’s case to local health officials.
B.    Notifying maintenance staff that a resident has COVID-19.
C.    Posting signs and notices about somebody in the building having COVID-19.
D.    Telling the neighbors about Ann’s case and warning them to keep away.
ANSWER: D. All your actions were legal except for the emails disclosing Ann’s illness to the neighbors.
EXPLANATION: The fact that Ann has COVID-19 is what the Americans with Disabilities Act (ADA) and privacy laws refer to as protected health information (PHI). General rule: You can’t disclose PHI without the person’s consent. Exception: You don’t need consent if the disclosure:
•    Includes only the PHI necessary to accomplish that infection control purpose; and
•    Doesn’t cast a stigma or subject the person to discrimination.
All four of your disclosures served a legitimate COVID-19-related purpose, and three of the four satisfied the other two criteria justifying disclosure of Ann’s illness without her consent. But your email to the neighbors crossed the line because it identified Ann by name. You could have put the neighbors on notice by just revealing that a neighbor had COVID-19 without naming names.
Note that you can also get into trouble even without naming names to the extent the neighbors can piece together the information you do provide to identify Ann as the unnamed neighbor to which your notice refers. To help you avoid putting too much information in a notice, we’ve prepared a Model Notice: Notify Residents of Confirmed COVID-19 Case at Site, which you can adapt and use at your site.
One more thing: Warning the neighbors to keep away from Ann, while well intentioned, can also be interpreted as exposing her to stigma and discrimination. Therefore, D is the right answer.
 
Why Wrong Answers Are Wrong
A is wrong because notifying health officials of confirmed COVID-19 cases in your community is not only permitted but legally required, even without the person’s consent.
B is wrong because under current CDC guidelines, owners are supposed to notify maintenance and other staffers that a person with whom they’ve had close contact within the past 48 hours has COVID-19 because it alerts them to their own potential exposure; the other saving grace of that notification is that it didn’t name names.
C is wrong for the same reason as B. The CDC is advising owners who become aware of an infection in the community to post signs and notices warning other building residents but without disclosing names, apartment numbers, addresses, or other information that could be used to identify the person with COVID-19.
__________________________________________________________________________
MODEL NOTICE
Notify Residents of Confirmed COVID-19 Case at Site
Here’s the kind of discreet notice you can use to put residents on notice of a confirmed COVID-19 case at your site without violating the ill person’s privacy or causing a panic.
COVID-19 CASE NOTIFICATION TO RESIDENTS
We have recently learned that a resident of [Site Name] has tested positive for the COVID-19 coronavirus. We are not at liberty to reveal that individual’s name, unit number, floor, or any other information that could be reasonably used to determine his or her identity. We therefore kindly request that you not ask us to provide such details.
What we can tell you, though, is that the person has been advised and agreed to follow Centers for Disease Control (CDC) guidelines and remain in self-isolation for at least 14 days.
We are urging all residents to remain calm and follow CDC and state and local public health guidelines with regard to social distancing, hygiene and hand washing, the use of personal protective equipment, and quarantine and self-isolation.
We also wish to assure you that [Site Name] has and will continue to take extensive COVID-19 infection control measures, including regular and frequent cleaning and disinfection of common areas, including floors, surfaces, and door handles, handrails, elevator buttons, trash and recycling chutes, and other commonly touched objects.
Thank you for your understanding and for keeping in mind that COVID-19 is not a stigma or mark of shame and that those who contract it deserve our empathy, understanding, and kindness. Please be assured that we will share new information as it becomes available.
Stay strong, stay safe, and stay in communication with us, and we will all get through this pandemic together, united and stronger than before. Thank you.
[Site Name] Management
[Date]