On November 12, 2020, the United States District Court for the Eastern District of Virginia granted the Defendant’s Motion to Dismiss a claim based upon an accusation that the Plaintiff was wrongly terminated after failing to give COVID-related information. The Court held that the Plaintiff/Employee was not directed to violate HIPAA when the Defendant/Employer asked him to disclose the COVID-test results of his family members.

This matter arose in late March of 2020, when the Plaintiff, Christopher Wells, was contacted by the HR Manager of the Defendant, Enterprise Leasing, and informed that the HR Manager received an anonymous complaint that Mr. Wells had been exposed to a family member who had tested positive for COVID-19. Mr. Wells informed the HR Manager that he had planned to be tested during the following week, when he was not scheduled to work. The HR Manager asked Mr. Wells to keep Enterprise advised of his test results. The Plaintiff refused to provide the results of his family members’ tests. Enterprise subsequently terminated Mr. Wells for gross insubordination as he had failed to provide the requested information.

Following his termination, Mr. Wells filed suit, claiming that he was wrongfully terminated under Virginia law. His claim is based upon the assertion that he was terminated for refusing to violate HIPAA at the request of his employer. In response, Enterprise filed a motion to dismiss for failure to state a claim, asserting that their inquiry into Mr. Well’s COVID-status did not create a violation of HIPAA for either party.

The Court ruled in favor of Enterprise, finding that the Plaintiff was not a “covered entity” under HIPAA. In short, HIPAA, prevents covered entities (health care providers, health plans, and health care clearing houses) from disclosing identifiable protected health information, without authorization. As HIPAA applies only to covered entities and the Plaintiff is not a covered entity, it cannot be the case that the Employer’s request of COVID information caused him to violate HIPAA.

Mr. Wells also argued that even if he is not a covered entity, he could be found indirectly criminally liable for disclosing the protected information to his Employer as requested. While the Court found that the information sought was protected, the Plaintiff still did not state a claim upon which relief can be granted as Mr. Wells could not have been found criminally liable in this matter. HIPAA imposes criminal liability on those who directly obtain, from a covered entity, the individually identifiable health information of a third party and then disclose it with that party’s consent or authorization. As the Plaintiff is not an employee of a covered entity and has no relationship with a covered entity, the Plaintiff could not be found criminally liable for aiding and abetting an improper disclosure by a covered entity.

Further, Mr. Wells could not be subject to criminal liability for voluntarily disclosing his own medical information to Enterprise. The Court notes that Enterprise did not command or coerce Mr. Wells to disclose the information, but only asked Mr. Wells to keep them advised of his status. Additionally, the Court noted that Enterprise did not command or coerce Mr. Wells to disclose the family members’ test results without the consent of the family members.

The Plaintiff’s claim of wrongful termination failed as Enterprise did not terminate him due to his refusal to engage in a criminal act. While Virginia is an at-will employment state, there are still various situations in which a termination can be found contrary to public policy and therefore illegal. A termination based on an employee’s refusal to violate state law would qualify as an illegal termination under Virginia law. In this matter, as it was found that Mr. Wells could not have been prosecuted for complying with the requests of Enterprise, the subsequent termination for his refusal to do so was not illegal.

When seeking COVID-status information from your employees, it might be suggested to ask only for the employee’s status and if the employee had been exposed to anyone who had a positive status. Seeking a voluntary disclosure from the employee should keep you clear of HIPAA-related issues. Additionally, your inquiries about exposures to COVID-positive individuals should focused only on the employee. Ask only if the employee’s COVID status could have been compromised by his contact with ANYONE else. Do not ask the employee to identify the individuals that have a COVID-positive status.

If you have questions about this article, please contact Sean Mackin (smackin@setlifflaw.com) at 804-377-1272 or Steve Setliff (ssetliff@setlifflaw.com) at 804-377-1261.