COVID-19 is not sparing health care workers. As health care workers become infected, or suspicious for infection, questions arise for their provider employers about whether and how they should disclose an employee’s illness to the patients exposed to the sick employee. The question is particularly apt for health care providers that routinely have multiple transient interactions with patients, such as laboratory patient service centers, home health nurses, and walk-in medical clinics.

Unfortunately, there is little-to-no specific public health guidance addressing whether, when and how health care providers should disclose to patients that they have been treated by a person who likely has COVID-19. This leaves providers with cobbling together a policy or procedure from the principles and directives of generally applicable public health guidelines.

With clear answers and guidelines in short supply, this piece is intended to share suggested best practices on making such disclosures. Of course, there is no one-size-fits-all approach to addressing the relevant issues. The nature, scale and geographic scope of the practice issue will present practical concerns and limitations that must be considered. A non-exhaustive list is discussed here.

The Threshold Issue: Whether to Disclose

You operate a walk-in health care clinic or standalone primary care physician practice. Your triage nurse becomes symptomatic and later tests positive for coronavirus. Should you report this to the patients that were sufficiently exposed to the nurse?

The primary practical issue is whether the disclosure can be made to exposed patients within a meaningful time of employee “diagnosis,” which generally translates to within 12-13 days since the infected employee tested positive or showed symptoms of COVID-19. Generally, consensus remains that incubation and symptom manifestation will occur within 2-14 days of coronavirus infection. After the incubation window closes, the disclosure becomes less helpful because:

  1. the exposed patient, if infected, likely will have manifested symptoms and, thus, have experienced an independent reason to seek appropriate medical care
  2. the period during which the patient may be unknowingly infectious to others has ended or is near its end and, therefore, any countermeasures the patient may take are less likely to reduce community spread.

If the disclosure can be made in this window, the patient will have the opportunity to follow applicable guidance on symptom self-monitoring and how to avoid spreading the virus to others.

Who Should Get the Disclosure?

Although, the consensus is that coronavirus may take up to 14 days to incubate, there is little known about when a carrier is infectious or contagious to others. Applying the guidance in the CDC’s Public Health Recommendations for Community-Related Exposure, it may be appropriate to make a disclosure only to patients who were exposed to the infected health care employee within a couple of days of the employee becoming patently symptomatic of COVID-19.

Nonetheless, disclosing the infection to any patient with whom your employee had enough contact to pass on the virus up to 14 days before symptom onset would represent a reasonable and conservative approach. The other factor influencing which patients should receive a disclosure is the amount and nature of the contact the patient had with the ill employee.

Notifying patients that they were exposed to an infected health care worker within two days of the worker becoming symptomatic stems from the CDC guidelines for Community-Related Exposure—specifically the recommendation for managing persons that come within six feet of an infected person for a “prolonged period of time.” For this type of exposure, the guideline notes that the critical period of exposure risk likely begins 48 hours before the development of symptoms. (Before March 30, the CDC guideline used the onset of symptoms as the beginning of the critical risk period.)

Notwithstanding the uncertainty regarding the time during which an infected person can pass the virus to another, this guideline strongly suggests infection concerns are paramount within 48 hours of symptom manifestation. This would counsel disclosing the employee’s condition only to patients with whom the employee had contact two days before COVID-19 symptom onset. Using the 48-hour standard will tend to reduce the number of disclosures that need to be made and, thus, may be better suited to entities with high patient volume and correspondingly shorter patient-provider interactions. Other WHO and CDC guidelines similarly suggest that exposure to infected persons within 48 hours of symptom onset is the critical period for patient surveillance, tracking and management.

The 14-day disclosure standard derives from multiple directives on the general incubation period for coronavirus and related guidance on sidelining health care workers exposed to patients with coronavirus for two weeks after exposure. The 14-day disclosure standard is also consistent with the continued uncertainty surrounding when coronavirus carriers are likely infectious.

The CDC’s answers to FAQs for health care providers specifically notes that: “The onset and duration of viral shedding and the period of infectiousness for COVID-19 are not yet known. ... Based on existing literature, the incubation period (the time from exposure to development of symptoms) of SARS-CoV-2 and other coronaviruses (e.g. MERS-CoV, SARS-CoV) ranges from 2–14 days.”

Accordingly, using a 14-day disclosure period is the most patient and community protective approach but may pose problems for large providers who may need to make hundreds or even thousands of disclosures across their organization if they were to use such a standard.

Relatedly, the nature and duration of the exposure may be relevant in determining which patients should receive the disclosure. If the infected employee’s exposure to a patient is fleeting, it is possible no disclosure would be required at all or the 48-hour standard may be enough.

The CDC’s Community-Related Exposure guidance cited above proposes quarantine and enhanced social distancing, among other disease conveyance countermeasures, when a person spends a “prolonged period of time” less than six feet away from the infected person. The notes to the CDC guidance explain that a prolonged period generally constitutes 10-30 minutes with a person that is not known to be infected at the time. Additional notes suggest 2-3 minutes of exposure to a person known to be ill (as is the case when a health care worker is exposed to an infected patient) may be enough to trigger the quarantine and enhance social distancing recommendations included in the guideline.

As such, if the employee was known to be symptomatic during the time the patient was exposed to them, a shorter exposure would warrant disclosure of the employee’s condition to the patient.

What Should the Disclosure Look Like?

Although HIPAA does not apply to an employer’s handling of health information relative to its employees, general confidentiality concerns controlling the employer-employee relationship – including those imposed by the Americans with Disabilities Act – dictate that the disclosure should not include the name, title, job function, gender or other information that would allow the patient receiving the disclosure to identify the employee. Guidance on complying with the requirements of the ADA in the context of a pandemic can be found on the Equal Employment Opportunity Commission’s website.

Next, unless the health care provider unequivocally has a physician-patient relationship with the recipient of the disclosure, it should not provide direct medical guidance or advice to the patient. Rather, it should identify the date of the exposure and the known status of the employee (test positive, presumptively positive, etc.) and direct the patient to standard industry guidance on how the patient should respond, while recommending follow-up with a physician for answers to any questions. Finally, the disclosure should include any language or directives required by state or local health departments (more on this below).

Other Issues

Health care providers embarking on a disclosure to exposed patients may also be well served to consult with local and state health departments with jurisdiction over the area where the employee resides. Many state and local health departments are running active COVID-19 surveillance and investigation operations. It is possible that the relevant health department already will have received information relating to the employee’s condition and have taken action to notify persons exposed to him or her. The health department may even be able to inform you that the employee has actually turned out to be test-negative for coronavirus (an actual outcome for one firm client).

It is also possible that local health departments will have developed a protocol for providers to follow when making such a disclosure. Moreover, some health departments have requested copies of the disclosure to add to their respective call center databases to assist with patient management and guidance if they were to call.

Finally, although there are concerns with increasing the provider’s exposure to lawsuits by making such a disclosure, there is a countervailing concern about increased liability for failing to disclose. Moreover, as the disease spreads, claims against a health care provider by a patient for exposing him or her to coronavirus injuries become more challenging due to the difficulty in proving causation (that the ultimate origin of the patient’s infection was the provider’s employee).


Employees of health care providers are now being routinely diagnosed with COVID-19. Many health care employers will feel a special urgency to reach out to their patients who were exposed to coronavirus in their facilities to preserve the health of their patients and the community they serve. There is little instructive guidance for making these disclosures, including what should be said and to whom, but the best practices above, which are based largely on CDC directives and our experiences to date, provide a reasonable methodology for making such disclosures.