Workplace testing for COVID-19: guidance for employers

For employers looking to introduce an internal COVID-19 testing programme outside of the NHS service, the government has set out some guidance. This covers issues to consider before introducing a testing regime; the different types of testing available; how the testing process will work in practice; and how to handle test results.

The guidance applies to England only, but equivalent guidance is to be published for Scotland, Wales and Northern Ireland.

What do we need to consider before deciding to test staff?

Before implementing a testing programme, consider the following issues:

• Who will the testing cover – just employees or anyone working onsite? Will it apply to all staff or just certain groups? Will it apply to those with or without symptoms? How will you deal with agency workers and contractors?
• How often will staff be tested?
• Do you have appropriate testing facilities?
• What type of test will be used? If a third party is providing the testing services, have you carried out diligence and put in place an appropriate contract?
• How will you use the test results? Do you have staff that have been properly trained in handling health data?
• What policies need to be updated to deal with, for example, handling health information, absence from work and self-isolation?
• What will you do if individuals refuse to be tested?
• Is the proposed programme compatible with your employment, data protection and health and safety obligations?

Communicating with staff prior to starting a testing programme

The guidance emphasises that it is important to be as transparent as possible about any new internal testing programme before it begins. Communications with the workforce should include clear information on the purpose of the testing; whether or not it will be mandatory; what happens after the results are received, what support will be available throughout the process; and what the consequences will be of failing to agree to take a test.

In addition, in order to comply with your data protection obligations, staff being tested should be given details of what data will be collected; how long it will be kept for and where; and on how and with whom their data may be shared. This could be in an updated privacy notice or a COVID-19 testing policy.

The guidance strongly advises employers to consult with staff associations or trade unions before implementing a testing policy. This is likely to help deal with any initial issues, and their support would obviously make the introduction of any regime easier.

Data protection obligations

Although data protection law does not stop you from testing employees for COVID-19, workplace testing will only be appropriate in specific circumstances (see the ICO guidance and our earlier blog). It's therefore essential to carefully consider the data protection issues before commencing a testing programme.

In summary, in addition to the requirement to communicate with staff on the processing issues noted above, you must:

• Undertake a data protection impact assessment in advance of the start of the testing programme (because testing employees for COVID-19 amounts to processing health information which is special category personal data). This will help identify whether the proposed testing programme is fair and lawful, the potential risks and what further policies, procedures, and notices are required.
• Identify what objectives the testing is designed to achieve; and then consider if testing is necessary to achieve those objectives. Is testing a proportionate way to address the risks identified in your health and safety risk assessments, or could less intrusive measures be used?
• Consider what the legal basis is for processing the data associated with the tests. This will most likely be compliance with employer health and safety obligations, but each organisation will need to reach its own conclusion on this. Whether testing is necessary will depend on the risks and options for mitigating those risks. Testing may be necessary for compliance with health and safety obligations for one group of employees, but not another. Different considerations will apply if testing is also offered to individuals living in the same household as your staff.
• Keep test results secure and disclose them to as small a group as possible. Develop appropriate policies and protocols for this.

Selecting the appropriate type of testing kit

The guidance contains information and links to further details on the following issues:

• The difference between virus and antibody testing
• Selecting and procuring test kits
• Collecting COVID-19 samples to test – both point of care tests and self-administered/assisted sampling tests
• Handling samples in transit
• Minimum standards for laboratory facilities
• Using technology to capture and disseminate results
• Collecting results

You will want to ensure that these issues are addressed in your contract for the supply of testing kits and testing services.

Communicating test results

• Before taking a test, if should be clear to employees what happens with their test results; and who they will be shared with, why and when.
• Test results should ideally be communicated by a healthcare professional, or someone in occupational health or HR who is subject to confidentiality restrictions and has had training on handling health information. If, however, results are communicated via text message or an app, the healthcare professional (or appropriate person) should be accessible to staff.
• It's good practice for test results to be accompanied by clear information on what they mean and guidance on what happens next. If an individual tests positive they must self-isolate in accordance with current guidance.
• Public health authorities must be notified by the laboratory carrying out the test if a member of staff has a positive virus test result. NHS Test and Trace (in England) or NHS Test and Protect (in Scotland) will then contact the individual to collect information about their recent contacts.
• If there is more than one case of COVID-19 on the premises, you are required to contact the local Health Protection Team.
• The guidance encourages employers to keep staff informed about potential and confirmed COVID-19 cases but makes it clear that individuals should not be named.

Can we introduce internal contact tracing or use contact tracing technology?

It is an option to introduce an internal tracing system alongside an internal testing programme. However, bear in mind that:

• An individual who has been identified as a contact via an internal contact tracing system is not defined as a contact in terms of NHS Test and Trace / Test and Protect. This means that they would not qualify for statutory sick pay (unless they were also contacted by NHS Test and Trace / Test and Protect). The guidance suggests in these circumstances you should arrange for the employee to work from home or, if that is not possible, to keep them on full pay unless their contract of employment specifically provides otherwise.
• An individual who has been identified as a contact via an internal contact tracing system, who doesn't have COVID-19 symptoms, or a positive test result, is not required to self-isolate until contacted by NHS Test and Trace / Test and Protect. Instead they are advised to take extra care practising social distancing and good hygiene; and avoid contact with people at high increased risk of severe illness from coronavirus.
• Contact tracing activities will involve the processing of personal data, and therefore need to be carried out in accordance with data protection law.
• The advice is not to attempt to trace any contacts beyond the workplace.

Employers may also be tempted to require employees to download NHS contact tracing apps or to use proximity wristbands or other monitoring technology to enforce social distancing within the workplace. We consider the data protection and employment law issues in this blog.

What about temperature checking or using thermal cameras?

The guidance issued by the government does not cover temperature checks or the use of thermal cameras as a means of testing staff. It notes that there is little scientific evidence to support them as reliable methods of detecting COVID-19.

The data protection considerations outlined above may also apply to these forms of workplace testing depending on how the checks are carried out; and as part of that you would need to consider whether the same results could be achieved through other less privacy intrusive means.

What can we do if an employee refuses to take a test?

Obtaining consent is the ideal from an employment law perspective. However, some employees may be reluctant to agree on the basis that it is an unnecessary intrusion of privacy, particularly if they are not exhibiting symptoms and there are other ways to minimise the spread of infection (e.g. effective social distancing at work).

If an individual refuses to take a test, the reason for withholding consent should be explored: is it financial, medical or as a 'point of principle'? Re-iterate the reasons for and benefits of the testing; and provide information about sick pay during self-isolation. Medical objections might have to be referred to HR/occupational health; and there may be additional considerations for those with disabilities.

If the refusal is unreasonable, and testing is clearly justified, as a last resort it may be possible to discipline the employee on the basis that they have failed to follow a reasonable management instruction intended to protect health and safety.

For more information on any of the above, or for assistance with drafting staff communications / policies or carrying out an impact assessment, please contact a member of the employment and immigration team, or Martin Sloan (IP, Technology and Data) .