Implications of New EEOC Guidance on Employers Requiring COVID-19 Testing

Background.  The EEOC has a role in the novel coronavirus pandemic because it enforces anti-discrimination laws, including the Americans with Disabilities Act (“ADA”).  The ADA substantially limits an employer’s ability to make medical inquiries and conduct medical examinations, including actions such as taking employees’ temperatures or requiring them to provide body fluid or other samples for testing.  However, there is an exception that applies when employers have a reasonable belief that employees have a medical condition that poses a “direct threat” to themselves or to others.

COVID-19 testing is now allowed.  As the coronavirus pandemic has progressed, the EEOC has repeatedly updated its guidance regarding what medical inquiries and medical examinations employers can require.  On April 23, 2020, the EEOC updated its guidance to allow employers to require a COVID-19 test before permitting employees to enter the workplace.  This follows previous guidance issued March 17, 2020 allowing employers to take employees’ temperatures during the novel coronavirus pandemic.

Implications of COVID-19 testing for employers.

  • The test administered must be safe and accurate, and such tests are currently in short supply.
  • Who will pay for cost of the test and whether employees will be paid for time spent traveling to a test site and for time spent getting tested should be determined prior to requiring testing.
  • The decision on who to test must be “job related and consistent with business necessity.”  For example, testing all employees who enter the workplace because an employee with COVID-19 would be a direct threat to the health of others is acceptable.  Being selective in who to test (e.g., hourly workers but not salaried workers) would not be acceptable unless the determination was “job related and consistent with business necessity.”  Testing based on criteria such as age, national origin, or parental status would not be acceptable.
  • Even if accurate, a negative test is only a snapshot in time.  An employee who tests negative today could have COVID-19 tomorrow.
  • If undertaken, testing should be part of a broader structure of policies and procedures for maintaining a safe workplace, not an ad hoc decision.
  • If employees are covered by a collective bargaining agreement, COVID-19 testing would be a subject of bargaining.
  • Public sector employees in Washington State have a right to privacy that requires balancing the government’s “compelling interest” in testing “based in the necessities of national or community life such as clear threats to public health, peace, and welfare.” Robinson v. City of Seattle, 102 Wn. App. 795, 10 P.3d 452, 467 (2000) (drug testing).  Thus, any testing program for public sector employees should document that the employees need to be tested because their duties will genuinely implicate public safety. 10 P. 3d at 470.

Reasonable accommodations.  The updated EEOC guidance also answers questions about accommodating employees at high risk for complications of COVID-19, accommodating employees with existing mental health conditions that are exacerbated by the novel coronavirus pandemic, and modifying accommodations that employers had in place prior to the pandemic because the accommodations do not apply to the employees’ current work environment or because the accommodations now place an undue burden on the employer.

More changes likely as employees return to work.  The EEOC recognizes the changing dynamics of the pandemic, and it has emphasized that “The EEO laws, including the ADA and Rehabilitation Act, continue to apply during the time of the COVID-19 pandemic, but they do not interfere with or prevent employers from following the guidelines and suggestions made by the CDC or state/local public health authorities about steps employers should take regarding COVID-19  . Employers should remember that guidance from public health authorities is likely to change as the COVID-19 pandemic evolves. Therefore, employers should continue to follow the most current information on maintaining workplace safety.

The EEOC’s updated guidance is online at

Please keep in mind that the above is an overview of a complex topic that is constantly changing, and that the information in this email may become outdated very quickly.  If you have a specific concern, you should seek legal advice and not rely on this article.  For more information, contact in our Seattle office or or in our Wenatchee office.

Additional state law rights  for employees at high risk for coronavirus complications

On April 13, 2020, Governor Inslee issued Proclamation 20-46, which provides additional rights and protections for workers at high risk for coronavirus complications, effective through (at least) June 12, 2020.  To summarize, all Washington State employers – public and private – must:

  1. Use all available options for alternative work assignments to protect high-risk employees, if requested, from exposure to the COVID-19 disease, including but not limited to telework, alternative or remote work locations, reassignment, and social distancing measures;
  2. Permit any high-risk employee to use any available employer-granted accrued leave or unemployment insurance in any sequence at the discretion of the employee if there is no feasible alternative work arrangement;
  3. Fully maintain all employer-related health insurance benefits until the employee is deemed eligible to return to work if the employee’s paid time off exhausts during the period of leave; and
  4. Not take any adverse employment action against an employee for exercising their rights under this Proclamation that would result in loss of the employee’s current employment position by permanent replacement.  However, employers can hire temporary employees so long as it does not negatively impact the permanent employee’s right under this Proclamation to return to their employment position without any negative ramifications to their employment status.

In addition to the four requirements above:

  • Employers and labor unions cannot apply or enforce any employment contract provisions that contradict or otherwise interfere with the items listed above.
  • Employers can require an employee who does not report to work based on this Proclamation to give up to five days’ advance notice to the employer of any decision to report to work or return to work under this Proclamation.
  • Employers can take employment action when no work reasonably exists, such as in a circumstance of a reduction in force, for a high-risk employee during this Proclamation. However, if no work exists, employers shall not take action that may adversely impact an employee’s eligibility for unemployment benefits.
  • Violators of this order may be subject to criminal penalties pursuant to RCW 43.06.220(5).

“High-risk” employees, for purposes of this Proclamation, has the meaning described or defined in guidance issued by the Centers for Disease Control and Prevention.  The CDC’s guidance is online at  It currently includes:

  • People 65 years and older
  • People who live in a nursing home or long-term care facility
  • People of all ages with underlying medical conditions, particularly if not well controlled, including:
    • People with chronic lung disease or moderate to severe asthma
    • People who have serious heart conditions
      • People who are immunocompromised Many conditions can cause a person to be immunocompromised, including cancer treatment, smoking, bone marrow or organ transplantation, immune deficiencies, poorly controlled HIV or AIDS, and prolonged use of corticosteroids and other immune weakening medications
    •  People with severe obesity (body mass index [BMI] of 40 or higher)
    • People with diabetes
    • People with chronic kidney disease undergoing dialysis
    • People with liver disease

The above is a summary only for general information and is not legal advice, and it is subject to change at any time.  If you would like more information about Proclamation 20-46 or other issues related to the impact of coronavirus on the workplace, feel free to contact,, or in our Seattle office; or or in our Wenatchee office.

FCC Telehealth Funding Available – Apply Today!

Elana Zana (

Starting at 9 AM Pacific on April 13, 2020, the FCC will begin to accept applications for its COVID-19 Telehealth Program, funded by $200 million dollars allocated by the CARES ACT. This program will fully fund telecommunications services, information services, and devices necessary to provide critical connected care services.

The FCC does not expect to award more than $1 million to any single applicant. Healthcare providers may use the funds for purchases made on or after March 13, 2020, and such funds may be used for monthly recurring charges through September 30, 2020.

Applicants must obtain (1) an eligibility determination from the Universal Service Administrative Company (USAC); (2) an FCC Registration Number (FRN) through CORES –; and (3) register with System for Award Management – The healthcare provider sites which the USAC has already deemed eligible to participate in the Rural Health Care Programs may rely on that determination for this program. Applicants that have yet to receive an eligibility determination from the USAC may still apply while the USAC reviews the FCC Form 460.

The Telehealth Program allows participation of the following types of healthcare entities: (1) postsecondary educational institutions offering health care instruction, teaching hospitals, and medical schools; (2) community health centers or health centers providing health care to migrants; (3) local health departments or agencies; (4) community mental health centers; (5) not-for-profit hospitals; (6) rural health clinics; (7) skilled nursing facilities; and (8) consortia of health care providers consisting of one or more entities falling into the first seven categories.

The FCC provided the following examples of eligible services and devices:

  • Telecommunications Services and Broadband Connectivity Services: Voice services, and Internet connectivity services for health care providers or their patients.
  • Information Services: Remote patient monitoring platforms and services; patient reported outcome platforms; storage and forwarding services, such as asynchronous transfer of patient images and data for interpretation by a physician; platforms and services to provide synchronous video consultation.
  • Internet Connected Devices/Equipment: tablets, smart phones, or connected devices to receive connected care services at home (e.g., broadband enabled blood pressure monitors; pulse-ox) for patient or health care provider use; telemedicine kiosks/carts for health care provider site.

The FCC application will include the following categories (including how telehealth funding can help free up resources that can then be used to treat COVID-19 patients):

Types of medical services:

  • Patient-Based Internet-Connected Remote Monitoring
  • Other Monitoring (e.g. pulse-ox, BP monitoring)
  • Video Consults
  • Voice Consults
  • Imaging Diagnostics
  • Other Diagnostics
  • Remote Treatment
  • Other Services

Note that the Program will only provide funding for monitoring devices that are connected, not devices that patients can use at home and then share the results with their healthcare provider remotely. The FCC will not require applicants to purchase only those services or devices identified in their applications. Health care providers may use funds to purchase any necessary eligible services and connected devices. Further, applicants may request additional support funds after they have exhausted the initial award.

Conditions to be awarded funds under this Program funding include:

  • Whether the applicant will treat COVID-19 patients directly
  • Whether the applicant will treat patients without COVID-19 symptoms or conditions (applicants will check all that apply):
    • Other infectious diseases
    • Emergency/Urgent Care o Routine, Non-Urgent Care
    • Mental Health Services (non-emergency)
    • Other conditions
  • How using the COVID-19 Telehealth Program funding to treat patients without COVID-19 symptoms or conditions would free up resources that will be used to treat COVID-19.

The FCC Order on April 2, 2020 also launched the Connected Care Pilot Program “to help defray health care providers’ qualifying costs of providing connected care services, with a primary focus on providing these services to low-income or veteran patients.” The funding of this program includes $100 Million over three years, and will cover 85% of the eligible costs of broadband connectivity, network equipment, and information services necessary to provide connected care services to the intended patient population. Applications for this Pilot Program are not due for 45 days from the effective date of the Pilot Program rules, or 120 days from the release date of the FCC order (whichever is later).

For more information about applying for funding, deploying telecommunications services (including software, fiber, and DAS contract review), and telehealth, please contact Elana Zana at 206-442-1308 or

Relevant Resources:

FCC Webinar & Application Materials on COVID-19 Telehealth Program: telehealth-program

FCC Guidance on COVID-19 Telehealth Program: 394A1.pdf

FCC Form 460:

FCC Order (April 2, 2020):

New CDC Guidance on Keeping #Coronavirus-Exposed Employees Working and Possible Impacts on Paid Emergency Sick Leave

As of April 8, 2020, the CDC is advising that critical infrastructure workers remain working after actual or potential coronavirus exposure.  The advisement includes protective measures that such workers are to take and provides for them to go home immediately if they develop coronavirus symptoms.   The new interim guidance applies to workers in all 16 sectors that are considered critical infrastructures.  The interim guidance is online at, and it states, in part, as follows:

To ensure continuity of operations of essential functions, CDC advises that critical infrastructure workers may be permitted to continue work following potential exposure to COVID-19, provided they remain asymptomatic and additional precautions are implemented to protect them and the community.

A potential exposure means being a household contact or having close contact within 6 feet of an individual with confirmed or suspected COVID-19. The timeframe for having contact with an individual includes the period of time of 48 hours before the individual became symptomatic.

Critical Infrastructure workers who have had an exposure but remain asymptomatic should adhere to the following practices prior to and during their work shift: Critical Infrastructure workers who have had an exposure but remain asymptomatic should adhere to the following practices prior to and during their work shift:

  • Pre-Screen: Employers should measure the employee’s temperature and assess symptoms prior to them starting work. Ideally, temperature checks should happen before the individual enters the facility.
  • Regular Monitoring: As long as the employee doesn’t have a temperature or symptoms, they should self-monitor under the supervision of their employer’s occupational health program.
  • Wear a Mask: The employee should wear a face mask at all times while in the workplace for 14 days after last exposure. Employers can issue facemasks or can approve employees’ supplied cloth face coverings in the event of shortages.
  • Social Distance: The employee should maintain 6 feet and practice social distancing as work duties permit in the workplace.
  • Disinfect and Clean work spaces: Clean and disinfect all areas such as offices, bathrooms, common areas, shared electronic equipment routinely.

This interim guidance pertains to critical infrastructure workers, including personnel in 16 different sectors of work including:

  • Federal, state, & local law enforcement
  • 911 call center employees
  • Fusion Center employees
  • Hazardous material responders from government and the private sector
  • Janitorial staff and other custodial staff
  • Workers – including contracted vendors – in food and agriculture, critical manufacturing, informational technology, transportation, energy and government facilities

The list of all 16 of the critical infrastructures is online at: Though not specifically referenced in the interim guidance, the list of all 16 critical infrastructures includes health care workers.

This interim guidance may impact employees’ eligibility for compensation under the Emergency Paid Sick Leave Act (EPSLA) where “The employee has been advised by a health care provider to self-quarantine due to concerns related to COVID-19” if the health care provider’s advice cited the old CDC guidance as the reason to self-quarantine. The EPSLA is online at

This interim guidance is subject to change at any time, as are the criteria for eligibility for compensation under the EPSLA.

This post is not legal advice, and should not be relied on.  For more information, please contact Karen Sutherland (, Beth Van Moppes (, or VaLiesha Brown ( in our Seattle office, or Erin McCool ( or Gil Sparks ( in our Wenatchee office.

EEOC Updates What You Should Know About COVID-19 and the ADA, the Rehabilitation Act, and Other EEO Laws

On Thursday afternoon, April 9, 2020, the EEOC issued expanded guidance on a variety of COVID-19-related workplace issues in a question and answer format. The expanded guidance clarifies issues regarding acceptable inquiries regarding COVID-19 symptoms, employer responsibilities regarding confidentiality of medical information obtained from employees, and duty to accommodate disabilities, including mental health issues, during the pandemic. The expanded guidance can be found at:

Some key points from the expanded guidance include:

  • When screening employees entering the workspace, employers may ask employees about COVID-19 related symptoms identified by the EEOC, the CDC, other public health authorities, or other reputable medical sources for guidance on emerging symptoms associated with the disease because the list of associated symptoms is subject to change.
  • Employers may store COVID-19 related medical files, including statements of employees, in existing medical files, separate from personnel files, as long as confidentiality requirements are met.
  • Logs of daily temperature checks, if kept, must be maintained confidentially.
  • Employers may disclose the names of employees with COVID-19 to public health agencies.
  • Temporary staffing agencies may disclose the names of employees who have tested positive for COVID-19 to employers with whom the employee was placed.
  • Employers may not unilaterally postpone start dates or withdraw job offers from individuals because the employee is at high risk from COVID-19.
  • Employers have some duty to explore reasonable accommodations for individuals with disabilities that place them at higher risk for COVID-19 to allow those employees to perform work at the worksite.
  • Employers have some duty to explore reasonable accommodations for employees with preexisting mental health conditions that may be exacerbated by the pandemic.
  • Employers have a continued duty to accommodate and engage in the interactive process for employees with disabilities unrelated to COVID-19.
  • Employers can help reduce pandemic-related harassment by clearly communicating that fear of the COVID-19 pandemic should not be misdirected against individuals because of a protected characteristic, including their national origin or race.

This information should not be construed as legal advice. you have questions about the EEOC guidance or other COVID-19 employment related issues, please seek appropriate legal advice from one of our employment law attorneys. At our Wenatchee Office, please contact Erin McCool ( or Gil Sparks ( At our Seattle Office, please contact Karen Sutherland (, Beth Van Moppes (, or VaLiesha Brown (

Expansion of Washington state unemployment eligibility criteria (retroactive to March 23, 2020)

The State of Washington adopted an emergency rule on April 8, 2020 that broadens eligibility for unemployment benefits.  The emergency rule, which we originally posted on April 9, was the subject of a technical correction on April 10, 2020 to address a grammatical issue.  The updated rule is posted below:

WAC 192-150-101 Job separations related to COVID-19. For individuals who became unemployed on or after March 23, 2020, the individual will be considered to have been laid off due to a lack of work when:

  1. (a) The individual was prohibited by a government official from working outside their home or place of residence as a result of COVID-19; and (b) The individual does not have the ability to telework with pay; or
  2. (a) The individual was not prohibited by a government official from working outside their home or place of residence as a result of COVID-19; and
    (b) The individual is either:
    (i) A person identified by the centers for disease control as someone at high-risk for severe illness from COVID-19;
    (ii) In the same household as a person identified by the centers for disease control as someone at high-risk for severe illness from COVID-19;
    (iii) Providing direct care to a person identified by the centers for disease control as someone at high-risk for severe illness from COVID-19; or
    (iv) Working at a worksite outside of the individual’s home or place of residence that does not follow rules or guidelines published by the United States Department of Labor, the Washington department of labor and industries, or the Washington department of health for protecting workers from COVID-19 exposure; and
    (c) The individual does not have the ability to telework with pay.

These new eligibility requirements are broader than the federal unemployment criteria under the FFCRA, so individuals who fit under subpart (2) of the Emergency Rule may not be eligible for the extra federal unemployment benefits* but they would be eligible for the regular state unemployment benefits.  Here is a link to ESD’s most recent guidance, but it may not be current (check back periodically for updates):  Please keep in mind that the rules and interpretation are subject to change at any time, and that the forms employers and employees receive from ESD when someone applies for unemployment may not be current.

*To be eligible for the additional federal unemployment benefits, someone at high risk would have to meet the following criteria:

(a) In General.–An employer shall provide to each employee employed by the employer paid sick time to the extent that the employee is unable to work (or telework) due to a need for leave because:

  1. The employee is subject to a Federal, State, or local quarantine or isolation order related to COVID-19.
  2. The employee has been advised by a health care provider to self-quarantine due to concerns related to COVID-19.
  3. The employee is experiencing symptoms of COVID-19 and seeking a medical diagnosis.
  4. The employee is caring for an individual who is subject to an order as described in subparagraph (1) or has been advised as described in paragraph (2).

This posting is for general information only, and is not legal advice.  For additional information, contact Karen Sutherland (, Beth Van Moppes (, or VaLiesha Brown ( in our Seattle office, or Erin McCool ( or Gil sparks ( in our Wenatchee office.

COVID-19 and Substance Abuse Records: Key Changes to 42 CFR Part 2 Requirements under the CARES Act

By Casey Moriarty


The recently enacted CARES Act includes important updates to the requirements governing the confidentiality of substance use disorder records under 42 CFR Part 2 (“Part 2”), including the following:

  1. Disclosures for Treatment, Payment, and Health Care Operations: After initial patient consent, the Cares Act permits substance use disorder programs, covered entities, and business associates to disclose Part 2 records for treatment, payment, and health care operations purposes as permitted by HIPAA without the need for additional consents from the patient. Below are examples illustrating a Part 2 program’s permissible disclosures upon receiving patient consent.

Treatment: The program may disclose the patient’s records as needed to any health care provider for the patient’s treatment, as permitted by HIPAA. There is no longer a requirement for the program to obtain the patient’s consent for the disclosure of records to each separate provider who may need to receive the records for treatment purposes.

Payment: The program can disclose the records to the patient’s current and future health insurers to obtain payment for services rendered as permitted by HIPAA.  There is no longer a need for the program to obtain patient consent for the disclosure of records to each specific insurer.

Health Care Operations: As permitted by HIPAA, the program can disclose the records for quality assurance or peer review purposes to another health care provider who has (or has had) a treatment relationship with the patient. Again, there is no need for the patient to consent to the disclosure to each provider.

While these changes certainly increase the ability of providers to disclose patient records, they also raise questions that need to be addressed in future regulations, including the following:

  • If substance use disorder records are disclosed in accordance with patient consent for a treatment, payment, or health care operations purpose, are the records still subject to Part 2 or are they only subject to HIPAA requirements?

This is a critical question because Part 2’s confidentiality protections are still greater than those in HIPAA, including stricter requirements on disclosures to family members of patients and disclosures related to court proceedings.  If Part 2 requirements continue to apply to the records after a disclosure for a treatment, payment, or health care operations purpose, providers need to continue segregating Part 2 records from other types of patient health information in order ensure that such records are not improperly disclosed in violation of Part 2.

  • Does a written patient consent for disclosure of records for treatment, payment, or health care operations need to list each of the intended recipient(s) of the records?

Current Part 2 regulations state that a written consent must list the permitted “recipient(s)” of the records. However, after a patient has signed an initial consent, the CARES Act appears to allow records to be broadly disclosed to any recipients for a treatment, payment, and health care operations purpose as permitted by HIPAA. Future regulations need to clarify whether a consent permitting disclosure of records for the purposes of treatment, payment, and/or health care operations must list permitted recipient(s) of the records.

  • Does the Part 2 notice prohibiting re-disclosure need to accompany records that are disclosed in accordance with patient consent for a treatment, payment, or health care operations purpose?

Future Part 2 regulations need to clarify whether the notice stating “42 CFR Part 2 prohibits unauthorized disclosure of these records” must be included with each disclosure of records for a treatment, payment, or health care operations purpose. Current Part 2 regulations require that this notice accompany each disclosure of substance use disorder records made with patient consent

  1. Disclosures to Public Health Authorities: The CARES Act permits a substance use disorder program to disclose patient records to a public health authority if the records have been de-identified in accordance with HIPAA requirements. On the surface, this change does not appear to be substantive because de-identified information technically is not subject to Part 2 disclosure restrictions in the first place.
  1. Use of Records in Court Proceedings: The CARES Act emphasizes the regulatory restrictions on the disclosure of substance use disorder records in criminal, civil, administrative, or legislative proceedings without patient consent or a court order. In addition, without patient consent or a court order, such records may not be used by law enforcement to conduct investigations, to apply for a warrant, or for other law enforcement purposes.
  1. Anti-Discrimination: The CARES Act prohibits any entity from discriminating against an individual based on substance use disorder records that the entity may have received through an inadvertent or intentional disclosure of such records. This includes discrimination related to (a) denying admission, access to, or treatment for health care; (b) hiring, firing, or terms of employment, or receipt of worker’s compensation; (c) the sale, rental, or continued rental of housing; (d) access to Federal, State, or local courts; or (e) access to, approval of, or maintenance of  social services and benefits provided or funded by Federal, State, or local governments.
  1. Breach of Records: The CARES Act incorporates the HIPAA breach notification rule requirements into the Part 2 statute. Therefore, substance use disorder programs must comply with the HIPAA Breach Notification Rule requirements when they discover an improper use or disclosure of patient records. In general, substance use disorder programs are already subject to HIPAA requirements as covered entities, so this modification is not a major change for many programs.
  1. New Regulations: As stated above, the CARES Act requires the Secretary of HHS to revise the Part 2 regulations as necessary to implement and enforce the CARES Act changes. In addition, the Secretary must update the HIPAA requirements related to the Notices of Privacy Practices of a substance use disorder program. The CARES Act instructs the Secretary to implement such regulations within twelve months from the enactment date of the Act.

Next Steps: The CARES Act’s most significant modification to Part 2 is the new ability for programs, covered entities, and business associates to disclose records for treatment, payment, and health care operations purposes after the patient has signed an initial consent. We recommend that Providers review and potentially revise their consent forms to comply with this change, as well as their associated policies pertaining to the use and disclosure of substance use disorder records.  Additionally, providers should be ready to make additional revisions to consent forms and their Notice of Privacy Practices when HHS releases updated Part 2 regulations to implement the CARES Act.

If you would like more information on the changes to the Part 2 requirements under the CARES Act, please contact Casey Moriarty at or 206-447-7226.


OCR Allows Business Associates to Disclose PHI for Public Health Activities

On April 2, 2020, the federal HHS Office for Civil Rights (OCR) announced that, effective immediately, it will not impose penalties against a business associate or covered entity under the HIPAA Privacy Rule for uses and disclosures of protected health information (PHI), even if not explicitly permitted in the Business Associate Agreement, if:

  • the business associate makes a “good faith use or disclosure of the covered entity’s PHI for public health activities and health oversight activities consistent with 45 CFR 164.512; and
  • the business associate informs the covered entity within ten (10) calendar days after the use or disclosure occurs (or commences, with respect to uses or disclosures that will repeat over time).

The OCR provided two examples of “good faith” uses or disclosures including to the CDC, CMS, and State health oversight agencies.

Under the HIPAA Privacy Rule, a covered entity may use or disclose PHI if the covered entity believes in good faith that disclosure is necessary to prevent or lessen a serious and imminent threat to the public, including to protect the public from the spread of infectious disease and to ensure health and safety.  HIPAA further permits a business associate of a HIPAA covered entity to use and disclose PHI under the same circumstances, but only pursuant to the explicit terms of the Business Associate Agreement or other written arrangement.

Since the beginning of the COVID-19 emergency, Federal public health authorities, health oversight agencies, state and local health departments, and state emergency operations centers have requested PHI from both covered entities and  business associates, or requested that business associates perform public health data analytics on such PHI, for the purpose of ensuring the health and safety of the public during the COVID-19 national emergency.  In response, business associates have expressed an inability to comply because the business associate agreements did not explicitly permit such uses and disclosures.

In the wake of the ongoing national emergency, the clear intent of this new guidance is to allow business associates to disclose requested PHI to a public health agency on behalf of covered entities without the necessity of negotiating permission within the business associate agreement.  While this is not a permanent amendment to the law, it does allow some coverage for business associates and contractors as they seek to provide the necessary information to track the developments during the COVID-19 crisis.

For more information regarding this guidance, please contact Eliza Whitworth at 206-447-0423 or

* The final notification has not been finalized or made public. While it is unlikely to change substantially, it could change slightly.  The final notification will be supplemented when available.

Zoom Security & Privacy Hygiene Tips by Elana Zana

Using video conference platforms, specifically Zoom, has become a new way of life to facilitate check-ins, mediations, public meetings, etc.  However, as many users have already identified (e.g. the FBI – there are some security vulnerabilities with Zoom. These vulnerabilities range from stealing login credentials to Zoom bombings – interrupted Zoom meetings by unwanted visitors – jeopardizing the privacy of these meetings and potentially, the security of your system.

Here are a few tips and procedures to follow in order to maintain the security and privacy in Zoom:

  1. Many hackers are embedding URLs into the chat feature within Zoom; do not click on any URLs within this feature. See
  2. Enable a password for all meetings (ideally a random one).
  3. When joining a meeting, type in the Meeting ID and Password (rather than following a Zoom link).
  4. Utilize the waiting room feature, in which the host must allow others to join the meeting.
  5. Disable file sharing, or allow only the host to share.
  6. Disable call recording.
  7. Prevent participants from saving chats and disable auto-saving chats.
  8. Periodically inspect the list of participants throughout the duration of the meeting.
  9. Lock the meeting once everyone has joined.
  10. Do not share Meeting IDs on any social media platform.
  11. Ensure that all users are running the most updated version of Zoom (post January 2020).

Another good video meeting hygiene tip: be aware of WHO and WHAT is in your background. Sometimes, the Zoom bombers are not only unwanted hackers, but your own family member(s) not realizing you are on video.

While in many cases you are not the “host” of the meeting, you may want to discuss some of these concerns with the host to make sure that they are aware of the security and privacy issues.

So, what’s the solution? You can still use Zoom – just make sure you use it with the correct settings and actions mentioned above.

Temporary Suspension of Certificate of Need Regulations & Facility Licensing Requirements

March 31, 2020

Elana R. Zana (


Governor Inslee announced in Proclamation 20-36 the immediate waiver and suspension of portions of the DOH licensing statutes and rules relating to certain health care facilities to respond to the COVID-19 pandemic.  These waivers are effective until April 29, 2020.


Certificate of Need

The following is a brief synopsis of the waiver of the CN review requirements. Please consult the cited, corresponding statute and Proclamation 20-36 for the full rule. The following CN review requirements are waived, in their entirety, for:

  • Construction and development of a new health care facility (RCW 70.38.105(4)(a), WAC 246-310-020(1)(a));
  • Sale, purchase or lease of an existing hospital (RCW 70.38.105(4)(b), WAC 246-310-020(1)(b));
  • Change in bed capacity which increases the total number of licensed beds, or redistributes beds among acute care, nursing home care, and assisted living facilities (RCW 70.38.105(4)(e), WAC 246-310-020(1)(c));
  • Change in bed capacity of a rural health care facility licensed under RCW 70.175.100 that increases the total number of nursing home beds, or redistributes beds from acute care or assisted living facility care to nursing home care (RCW 70.38.105(4)(e);
  • Any expenditure for the construction, renovation, or alteration of a nursing home, or change in nursing home services in excess of the expenditure minimum made in preparation for any undertaking  subject to CN review (RCW 70.38.105(4)(g), WAC 246-310-020(1)(g));
  • Any increase in the number of dialysis stations in a kidney disease center (RCW 70.38.105(4)(h), WAC 246-310-020(1)(e));

The waiver and suspension of the CN requirements are only applicable to projects used to provide surge capacity for the COVID-19 response.  Thereafter, CN approval must be obtained after the expiration of this waiver in compliance with the statutory and regulatory requirements.

The Hospice Cycle 2 and Dialysis Facility concurrent review deadlines will also be delayed by 30-days.  Following the delays, the concurrent review cycles will resume on the same regulatory review timelines but will be set back 30 days.


Facility Licensing Requirements

The Governor’s Proclamation also included waivers and suspensions in their entirety of many hospital licensing requirements including, but not limited to, certain patient notices, bed limitations for rural hospitals, notifications of adverse health events, duration of hospital licenses, and MRSA policies.  Included in these waivers are certain hospital licensing regulations contained in WAC 246-320. For a complete list of the relevant statutes and hospital licensing regulations, please see the Governor’s Proclamation 20-36.


Further, the Governor’s Proclamation eased the pharmacy assistant rules under RCW 18.64A and modified certain locational requirements for pharmacy licenses under RCW 18.64; specifically, no longer requiring that pharmacy ancillary personnel obtain authorization by the commission, and waiving the requirements of approval of the commission under RCW 18.64A.060, but retaining all other limitations and requirements contained in RCW 18.64A. This waiver also includes modifications to WAC 246-901-020, WAC 245-901-035 regarding specialized functions, and suspension of WAC 246-901-100 in its entirety.

The waiver provisions are further identified in the Governor’s Proclamation 20-36 and are only temporary in nature to provide surge capacity for COVID-19 response.  Hospitals, pharmacies and other healthcare entities must comply with the statutory and regulatory provisions after the expiration of the waiver.

For more information regarding the Certificate of Need or Licensing waivers and suspensions, please contact Elana Zana at 206-442-1308 or or Don Black at