HIPAA Privacy Doesn’t Stop Vaccine Inquiries By Employers And Businesses
HIPAA privacy rules do not prevent employers and businesses from asking employees and visitors about their COVID-19 vaccination status, the government recently reiterated.
In guidance issued on September 30, 2021, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) again explained that the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule does not apply in most instances in which individuals are asked whether they have received a COVID-19 vaccine or to provide evidence of vaccination. The OCR also reminds organizations that if HIPAA does apply, it regulates the use and disclosure of protected health information, and not the ability to request information from its employees.
The guidance poses a number of common questions, all of which are answered in the negative:
- “Does the HIPAA Privacy Rule prohibit businesses or individuals from asking whether their customers or clients have received a COVID-19 vaccine?” “No.”
- “Does the HIPAA Privacy Rule prevent customers or clients of a business from disclosing whether they have received a COVID-19 vaccine?” “No.”
- “Does the HIPAA Privacy Rule prohibit an employer from requiring a workforce member to disclose whether they have received a COVID-19 vaccine to the employer, clients, or other parties?” “No.”
The guidance reminds everyone that the HIPAA Privacy Rule only regulates the usage of protected health information by “covered entities” and their business associates, and only health care providers, health care clearing houses, and health plans are “covered entities.” Those entities cannot provide vaccination information to third parties who are not covered entities without an appropriate HIPAA authorization or as otherwise permitted under HIPAA. However, employers or businesses interacting with their customers or visitors are not covered entities and are not restricted by the HIPAA Privacy Rule.
The guidance clarifies that even covered entities can request COVID-19 information from their workforce members when the covered entities, such as hospitals, are acting in their capacities as employers. Covered entities can require their workforce members to provide proof of vaccination, sign a HIPAA authorization about vaccination status, wear a mask, or reply to inquiries from patients about vaccination status.
The guidance notes that the Americans With Disabilities Act (ADA) does require employers to keep documentation or other confirmation of vaccination confidential and stored separately from the employee’s personnel files. The relief from HIPAA privacy restrictions for employers does not extend to ADA compliance. Moreover, group health plans sponsored by employers are often HIPAA-covered entities, which means that COVID-19 vaccination information that employers receive through a group health plan constitutes protected health information subject to HIPAA rules. However, notably, information an employer learns from sources other than the group health plan (such as the methods discussed above) is not protected by HIPAA.
EEOC Updates Guidance On COVID-19 Vaccination Incentive Programs (U.S.)
Since the start of the pandemic, the EEOC has periodically updated its informal guidance to address emerging topics related to COVID-19, include regarding vaccination, which is top of mind for many U.S. employers. This week, the EEOC updated its informal guidance to address questions regarding COVID-19 vaccination and vaccination incentive programs. Takeaways from the updates include the following:
- An employer may require all employees physically entering the workplace to be vaccinated against COVID-19, subject to the reasonable accommodation provisions of Title VII (related to religion and pregnancy) and the Americans with Disabilities Act (ADA). The agency warns against policies that might have a disproportionate impact on certain groups of employees, therefore consistent application of mandatory vaccination policies is essential. Specifically with respect to pregnant employees, although the EEOC echoes guidance from the U.S. Centers for Disease Control and Prevention (CDC) encouraging persons who are pregnant or breastfeeding to obtain the COVID-19 vaccine, if an employee seeks an exemption from a vaccination requirement due to pregnancy, employers must ensure that the pregnant employee is not discriminated against compared to other employees similar in their ability or inability to work. Accordingly, the pregnant employee may be entitled to accommodations such as job modification, telework, changes to work schedules or assignment, or leave, to the extent such modifications are provided for other similarly-situated employees whose request for exceptions to vaccination policies are granted.
- An employer may provide employees information about COVID-19 vaccination, raise awareness about the benefits of vaccination, work with medical providers to make vaccination available for unvaccinated workers in the workplace, provide information on low-cost or no-cost transportation resources to vaccination sites, and offer paid time off for vaccination, all without violating the ADA or Genetic Information Non-Discrimination Act (GINA). The EEOC balances this message with a reminder to employers to provide contact information of a management representative to employees who may need to request a reasonable accommodation for religion, disability, or pregnancy.
- Requesting documentation or other confirmation of vaccination is not a disability-related inquiry under the ADA. Although employers may require employees to provide confirmation of vaccination as part of a voluntary or mandatory vaccination program, like all medical information, documentation of vaccination must be kept confidential and maintained separate from employees’ personnel files, as required by the ADA. If the employer requires employees to provide documentation of a vaccination received from a health care provider that is not affiliated with their employer, GINA is not implicated.
- Employers may offer incentives to employees for voluntarily receiving a COVID-19 vaccination from a health care provider that is not affiliated with the employer, such as the employee’s own physician, pharmacy, or a public health department. As long as the health care provider is independent of the employer, there is no limit or cap on the incentive an employer may offer. However, if the employer itself is administering the vaccine, the value of the incentive may not be so substantial as to be coercive because of the genetic and/or disability-related information that the employee may have to provide the employer-as-vaccine-administrator.
These updates are in keeping with the EEOC’s steady position supporting vaccination, subject to reasonable accommodation obligations, and set the stage for anticipated mandatory vaccination programs consistent with President Biden’s Path Out of the Pandemic plan. With the OSHA Emergency Temporary Standard (expected to require COVID-19 vaccination of employees working for U.S. employers with 100 or more employees) under review by the White House and expected to be released at any time.
Covid-19 Vaccination: The EEOC’s Long-Awaited Religious Exemption Guidance
On October 25, 2021, the EEOC released its latest update to its COVID-19-related technical assistance on a much-anticipated topic: religious exemption from COVID-19 vaccination. The EEOC has released guidance periodically since the onset of the COVID-19 pandemic, but this latest update is particularly well-timed given the increasing number of vaccine mandates in the public and private sectors.
The latest guidance clarifies that:
- Even though there are no “magic words” when an employee makes an accommodation request, an employee making a religious exemption request must inform their employer if they are requesting an exemption from a COVID-19 vaccination requirement because of their religious belief; and that the same principles apply if employees have a religious conflict with getting a particular vaccine and wish to wait until a specific brand is available.
- Employers can ask employees to explain the religious nature of their belief, as well as how their religious belief conflicts with COVID-19 vaccination requirements.
- Employees should not assume that an employer already knows or understands the religious nature of their belief.
- Employers may ask for an explanation of how the employee’s religious belief conflicts with the employer’s COVID-19 vaccination requirement.
- While the sincerity of a religious belief is not normally in dispute, the employee’s sincerity in holding a religious belief is “largely a matter of individual credibility.”
The EEOC also provides various scenarios in which an employee’s religious exemption request can be met with additional questions or denied. They include:
- When an employer has an objective basis for questioning either the religious nature or the sincerity of a particular belief. In such a case, the employer would be justified in making a limited factual inquiry and seeking additional supporting information.
- When an objection to COVID-19 vaccination is not based on religion. Objections to COVID-19 vaccination that are based on social, political, or personal preferences, or on non-religious concerns about the possible effects of the vaccine, do not qualify as religious beliefs under Title VII.
- When an employee is not credible. The EEOC clarifies that while the sincerity of a religious belief is not normally disputed, employee credibility can be considered when the employee has acted in a manner inconsistent with the professed belief; when there is a particularly desirable benefit that is likely to be sought for non-religious reasons; when the timing of the request renders it suspect (e.g., it follows an earlier request by the employee for the same benefit for secular reasons); or when the employer otherwise has reason to believe the accommodation is not sought for religious reasons.
- When an employee fails to cooperate.
The EEOC also provides much-awaited guidance on the “undue hardship” analysis and clarifies that when conducting an “undue hardship” analysis for religious accommodation, costs to be considered include not only direct monetary costs but also the burden on the conduct of the employer’s business — including the risk of the spread of COVID-19 to other employees or to the public. The EEOC also explains that while an employer cannot rely on speculative hardships, employers can consider the number of employees who are seeking a similar accommodation (i.e., the cumulative cost or burden on the employer). Lastly, the EEOC makes clear that an employer has a right to right to discontinue a previously granted accommodation if it is no longer utilized for religious purposes, or if a provided accommodation subsequently poses an undue hardship on the employer’s operations due to changed circumstances.
What considerations does the EEOC remind employers of?
The EEOC reminds employers that while prior inconsistent conduct is relevant to the question of sincerity, an individual’s beliefs or degree of adherence may change over time.
The EEOC also reminds employers that every request for an accommodation should be handled on a case-by-case basis.
Texas Governor Abbott Bars Employers And Individuals From Compelling COVID-19 Vaccines
On October 11, 2021, Texas Governor Greg Abbott issued Executive Order GA-40, which states that no entity in Texas can “compel” any individual, including any employee or consumer, to receive a COVID-19 vaccination who objects “for any reason of personal conscience, based on a religious belief, or for medical reasons, including prior recovery from COVID-19.” The order also establishes a maximum criminal penalty of $1,000 but expressly excludes confinement as a penalty. The governor further signaled in the preamble to the order that he would rescind the order on the effective date of legislation on the subject, which is currently being considered in the atypical Third Session of the Texas Legislature. Governor Abbott has previously revised his COVID-19 related executive orders or issued supplemental guidance within the first few days of their issuance, so it is possible more clarification on this point will soon be forthcoming.
In the preamble, the governor notes that the order is in direct response to the recent actions by the Biden administration requiring the Occupational Safety and Health Administration to issue an Emergency Temporary Standard (“ETS”) mandating that employers with 100 or more employees require employees to be vaccinated or submit to weekly testing. To this point, the order’s preamble states: in “yet another instance of federal overreach, the Biden Administration is now bullying many private entities into imposing COVID-19 vaccine mandates, causing workplace disruptions.” Further insight can be gleaned from the governor’s previous pandemic orders, including Executive Order GA-38, in which he states that “COVID-19 vaccines are strongly encouraged for those eligible to receive one, but must always be voluntary for Texans.”
The language of the executive order leaves many areas open for consideration by employers that have already implemented, or are in the midst of implementing, a vaccine program, including the following issues:
- The order’s list of appropriate objections is arguably vague. One reading of the language sets “reasons of personal conscience” apart from religious or medical reasons (which appears to be consistent with the language in one of the many draft bills before the Texas Legislature), thus creating an independent third basis for refusal of a vaccine. But an alternative analysis grounded in interpretation of similar language under Texas law suggests instead that the “reasons of person conscience” must be based on a religious belief, and not a separate, non-religious/non-medical basis for objection.
- Similarly, while the phrases “medical reason” and “religious belief” appear to be broader in the order than they are under federal antidiscrimination statutes and similar state laws, it is also possible that the order did not intend to fully flesh out these tests and has left traditional EEO guidance on these issues in place.
- Despite statements by the governor’s office regarding the intent of the order, the concept of what it means to be “compelled” is unclear in the text itself. As litigated in federal court in Texas earlier this year, at-will employees in Texas are free to end employment at any time, and so employers arguably never “compel” anyone to receive a vaccine. This topic is also addressed in a number of pending bills before the Texas Legislature.
- The order’s criminal provision has previously been interpreted by a few Texas prosecutors to mean $1000 per day in the context of earlier pandemic-related orders. But there is no language in the order or the referenced statutory provision (Tex. Gov’t Code § 418.173) requiring this exact increment, and the order is otherwise silent on the subject.
- The order does not create a private right of action, and any common law claim for wrongful termination would be foreclosed by Texas Supreme Court precedent addressing the extremely limited circumstances under which wrongful termination claims may be brought against employers in Texas. (That being said, more than one of the pending bills in the Texas Legislature on this topic would create such a right.)
- For employers that are currently bound by federal contractor vaccine program rules, federal law likely preempts state laws that are inconsistent with those federal rules, including the governor’s order. As such, covered federal contractors and subcontractors subject to the recently announced vaccine program rules should carefully evaluate their options and consider continuing to comply with their vaccine program obligations under federal law. For nearly all private employers, however, there is no federal requirement for vaccinating employees at this moment. For employers scheduled to, but not yet covered by, federal contractor vaccine program rules, or for employers of 100 or more employees anticipated to be covered by OSHA’s planned emergency temporary standard covering vaccines, attention to this order is important, as anticipated federal supremacy on this subject may not be a sufficient basis to ignore current obligations that may arise under the order. Moreover, the extent of federal preemption of OSHA’s anticipated temporary standard over the Texas executive order should be carefully considered after OSHA’s final rule is released. In this regard, today OSHA announced a final version of the ETS vaccine rule for private employers was sent to the White House regulatory office, meaning the final OSHA rule could be released anytime in the coming days or weeks.
- We anticipate that adversely impacted employees of private employers may seek judicial intervention for enforcement of the order.
- Given the above, an employer program that encourages vaccines, but that provides testing options as an alternative to the vaccine, may now be the most conservative approach for employers since it allows employees the option to remain unvaccinated. Employers contemplating this type of vaccine program should consider the associated costs and time required for testing, among other legal and practical issues. Those employers that are mid-stream on their own vaccine programs and ready to terminate unvaccinated workers may want to consult counsel about their positions in light of these changing circumstances.
The order was effective upon issuance and remains in effect unless, and until, it is modified, amended, rescinded, or superseded by the governor.
NYC Employers: Have You Bifurcated Your Background Check Process?
New York City employers who conduct criminal history checks of employees need to take note of recent amendments to the NYC Fair Chance Act that took effect in late July 2021. Most significantly, except in limited circumstances where employers are legally required to conduct criminal background checks as a condition of employment, the Fair Chance Act amendments now require employers to adopt a bifurcated process based on the type of prior history being reviewed. Education and employment history, and any other legally-permissible checks that do not reference criminal history, must be completed before extending to the candidate a conditional offer of employment. Once cleared, the employer can then offer the candidate employment that is conditioned on a criminal history check. Only after extending a conditional offer can the employer actually conduct a review of a candidate’s criminal history.
This bifurcated process is dictated by a provision in the amendments to the Fair Chance Act that states a conditional offer of employment may only be rescinded if 1) the results of a criminal background in accordance with the FCA as amended warrant rescission, 2) the results of a legally-permissible medical examination warrant rescission, or 3) the employer discovers other information that it could not have reasonably known previously and that information would have independently warranted rescission. Education and employment history that could have been ascertained at an earlier point may not be used as a reason for rescinding a conditional offer of employment, and hence employers are left with this new bifurcated process.
Another significant change to the FCA was the extension of the FCA’s protections beyond criminal history of job applicants to also include 1) an applicant’s open, pending criminal arrests and charges and 2) the criminal record of current employees. In both contexts, employers must now analyze the relevance, severity, and implications of the criminal history utilizing a series of “Fair Chance Act Factors” that are similar to the factors required to be analyzed in regard to the conviction history of job applicants under N.Y. Correction Law Article 23-A. As a reminder, even before the recent amendments, the FCA has required employers to explain to the applicant in writing the information obtained in the background check process and the Fair Chance Act Factors on which the employer relied. Applicants must then be provided an opportunity to respond before any employment decision can be made, and the FCA amendments extend to five days (formerly three days) the applicant’s window to respond.
Another FCA amendment was a clarification that certain types of criminal history should be considered “non-convictions” and therefore cannot be considered at all as part of the background check process. The category of non-convictions includes convictions that result solely in a “violation,” records that are sealed, juvenile convictions, and dismissed, vacated, or acquitted charges.
Legal Enforcement Guidance on the Fair Chance Act, issued by the NYC Commission on Human Rights, further advises employers that they cannot include even neutral statements like “background checks required” or “applicants’ criminal history will be considered consistent with the requirements of the New York City Fair Chance Act” in their job ads or at any point before making a conditional offer. Rather, the guidance states that an employer can advise an applicant that its process will include a criminal background check only in response to a specific inquiry by the applicant. To comply with disclosure obligations under the federal Fair Credit Reporting Act, the NYC guidance encourages employers to use terms like “consumer report” or “investigative consumer report” rather than “background check” in its authorization notice.
The amendments to the FCA and the enforcement guidance from the New York City Commission on Human Rights are very much intended to discourage employers from using criminal history as a basis for employment decisions. Most background check vendors have shifted their processes to comply with the new bifurcated process mandated by the FCA. Those New York City employers that continue to conduct background checks that include consideration of criminal history should consult with legal counsel whether they fall within an exception to the FCA amendments and, to the extent they do not, confirm that they are adhering to the new New York City requirements.
New York Department Of Labor Publishes Guidance Addressing Recreational Marijuana In The Workplace; Most Drug Testing For Marijuana Is Prohibited
he New York Department of Labor (“DOL”) recently published guidance and FAQs entitled “Adult Use Cannabis And The Workplace – New York Labor Law 201-D” to address questions related to the Marijuana Regulation and Taxation Act (“MRTA”). MRTA legalized marijuana use and possession for adults who are 21 and older, effective March 31, 2021, and amended New York Labor Law Section 201-d, the legal activities law. New York employers may not refuse to hire, employ, discharge, or otherwise discriminate against someone who uses cannabis lawfully while off-duty and off-premises and while not using the employer’s equipment or other property.
Some of the key takeaways from the DOL Guidance include:
- Drug testing for marijuana is not permitted except in very limited circumstances (e.g., the test is required by law);
- A drug test result cannot serve as a basis for an employer’s conclusion that an employee was impaired by marijuana;
- The smell of marijuana, by itself, is not evidence of “articulable symptoms of impairment.”
Pertinent excerpts of the DOL’s Guidance and FAQs are set forth below:
Permitted Employer Actions
Employers may take employment actions related to the use of cannabis based on the following:
- The employer is/was required to take such action by state or federal statute, regulation, ordinance, or other state or federal governmental mandate;
- The employer would be in violation of federal law;
- The employer would lose a federal contract or federal funding;
- The employee, while working, manifests specific articulable symptoms of cannabis impairment that decrease or lessen the employee’s performance of the employee’s tasks or duties;
- The employee, while working, manifests specific articulable symptoms of cannabis impairment that interfere with the employer’s obligation to provide a safe and health workplace as required by state and federal workplace safety laws.
Frequently Asked Questions
Can an employer take action against an employee for using cannabis on the job?
An employer is not prohibited from taking employment action against an employee if the employee is impaired by cannabis while working (including where the employer has not adopted an explicit policy prohibiting use), meaning the employee manifests specific articulable symptoms of impairment that:
- Decrease or lessen the performance of their duties of tasks
- Interfere with an employer’s obligation to provide a safe and healthy workplace, free from recognized hazards, as required by state and federal occupational safety and health laws.
What are articulable symptoms of impairment?
There is no dispositive and complete list of symptoms of impairment. Rather, articulable symptoms of impairment are objectively observable indications that the employee’s performance of the duties of their position are decreased or lessened. Employers are cautioned that such articulable symptoms may also be an indicate that an employee has a disability protected by federal and state law (e.g., the NYS Human Rights Law), even if such disability or condition is unknown to the employer. For example, the operation of heavy machinery in an unsafe and reckless manner maybe considered an articulable symptom of impairment.
What cannot be cited by an employer as articulable symptoms of impairment?
Observable signs of use that do not indicate impairment on their own cannot be cited as an articulable symptom of impairment. Only symptoms that provide objectively observable indications that the employee’s performance of the essential duties or tasks of their position are decreased or lessened may be cited. However, employers are not prohibited from disciplinary action against employees who are using cannabis during work hours or using employer property.
Can employers use drug testing as a basis for an articulable symptom of impairment?
No, a test for cannabis usage cannot serve as a basis for an employer’s conclusion that an employee was impaired by the use of cannabis, since such tests do not currently demonstrate impairment.
Can I fire an employee for having a noticeable odor of cannabis?
The smell of cannabis, on its own, is not evidence of articulable symptoms of impairment under Labor Law Section 201-d.
Can an employer test for cannabis?
No, unless the employer is permitted to do so pursuant to the provisions of Labor Law Section 201-d(4-a) or other applicable laws.
Can an employer drug test an employee if federal law allows for drug testing?
No, an employer cannot test an employee for cannabis merely because it is allowed or not prohibited under federal law. (See e.g., neither the Drug-Free Workplace Act nor the rules adopted thereunder authorizes drug testing of employees.) However, an employer can drug test an employee if federal or state law requires drug testing or makes it a mandatory requirement of the position.
Can employers prohibit use of cannabis during meal or break periods?
Yes, employers may prohibit cannabis during “work hours,” which for these purposes means all time, including paid and unpaid breaks and meal periods, that the employee is suffered, permitted or expected to be engaged in work, and all time the employee is actually engaged in work. Such periods of time are still considered “work hours” if the employee leaves the worksite.
Can employers prohibit use of cannabis during periods in which an employee is on-call?
Yes, employers may prohibit cannabis during “work hours,” which includes time that the employee is on-call or “expected to be engaged in work.”
For remote employees, can employer prohibit use in the “worksite”?
The Department of labor does not consider an employee’s private residence being used for remote work a “worksite” within the meaning of Labor Law Section 201-d. However, an employer may take action if an employee is exhibiting articulable symptoms of impairment during work hours as described above and may institute a general policy prohibiting use during working hours.
Can employers prohibit use when the employee uses a company vehicle?
Yes, employers are permitted to prohibit use in company vehicles or on the employer’s property, even after regular business hours or work shifts.
Pennsylvania Medical Marijuana Act Did Not Protect Employee Who Was Terminated For Positive Marijuana Test
A federal court in Pennsylvania granted an employer’s motion for summary judgment dismissing a former employee’s Pennsylvania Medical Marijuana Act (PMMA) claim because he could not show that his termination was premised solely on his status as a certified user of medical marijuana. Matthew Reynolds v. Willert Mfg. Co., LLC, No. 5:21-cv-01208 (E.D. Pa. October 19, 2021).
The employee received a conditional offer of employment contingent upon the successful completion of a drug test and began working on October 16, 2020. The drug test was performed off-site by a third-party vendor. Upon submitting to the drug test, the employee informed the individual performing the drug screening that he was a medical marijuana patient. After testing positive for marijuana, he also informed the medical review officer (MRO) of his status as a medical marijuana patient. The MRO reported the positive drug test results to the employer but did not mention the employee’s status as a medical marijuana patient. Based on the positive drug test result, the employer terminated the employee on November 5, 2020. Immediately after his termination, the employee informed the employer—for the first time—that he was a medical marijuana patient. The employer declined to reverse its termination decision based on the newly obtained information that the now former employee was a registered medical marijuana patient.
In February 2021, the employee filed a state court action for discrimination pursuant to the PMMA. The employer subsequently removed the action to federal court and moved for summary judgment asserting that the “uncontroverted facts indicate that” the employer’s decision to terminate the employee was not based solely on the employee’s status as a medical marijuana patient.
The Court agreed with the employer, reasoning that the PMMA “indicates that it prohibits discrimination ‘solely on the basis of such employee’s status as an individual who is certified to use medical marijuana,’” and does not explicitly or implicitly protect against discrimination on the basis of a positive marijuana drug test result. The Court reasoned that to prevail on a discrimination claim under the PMMA, the employee “must show (1) he was discriminated against on the basis of his status as a cardholder, and (2) that but for his status, he would not have been terminated.” Because there was no evidence that the employer was aware of the employee’s status as a medical marijuana patient prior to his termination, the Court could not logically conclude that the termination was based upon such status.
In an attempt to impute the testing site’s knowledge of the employee’s status as a medical marijuana patient to the employer, the employee argued that the testing site was an agent of the employer. The Court rejected this argument, explaining that an agency relationship exists only where an agreement creates a fiduciary relationship between the two parties.
The Court further opined that even if the employee “could show his termination was motivated by his status as a medical marijuana user, [the employee] failed to provide facts that would allow a reasonable jury to find that his status was the sole basis of his termination. Accordingly, the Court granted the employer’s motion for summary judgment.
European Whistleblowing Directive – Need To Know FAQs
The 17 December 2021 deadline for EU Member States to implement the EU Whistleblowing Directive into national laws is fast approaching. Private sector organizations in the European Union with 250 or more workers (and certain public authorities) will be required to comply with the new laws from that date, though those with 50-249 workers have until 17 December 2023 to do so. Importantly, the 50-worker minimum limit is removed for financial services firms and the UK is not required to introduce the Directive. We’ve set out below responses to some of the frequently asked questions on this topic. This is based on the provisions of the Directive though do remember that Member States are free to go beyond these minimum standards and so the final national laws must be checked.
1) Why was the Directive introduced?
Existing whistleblower protection in the European Union offers patchwork protection only, which may deter individuals from raising concerns (particularly those in global roles where it is not clear which jurisdiction/laws apply). The economic case for enhancing whistleblower protection is strong. Annual losses in the EU due to a lack of whistleblower protection in public procurement are estimated at between €5.8 and €9.6 billion. That’s in a “normal” year, absent a global pandemic coupled with significant (and often questionable) increases in public spending.
2) What’s “whistleblowing” in this context?
It’s limited to reporting breaches of certain EU laws, including those relating to financial services, food and product standards, public health, public procurement and consumer protection. Some Member States (e.g., Denmark) are going further and extending this to serious wrongdoing and violations of national law whereas others (e.g., Germany) are being criticized for their plans to apply the minimum approach only.
3) Who does it cover?
It’s broader than employees and workers. Self-employed contractors, workers, volunteers, non-executive directors, shareholders, suppliers and contractors are all covered.
4) What are the key requirements?
- Establish reporting channels (internally and/or externally) to receive reports in writing and orally (e.g., telephone / voice messaging system). For private sector organizations, this applies only to organizations with 50-249 workers though member States may extend this requirement to organizations with fewer than 50 workers.
- An impartial person/department should be professionally trained and have responsibility for handling reports.
- Reports should be acknowledged within 7 days and feedback/follow-up provided in 3 months (this may be extended to 6 months e.g., in complex cases).
- Whistleblowers should be protected from retaliation (examples include removing workplace duties, negative performance reviews, blacklisting or psychiatric/medical referrals).
5) Are there any areas where Member States are free to decide how to manage?
Member States are free to decide to enhance any of the protections in the Directive, though these key areas have been left up to the Member States:
- The scope of breaches that can be reported (e.g., whether this will go further than only certain EU law breaches).
- Whether businesses and relevant public authorities will be required to accept and follow up on anonymous reports (in any case, a tricky topic with broader commercial considerations at play – it’s generally not recommended to take a blanket approach of ignoring anonymous reports).
- The penalties for retaliation.
6) Will this impact how businesses deal with employee grievances?
If you’re handling a workforce in the EU, it’s one to watch. It’s up to each Member State whether they bring interpersonal grievances within the scope of the protection. Even if they do not do so, you’re HR and investigation teams need to be alive to the risk of employees raising concerns via these channels. You’ll also need to proactively manage the reputational risk of employees raising concerns with any regulators directly (e.g., particularly in the financial services and healthcare sectors).
7) What can businesses do now to prepare?
Although national legislation is not yet finalized in many countries (though it’s underway in 23 of the 27 EU Member States), businesses can take proactive steps to manage this change by:
- Assessing whether you are in scope and, if so, take advice from European counsel on the key upcoming issues in each jurisdiction relevant to your business (at this stage, many countries have draft bills so there is information available).
- Do a gap analysis of your existing whistleblowing/speaking up frameworks (bearing in mind any specific regulatory obligations placed on your industry, e.g. financial services/healthcare, or your business by virtue of your global operations e.g. there are separate U.S.-specific whistleblowing requirements).
- Designate responsible individuals to manage reports (and arrange training for those individuals).
- Consider engaging with an external provider/hotline to receive reports