As the nation reopens, businesses have a host of logistical and legal issues to resolve in order to bring their employees back safely in the age of COVID-19. Many are turning to technological solutions, ranging from standard forehead thermometer guns, to more sophisticated, social-distancing and heat-detection cameras, some of which are even paired with facial recognition software that can track and identify individuals who have a fever or who flout the distancing rules. Before implementing such technology in the workplace, however, enterprises must consider the potential legal implications associated with their use.

The Benefits of Thermal Cameras and COVID-19

The main advantage is that the person who handles the thermal imaging system is not required to be physically close to the person being evaluated. In fact, the person who handles the thermal imaging system could be in a different area or room. This eliminates the need for personal protective equipment (PPE) and the Occupational Safety and Health Administration (OSHA) required training for temperature takers.

A thermal imaging system has also shown that it more accurately measures surface skin temperature faster than the typical forehead or oral (mouth) thermometer that requires a close distance or physical contact with the person being evaluated.

The Pitfalls of Thermal Cameras and COVID-19

The primary disadvantage is that thermal imaging does not detect whether someone has COVID-19 because, among other things, a person with the coronavirus may not have a fever. A more complete diagnostic test must be performed to determine if someone has COVID-19.

In addition, the accuracy of the systems depends on careful set-up and operation, and they need to be used in the right environment and location in order to be effective. Since these systems measure surface skin temperature, which is usually lower than a temperature measured orally, thermal imaging systems need to be properly adjusted to correct for this difference in measurements. Further, the person handling the thermal imaging system must be properly trained for the results to be helpful.

The Legal Limitations of Using Thermal Cameras in the Workplace

Before businesses rush to use thermal cameras, they should consider the applicability of current and likely future laws regulating their use (particularly in states such as California with strict privacy laws). First, the Health Insurance Portability and Accountability Act (HIPAA) requires companies to develop and follow procedures that ensure the confidentiality and security of protected health information. Employers, however, only have to comply with HIPAA if they are a healthcare provider or are assisting with the administration of a group insurance plan. The information provided by the cameras, therefore, likely does not fall within HIPAA’s purview.  There also is no legal issue under HIPAA with analyzing customer temperatures (unless perhaps if the user of the camera is a healthcare provider).

Notwithstanding HIPAA, employers need to consider whether the use of thermal cameras to record the temperatures of employees and customers implicates other privacy laws. There is no federal “data” collection law in the United States. However, in some states, including California for example, thermal cameras may implicate state privacy laws. The California Consumer Privacy Act (CCPA), requires businesses to provide notice to consumers about personal information the business collects about them. This includes personal information that an employer collects about an employee. If located in California, companies would be prudent to adopt a CCPA-compliant notice to inform individuals entering the premises of the thermal camera use and the purpose for which it used. Individuals do not have to provide consent, but they do need to be given advance notice. This should be posted at the site and made visible to all before they pass through the surveillance area. After California adopted the CCPA in 2018, other states began considering similar bills. No state currently prohibits the typical use of a thermal camera, but the required notice to employees and visitors does vary by jurisdiction.

Under the Americans with Disabilities Act (ADA), and similar state laws, measuring the body temperature of an employee by any means is considered a medical examination, and thus, is subject to certain limitations. However, the Equal Employment Opportunity Commission (EEOC) recently approved checking temperatures of employees and even suspending job offers to individuals who have a temperature in excess of 100.4 degrees. The EEOC justifies the use of such measurements now because of the “direct threat” of COVID-19 as a worldwide pandemic, but it is unclear how long that justification will remain valid.

Another important consideration is the guidance from the Food and Drug Administration (FDA). On April 20, 2020, the FDA issued guidance on the use of this type of technology. The guidance appears to allow non-FDA approved thermal technology to be used for temperature screening purposes during the COVID-19 health emergency, so long as there is no “undue risk.”  To that end, the FDA recommends that the technology be used in combination with a secondary screening measure (for those who are identified as having a fever) and that the technology be used to screen only one individual at a time. This calls into question the use of non-FDA approved mass scanners that scan multiple people at one time. Where secondary temperature screening is conducted, the same health information collection and storage concerns discussed above would also apply to that secondary temperature screening information.

Some states also have specific laws regulating biometric testing and/or facial recognition. For example, states such as California, Illinois, Texas and Washington have laws regulating the collection and use of biometric identifiers, including fingerprints, handprints, retinal and/or facial scans and voiceprints. Additionally, local ordinances in Massachusetts prohibit the use of facial recognition technologies by government entities. Whether these laws may be used to regulate thermal imaging depends on the language of a particular statute and the data collected by the camera.

Last, if companies have unionized employees, they should consider whether they are permitted by the applicable collective bargaining agreement to implement such new technologies. Employer surveillance of union activity can constitute an unfair labor practice. Thus, employers should consider whether they have a duty to bargain with the union representing their employees about such tests.

Practical Tips for Using Thermal Cameras and COVID-19

If enterprises decide to proceed with thermal cameras at their workplace, there are some practical tips they should follow for the best results.

Identify who needs to have their temperatures checked, why, when and how, including if such screening is required by local or state order.

Disclose the use of these systems with proper signage, policies and/or acknowledgement forms.

Communicate with employees about the need for and reasoning behind the temperature checks.

Obtain consent to the use of these systems from persons being tested. Consent can be express, such as on a signed waiver form, or implied, through unilateral communications such as signs or policies. All should make it clear that access to the facility is conditioned on consent to the temperature check. State and local laws, however, may vary on the method of consent needed.

Develop policies and procedures for dealing with temperatures that are out of range and situations where someone is believed to be at risk for the coronavirus.

Keep the results of scans confidential as required by the ADA and related laws.

As with many employee monitoring issues, the biggest concern with respect to thermal cameras is actually what the business does with the information. If security companies or their clients are going to collect and store any data from the thermal screening, the data needs to be protected; and employers need to maintain employee information in a confidential file. To mitigate risk, any information that is stored for an individual should use only the individual’s last name or some other identifier.

If someone registers as feverish, the best practice is to confirm the temperature with a forehead thermometer and allow for sunshine or ambient heat before the person is excluded from the premises. Employees who fail the temperature check should be sent home to consult with their own healthcare provider.  Employees can and should be denied entry into the workplace if they refuse to submit to temperature screening.  It is also important to note that hourly employees need to be paid for time spent waiting for the temperature screening, and if sent home, may need to be paid for “show-up pay,” which is half their regular shift, minimum of two, and maximum of four, hours (check your state law on this).

Awareness is Key

Thermal cameras can be an efficient and effective tool when used under appropriate circumstances. However, employers need to make sure they are aware of the legal and practical limitations (particularly in the state where the camera is to be used) before rushing into the use of such systems.