Internal tracing systems

As well as the NHS Test and Trace service, some employers may want to introduce their own internal tracing systems alongside internal testing programmes. It is a voluntary decision for employers to run their own tracing systems for their staff.

Employer-led internal tracing systems are never a substitute for NHS Test and Trace. If employers identifies that there is more than one case of COVID-19 on your premises, they must always contact their local Health Protection Team to report the suspected outbreak., However internal employer-led tracing can offer an extra-layer of reassurance for the workplace environment. It is important that advice from NHS Test and Trace takes precedence over internal advice on isolation.

When developing a system, it is critical that due regard is given to the interaction between internal tracing systems and NHS Test and Trace and how this impacts employee rights such Statutory Sick Pay. An individual who has been identified as a contact by an internal contact tracing system but is not defined as a contact by the NHS Test and Trace service does not qualify for Statutory Sick Pay. If an employer decides to keep the employee away from the workplace the employer, where possible, should arrange for the member of staff to continue to work from home. If working from home is not possible the employer may have to keep them on full pay, unless their contract of employment provides otherwise. If an individual is contacted by NHS Test and Trace as well, they will be eligible for Statutory Sick Pay (if they meet the other eligibility criteria) from the day that NHS Test and Trace has told them to self-isolate.

<> If employers choose to take precautionary measures by keeping an asymptomatic member of staff away from the workplace, the employer is strong advised to ensure they are providing them with the correct public health advice. This includes advising the individual to request a test if they become symptomatic. Until they are contacted by NHS Test and Trace, they do not have to self-isolate. Instead, they should:

- avoid contact with people at high increased risk of severe illness from coronavirus, such as people with pre-existing medical conditions
- take extra care in practising social distancing and good hygiene
- watch out for symptoms and self-isolate if they also show signs of coronavirus

Employers should not attempt to trace any contacts beyond the workplace, but should refer these cases to the local Health Protection Team.

Communicating results to the person who had a test

It is a legal obligation for employers and third-party healthcare providers to directly share all results from both virus and antibody tests with a member of staff who asks to see them. An employee may agree to have their results transmitted to their employer first (or at the same time as they receive them). What will happen to the employees' results, who they will be shared with, why and when should be clear to the staff member before they take the test. It is highly advised that when the result is communicated to the person it is accompanied, with clear information on what the results means in non-technical language, along with what actions they should take. A healthcare professional is expected to communicate the results but in the absence of a healthcare professional a person owing a similar duty of confidentiality to the employee may communicate test results (e.g. someone who works in occupational health or HR who has signed confidentiality clauses over and above the employer's standard wording and has received additional training on the handling of sensitive health data).

If results are being communicated via text message or app, it is strongly encouraged for a healthcare professional (or a person owing a similar duty of confidentiality) to be accessible to members of staff to discuss the results.

Communicating a positive virus test case to the workforce

Employers are encouraged to keep staff informed about potential or confirmed COVID-19 cases amongst their colleagues. However, they should not name individuals, and should not unlawfully share anyone's personal data (including anyone's test results).

The ICO is clear that data protection law doesn't prevent an employer ensuring the health and safety of their staff. It should not to be viewed as a barrier to sharing data with authorities for public health purposes when necessary and proportionate, such as working with the NHS Test and Trace service. More information is provided by the ICO's FAQs.

What an employer can do with the results

Employers can use virus test results to understand who in their workforce currently has COVID-19 and who needs to isolate following a positive COVID-19 virus test.

They can use antibody test results to understand the percentage of their workforce that has already potentially had COVID-19.

What an employer cannot do with the test results

An employer must ensure that any lists of members of staff made from collecting their sensitive health data, including their test results, do not result in any unfair or harmful treatment of employees.

It would also not be fair to use, or retain, information for purposes staff members were not told about or would not reasonably expect.

<> If a member of staff receivesa positive antibody test result, employers cannot assure them that they are immune, or allocate to them any form of immunity certification, for example an 'immunity passport'.

Employers should not treat staff who have had a positive antibody test any differently from staff who do not.