Guidance for employers on private asymptomatic employee testing programs
1. Scottish Government Position
The current position of the Scottish Government on SARS-CoV-2 virus detection testing (Polymerase Chain Reaction (PCR) or antigen testing) can be divided into whole population symptomatic testing and targeted asymptomatic testing. This guidance falls into the asymptomatic testing category for employers who are using private laboratories to run testing programmes for their workforce.
The Scottish Government has reviewed its testing strategy and presently sees asymptomatic testing as a way of finding additional cases, in some situations helping to protect the vulnerable, and reducing the risks of outbreaks in high risk settings through regular testing. Examples of this will include routine testing of patients or care staff in hospitals and care homes, testing of prison staff, or providing asymptomatic population testing in areas of high prevalence.
Employers should note that a routine asymptomatic testing program does not replace the need for other mitigation measures, which may include physical distancing, the use of face coverings, good ventilation, enhanced hygiene measures, and use of Personal Protective Equipment (PPE).
Furthermore, this guidance is clear that regardless of any private asymptomatic testing there is no alternative to Test and Protect for any individuals who display symptoms of Covid-19. Anyone displaying symptoms should immediately refer themselves for a PCR test through the public route, not a private test designed for asymptomatic detection.
Where employers are considering – or are already running - asymptomatic workforce testing programmes, this guidance sets out the legal obligations and best practice to follow, ensuring that both established and new/innovative programmes are as reliable and effective as possible.
This guidance should be used alongside:
- PCR and Molecular COVID-19 testing within Scotland – A Guide for Non-NHS Laboratories
- PHS Guidance for non-healthcare settings
- PHS Contact Tracing Guidance
- PHS Guidance for sampling and laboratory investigations
- Test and Protect on NHS Inform
- Coronavirus: getting tested in Scotland
This guidance covers:
- The legislation, regulations and guidance for employers and third-party healthcare providers.
- Virus detection testing (PCR and antigen) as well as antibody testing.
- How to interpret test results and what the next steps should be after a positive or negative test.
- The framework in place for employers using Non-NHS Laboratories to interlink with NHS services on service provision and data flows.
- The factors to be considered before using non-laboratory testing.
This guidance does not:
- replace the need for independent legal advice and it does not supersede existing legal obligations, including those relating to health and safety, the Public Health (Scotland) Act 2008, employment law, data protection or equalities.
- cover temperature checks or the use of thermal cameras as a means of "testing" staff. As the Medicines and Healthcare products Regulatory Agency (MHRA) has set out, there is little scientific evidence to support temperature screening as a reliable method for detection of COVID-19.
- excuse employers from following the broader national measures in place and any specific regional or local requirements in relation to 'areas of concern' or 'areas of intervention', for example:
- Following the guidance for employers and businesses on coronavirus (COVID-19) protective measures in the workplace.
- Referring staff to the Test and Protect service which offers testing to anyone with symptoms. A virus test can be booked via NHS inform, more advice for employers is available from the Scottish Government.
- Supporting staff to self-isolate if they or a household member have symptoms of, or have tested positive for, COVID-19 or if they are advised to do so by Test and Protect.
- Following the Health and Safety Executive (HSE) guidance on member of staff safety and conducting risk assessments.
This guidance will be updated on an ongoing basis. It applies to Scotland only, and there will be equivalent guidance published for Wales and Northern Ireland. Guidance for use in England is available from UK Government at website - https://www.gov.uk/government/publications/coronavirus-covid-19-testing-guidance-for-employers/coronavirus-covid-19-testing-guidance-for-employers-and-third-party-healthcare-providers
3. Before deciding to test staff
If an employer intends to begin workforce testing arranged privately, and not through a government programme, they should inform their local health protection team (HPT) and local Environmental Health Officers (EHOs). A list of HPT contacts is available on Health Protection Scotland's website.
They should agree with their local HPT the approach to manage positive results.
This should include:
- When a person tests positive using a virus detection test which has not been provided through an NHS laboratory or via the UK Government testing route, they must isolate immediately, seek a confirmatory PCR test through the UK Government testing route, or via the MOU scheme (see Section 5 below). They, and their household, should continue to isolate pending this result. If the confirmatory PCR result is positive this will trigger the usual full Contact Tracing process.
- the circumstances in which they should proactively inform the HPT if they find positive cases through testing, e.g. two or more cases.
A designated contact within the workplace for any issues arising from workforce testing must be appointed, and the employer should confirm that their workforce has been consulted appropriately (see Section 4 of this guidance).
It is important that employers have in place a reporting pathway to their local HPT at the Health Board with whom they must liaise if they perceive they have a developing cluster of COVID cases. This is defined as the appearance of 2 or more COVID cases in a 14 day period. This must be reported to the local HPT who work with the Local Authority's Environmental Health Team in managing outbreaks BEFORE taking action that goes beyond checking that guidance for COVID-19 measures are all in place. Employers must avoid managing outbreaks themselves as that responsibility lies with the local HPT under the Public Health (Scotland) Act 2008, supported by the Managing of Public Health Incidents 2020 (MPHI guidance. It is acknowledged that some specific situations may differ from this e.g. offshore installations.
Before deciding to establish a testing programme, employers are advised that they are clear on:
- Who the testing will cover – for example, whether this is all directly employed staff, or includes individuals working onsite, like contractors.
- The focus of the programme is only for staff without symptoms.
- How often staff will be tested.
- Appropriate facilities for carrying out the tests.
- Which test should be used (to be clear, virus tests are designed to detect active infection whereas antibody tests only reveal evidence of previous infection).
- What the arrangements will be for any individual who does not wish to be tested.
- How the employer will use test results, including its policies on matters like handling health information, absence from work, self-isolation, diversity, non-discrimination, and so on.
- The compatibility of the programme with its legal responsibilities to staff, including under health and safety, equalities, data protection and employment law.
- The affordability of implementing a testing programme.
- Communication of risk to employee and to their close contacts which may include family members.
- Advice on next steps including further test requirements if symptomatic or if test result is inconclusive.
- Advice if an NHS test result is negative where an employer test result is positive.
- The total number of individuals likely to be included in their workforce testing.
- The details of their workforce testing plan (e.g. testing kits to be used, frequency of testing).
- Business resilience plans if a group of staff must immediately self-isolate when identified as cases or close contacts of cases, either by the business or ultimately by Test and Protect.
4. Communicating the intention to test staff
Transparency is very important when outlining to staff an employer's decision to develop and implement a virus detection or antibody testing programme. This applies equally to both laboratory based and non-laboratory based tests.
When communicating with staff about a new internal testing programme, employers are strongly advised to communicate clear information on:
- Why they are setting up a testing programme, as well as or instead of accessing the existing national programme.
- Confirming the voluntary nature of the programme.
- What the consequences are for staff who decline to take part in the testing programme.
- What the next steps are for staff after they receive the result, including what support will be available for those who test positive.
- Where staff can seek advice on their rights throughout the process
- How staff will have the opportunity to discuss the collection of such data if they have any concerns.
- What to do after receiving a test result.
Employers are strongly advised to consult with their staff associations or unions ahead of implementing any policy. Particular regard should be given inclusion of the use of foreign language in such communications depending on workforce composition.
The Information Commissioner's Office (ICO) has set out specific points on GPDR and the Data Protection Act 2018. To comply with the GDPR and the Data Protection Act 2018 employers must:
- Process all data lawfully, fairly and transparently.
- Ensure staff are aware of what personal data is required, what it will be used for, and who it will be shared with taking account of the ICO's guidance on individual rights.
- Make staff aware of how long they are able to keep the data for according to data protection law and for how long they intend to do so.
- Employers are advised to make all staff aware of how their personal data will be processed including sharing with the NHS, before processing begins. Further detailed information on how to do this is set out in the guidance for employers by the ICO.
- Data sharing or data processing agreements need to be in place as well as a current Data Protection Impact Assessment (DPIA) outlining data risks and legal bases for the processing of personal data.
In Scotland, non-NHS laboratories are expected to sign a Memorandum of Understanding (MoU) with a local NHS laboratory to allow for confirmatory testing of all positive tests where necessary. This will also ensure a streamlined process for the incorporation of positive cases into Test and Protect to allow for timely statutory notification and contact tracing.
A list of non-NHS laboratories who have MoU in place with their local NHS laboratory can be found by contacting this address: Nss.firstname.lastname@example.org
The JDG National Quality Group (JDGNQuaG) is currently the group in Scotland which has been tasked with assuring that diagnostic testing in NHS laboratories for SARS-CoV-2 meet minimum acceptable levels of quality and timeliness.
Public Health Scotland guidance on sampling and laboratory investigations is available on the Heath Protection Scotland Webpage.
Whether privately contracted laboratories, academic or in-house laboratories are being used, it is highly recommended that they are UKAS accredited, or working towards UKAS accreditation, and have quality management systems operating according to ISO 15189 and/or ISO 17025. This is the standard used in all NHS laboratories.
If a laboratory is already UKAS accredited, it will still need to apply for an 'extension to scope' to deliver COVID-19 testing. If procuring or being offered laboratory services, it is important to check the laboratory's UKAS accreditation includes COVID-19 testing. You can see more information, including identifying laboratories with accreditation on the website for the UK's accreditation body, UKAS.
An employer or third-party healthcare provider is strongly encouraged to make sure the systems below are in place, as a minimum, before procuring its services:
- Clear governance and lines of accountability e.g. Senior Responsible Officer, Clinical Lead, Quality Lead, Training Lead.
- Staff are appropriately trained and there is evidence of competency assessment and participation in the External Quality Assessment (EQA) competency tool.
- Liability and indemnity cover for staff.
- A validation report for the laboratory element of the test (known as the assay), in line with national protocols.
- Appropriate laboratory information management systems (LIMS) to monitor sample delivery and tracking.
- Working to containment level CL3 or CL2+ with HSE approval.
For non-NHS laboratories out with Scotland, positive results shared by Public Health England (PHE) from their surveillance system with Public Health Scotland (PHS) will be passed on to the appropriate HPT for their assessment of the patient. Following local HPT assessment, for those cases with symptoms or other epidemiological links to a positive case this result can be accepted without further testing and contact tracing interview completed at the same time. However, for those cases without symptoms/supporting evidence it is suggested a repeat sample is arranged locally by the HPT.
All employers and third-party healthcare providers are recommended to make sure laboratories are following PHS, Royal College of Pathologists (RCPath) and Institute of Biomedical Science (IBMS) guidance on safe handling, processing and recording of samples and specimens in laboratory conditions. These include:
- Guidance for sampling and for diagnostic laboratories.
- Guidance on safe handling of samples and processing in laboratories.
- Guidance on retention and storage of pathological records and specimens.
Non-NHS laboratories outside Scotland
When a non-NHS laboratory is based outside Scotland they will not have a Memorandum of Understanding in place with an appropriate NHS laboratory in Scotland. This means that any positive test results from this route will require the individual (if resident in Scotland) to be re-tested in Scotland through the Test and Protect Scotland via a local NHS Laboratory.
In this circumstance the employee must still continue to follow the advice contained in "Virus Testing – Positive test results" below.
6. What test results mean
Tests results identify whether an individual has a current or past infection. For COVID-19, there are two categories of tests: virus detection tests and antibody tests. Before deciding to test staff, it is essential that employers understand what a test result actually means and what actions they need to take for a positive test result.
All employers and employees must follow the guidance for employers and businesses on coronavirus (COVID-19) on COVID-19 protective measures in the workplace, regardless of the result of either a virus or antibody test.
7. Virus detection testing
A virus detection test will identify whether somebody has COVID-19 at that moment.
Positive test results
If a member of staff tests positive:
- They should immediately self-isolate (or continue to self-isolate if they are already doing so) for ten days from the date of the test. As long as they are then well with no fever for 48 hours (and no anti-pyrexials), they can then return to work.
- Self-isolation of household members is also required for 10 days from the date of onset of symptoms in the worker case or from their test date for those who are asymptomatic.
- Where laboratory based, PCR testing has been used, the NHS lab with which an MoU has been signed should be contacted to arrange a confirmatory test. Until this has been completed, the test result is an unconfirmed positive.
- Where non-laboratory based testing (e.g. lateral flow) has been used, the employee should arrange for a confirmatory PCR test through the public (i.e. UK Government) test booking portal.
- Following a confirmatory test, the individual should share information promptly about their recent contacts when they are contacted by the contact tracing service so that Test and Protect can alert all contacts if they need to self-isolate.
Negative test results
If a member of staff tests negative for the virus this means they are at low risk of having COVID-19 at the time of testing. It does not mean they are definitely negative for COVID-19 nor does it mean that they are no longer at risk since they may still be incubating the virus. A member of staff does not need to self-isolate if their test is negative, as long as:
- No other member of their household, or extended household, has symptoms or has tested positive.
- The NHS Test and Protect service (including the Protect Scotland app) has not told them to self-isolate
- They are not displaying any symptoms of COVID-19.
- They feel well – if they feel unwell with symptoms not associated with COVID-19 they should stay at home until they feel better.
- They have not otherwise been identified as a contact of another case
- They have not returned from travel, necessitating self-isolation of quarantine.
See more details on what a virus test result means.
The use of non-NHS laboratory virus detection testing should only be used for asymptomatic individuals. Employers should refer symptomatic staff for NHS virus testing (e.g. PCR), in the usual manner through Test and Protect.
Employees displaying symptoms must self-isolate immediately and should not attend work unless this can be done from home. The household must also self-isolate pending the test result.
The NHS Test and Protect service is for those who display symptoms of COVID-19 or who have been advised to take a test by a medical practitioner or public health service. Unless a member of staff had a positive private test already, employer and third-party healthcare providers must not advise individuals without symptoms to get a test from the limited supply offered by Test and Protect. Any alternative private provision, should be delivered in accordance with this guidance.
When testing asymptomatic staff, the current advice is clear that a virus test will provide evidence of the presence of the virus that causes COVID-19 at that moment in time, but not in all circumstances. If employers wish to offer repeat tests to asymptomatic staff, there is not yet a clinically-defined number of times that an individual should be tested within a given timeframe.
If somebody subsequently develops symptoms after receiving a negative result having been tested while not displaying symptoms, they (and their household) must self-isolate and they are advised to be re-tested as soon as possible through Test and Protect.
Following a previous confirmed positive virus test through the NHS service, an individual does not require a repeat virus test for a period of 90 days from the previous positive test unless they are symptomatic, in which case they must self-isolate and arrange a virus test via Test and Protect.
8. Communicating Results to Staff
Communicating results to the person who had a test
It is a legal obligation for employers and third-party healthcare providers to directly share an individual's test results with them. An employee may agree to have their results transmitted to their employer first (or at the same time as they receive them). All employees tested should be told of the results and be provided with the relevant information on action to take once this result is available.
What will happen to the employees' results, who they will be shared with, why and when should be clear to the staff member before they take the test.
It is highly advised that when the result is communicated to the person it is accompanied, with clear information on what the results means in non-technical language, along with what actions they should take.
A healthcare professional is expected to communicate the results but in the absence of a healthcare professional a person owing a similar duty of confidentiality to the employee may communicate test results (e.g. someone who works in occupational health or HR who has signed confidentiality clauses over and above the employer's standard wording and has received additional training on the handling of sensitive health data).
Clarity should be provided to the employees as to how results will be communicated. If results are being communicated via text message or app, it is strongly encouraged for a healthcare professional (or a person owing a similar duty of confidentiality) to be accessible to members of staff to discuss the results.
Communicating a positive virus test case to the workforce and others
Employers are encouraged to keep staff informed about the overall COVID-19 situation in the workplace. However, they should not name individuals, and should not unlawfully share anyone's personal data (including anyone's test results).
The ICO is clear that data protection law doesn't prevent an employer ensuring the health and safety of their staff. It should not be viewed as a barrier to sharing data with authorities for public health purposes when necessary and proportionate, such as working with the NHS Test and Protect service and statutory notification of infection under the Public Health (Scotland) Act 2008 and reporting to the Health and Safety Executive (HSE) under RIDDOR- Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013, when relevant. More information is provided by the ICO's FAQs.
9. Antibody testing
Antibody testing is not widely undertaken by non-NHS laboratories, however we are aware that some do provide this service.
An antibody test looks for the presence of antibodies (produced by people following infection with the virus) against the COVID-19 virus. The clinical significance of antibody testing has not yet been determined at the individual level, though it is being used for population surveillance purposes. Therefore, any antibody result (positive or negative) should not change a persons' behaviour either within or out with the workplace and is currently not supported for workplace assessment.
It is important to recognise that there is currently no strong evidence to suggest that those who have antibodies have developed long-lasting immunity which would prevent them from getting the virus again. Everyone (testing positive or negative) should continue to follow safer workplace guidelines including social distancing measures.
The value of antibody tests is currently limited to answering the question of whether someone has had the virus or not and helping us to understand more about the virus and how it spreads.
See more details on what an antibody test result means.
10. Selecting and procuring test kits
Selecting a type of test
The MHRA has set out guidance explaining how both virus detection and antibody tests work.
Third-party healthcare providers who offer a testing service are strongly advised to be as open and clear with employers as possible when informing them of the clinical specification and implications of the test result and in particular the need to self-isolate when required.
Procuring test kits
Test kits in the UK are regulated by the MHRA, which is responsible for administering and enforcing the law on medical devices in the UK. It has a range of investigatory and enforcement powers to ensure their safety and quality.
As with all medical devices sold in the UK, manufacturers must place a CE mark on products that diagnose diseases (sometimes known as IVDs).
Tests without a CE mark are not legally allowed to be placed on the EU and UK markets unless they have an exemption. All tests granted an exemption during the pandemic are published by the MHRA.
Employers must make sure that the test kit they or their provider is procuring is legal in the UK either through having the CE mark or an exemption.
Non-Laboratory Based Testing
In addition to lab-based private testing focusing on PCR tests, some employers may wish to establish workforce testing using non-lab based tests, such as lateral flow devices (LFDs).
If a company is considering introducing asymptomatic testing, they should consider a range of factors about the test itself, including the purpose for which tests are designed, the specificity (how effective the test is at identifying Covid-19) and sensitivity (the percentage of positive Covid-19 cases the test will identify) of such tests. LFD testing has significantly lower sensitivity than PCR testing, which is used for public tests. They should also consider whether the particular LFD tests being considered have been independently validated in terms of sensitivity and specificity.
There are several factors an employer should consider if they decide to use LFDs. Staff must still be consulted on the tests they are being asked to use and how their personal information and results will be handled, and must still be informed of what they are expected to do in the event of a positive result from an LFD, which will be treated as an 'unconfirmed positive' until a confirmatory second test through the UK Government booking portal. See Section 4 for further details.
The effectiveness of LFD tests, and all self-test kits, also depends on test kit instructions being clear and effectively followed by the user. An employer must be confident that anyone asked to use a test kit carries out testing in accordance with the manufacturer instructions, is given clear advice on how to do so effectively, and support if they feel unable to do so. LFDs are to be used for asymptomatic testing only, and anyone with symptoms must stay off work and is strongly advised to arrange a test via NHS Inform.
Staff who receive an unconfirmed positive result from an LFD test must book a PCR test through the NHS immediately. They must also self-isolate, along with their household, as soon as they receive an unconfirmed positive result from an LFD test. If the result is received at work, the person should leave work to self-isolate straight away and wear a face covering on route and avoid public transport. Employers should support staff to isolate, in accordance with the advice for employers in the Scottish Government Test and Protect guidance: https://www.gov.scot/publications/coronavirus-covid-19-test-and-protect/pages/advice-for-employers/ The employer must report positive test results to the local HPT, as per agreed reporting pathways (see Section 3).
- The EU directives below have more information on the definitions and regulations of medical devices:
- The In Vitro Diagnostic Medical Devices Directive 98/79/EC – sets out the regulatory requirements for in vitro diagnostic medical devices (test kits).This was transposed into UK law in the Medical Device Regulation 2002.
- The Medical Devices Directive 93/42/EEC – sets out the regulations for other medical devices (i.e. swabs, lancets) and for software (including apps) which meet the definition of a 'medical device'.
If a testing service takes on the role of legal manufacturer then the regulations that cover manufacturing become obligations.
Third-party healthcare providers and any staff responsible for procuring test kits on behalf of the employer are strongly advised to be aware of the MHRA's guidance below:
- Guidance on the In Vitro Diagnostic Medical Devices Directive 98/79/EC. This guidance outlines the current controls on the sale and supply of IVDs (test kits) and explains the main features of Directive 98/79/EC which regulates the manufacture and procurement of an IVD.
- Guidance on Management of In Vitro Medical Devices. This guidance is aimed at all staff who are responsible for purchasing, supplying, using, maintaining and replacing IVDs (test kits).
11. Collecting COVID-19 samples to test
The Medical Devices Directive 93/42/EEC and the In Vitro Diagnostic Medical Devices Directive 98/79/EC require test kits and sampling kits to have appropriate instructions for use for the intended sample collector, whether that is a healthcare professional or lay person.
The packaging and labelling must also clearly advise on the correct storing, handling and transporting of the device.
Everyone who is responsible for overseeing sample collection must understand these instructions clearly and are encouraged to feed information into manufacturers' post market surveillance system through the Coronavirus Yellow Card Reporting Site. MHRA has published guidance on reporting to the yellow card scheme for health care professionals.
There are currently 2 methods for collecting samples for COVID-19, that apply for both virus detection and antibody testing:
1. Tests administered by a professional
A sample is collected by a trained and qualified healthcare professional. The results should be interpreted by a trained and qualified healthcare professional.
If the test is administered by a health professional as part of an employer's in-house occupational health offer, whether sub-contracted or a regular employee, they may not need to register with any regulatory body. If the professional works for a contracted healthcare provider which has additional work out with the employer's operations, they may need to be registered with Health Improvement Scotland (HIS) as an independent clinician or clinical body. There will also need to be HIS registration if the employer is testing individuals other than employees, e.g. a testing offer to members of the public. You can see further guidance on regulating coronavirus (COVID-19) testing.
2. Self-administered/assisted sampling tests
The sample is collected by the person having the test (self-administered) or by someone else (assisted) in a home or non-laboratory environment like a police station, care home or drive-through centre.
Employers are strongly advised to make reasonable adjustments for a member of staff's personal situation if they are requested to provide a sample, for example taking into account if they can't drive to a testing facility.
It is very important for self-administered/assisted sampling tests that employers and third-party healthcare providers are aware:
- Of the NHS guidance on How to use self-test kits safely and Warning about self-test health kits, including appropriate PPE. All staff who are asked to collect a self-administered virus test sample are also advised to watch the short video on how to self-administer a swab from a sample kit.
- That self-administered/assisted sampling is sometimes confused with less reliable 'self-test kits'. A self-test kit involves a non-medical professional, for example the individual member of staff, collecting their own sample. They then test that sample and read and interpret the results by themselves rather than sending the sample to a laboratory for testing and processing. None of these COVID-19 kits have currently received a CE mark and so there are no self-test kits in the UK suitable for home use (excluding approval from MHRA for use of the Innova LFD test for use in certain circumstances only). Using the wrong type of testing kit in the wrong setting can lead to inaccurate results, a false sense of confidence and increased pressure on our NHS and social care systems.
After a sample is collected, the individual being tested is advised to follow the below steps while waiting a test result:
- If symptoms develop during the period of waiting, the individual being tested and anyone they live with, or are in an extended household with, should self-isolate until the result of the test has been received.
- If asymptomatic, the individual being tested does not need to self-isolate, unless they have been identified as a close contact themselves and asked to self-isolate by Test and Protect.
Further information can be found at the HPS Website - COVID-19 - packaging of diagnostic samples for onward transportation (scot.nhs.uk)
12. Handling samples in transit
Employers are advised to follow the World Health Organization guidance on regulations for the transport of infectious substances 2019-2020.
It is a legal duty for those responsible for the handling, transportation and laboratory analysis of test samples to meet the provisions set out in The Control of Substances Hazardous to Health Regulations 2002 Schedule 3: Additional Provisions Relating to Work with Biological Agents. Employers and third-party healthcare providers are strongly advised that they ensure these provisions are met.
13. Collection of results
SARS CoV-2 PCR test results undertaken in NHS Labs will be reported via the NHS lab's LIMs into the national ECOSS system for onward transmission into Test and Protect
Data will be stored securely and for the requisite amount of time.
Awareness of false results
False results undermine the reliability and effectiveness of our response to COVID 19.
Employers and third-party healthcare are strongly advised to report all suspected incidents that may lead to false virus detection or antibody test results (both false negative and false positive) associated with medical devices and IVDs:
- Health institutions in Scotland are advised to report via MHRA and Health Facilities Scotland Incident Reporting and Investigation Centre.
Collecting negative virus test results and antibody test results to support national understanding
We are learning more about this virus every day. To help us all to better understand COVID-19, employers and third-party healthcare providers are strongly encouraged to work with the government, via PHS, to share vital data.
Data collection and individual rights
Data protection does not prevent the necessary and proportionate use of personal data for COVID-19 response. Data protection law has built-in flexibility to ensure it does not prevent appropriate health and safety measures being implemented in the workplace or action taken in the overwhelming public interest. Nevertheless, there are important data protection considerations to take into account when processing personal data, particularly health data.
The ICO has set out FAQs on data collection and data protection relating to COVID-19 that provide further information.
14. Use of technology (such as apps) to capture and disseminate results.
Apps that are used to capture, store and disseminate health results can be considered to be medical devices, and so are regulated by the MHRA under The Medical Devices Directive 93/42/EEC.
Employers and third-party healthcare providers have a legal duty to meet these regulations if apply to their technologies. You can see further information by the MHRA on when software applications are considered to be a medical device and how they are regulated.
When developing apps for data collection, employers and third-party healthcare providers should capture only the minimum data necessary. The ICO has published guidance for app developers. The MHRA has also published advice for apps and software that is used or developed in response to COVID-19.
15. Contact tracing
Test and Protect
The Scottish Government has developed Test and Protect to ensure that anyone with symptoms of COVID-19 can quickly be tested to find out if they have the virus, help trace their close recent contacts and, if necessary, notify them that they must self-isolate at home to help stop the spread of the virus.
All laboratories processing notifiable virus tests using PCR are legally required to notify PHS when a positive test is identified. The sample should then be retested through an NHS laboratory per the terms of the MoU referred to elsewhere in this guidance for a confirmatory test. Until this has been done, the positive result from the private testing program is an unconfirmed positive.
This begins the Test and Protect process of contact tracing. Test and Protect will not generally contact employers unless two or more new COVID-19 cases are linked to a workplace setting. If employers identifies that there is more than one case of COVID-19 on their premises over a period of 14 days, they should contact their local Health Protection Team to report the suspected outbreak.
It may be helpful for employers to collect lists of staff, contractors, visitors to sites so that the local Health Protection Team (HPT) can start assessing close contacts as soon as possible, however, they should not undertake formal contact tracing and advising on isolation etc. but should cooperate in further investigations led by the HPT.
An individual who is not defined as a contact by the NHS Test and Protect service does not qualify for Statutory Sick Pay. If an employer decides to keep the employee away from the workplace the employer, where possible, should arrange for the member of staff to continue to work from home. If working from home is not possible the employer may have to keep them on full pay. If an individual is contacted by Test and Protect, they will be eligible for Statutory Sick Pay (if they meet the other eligibility criteria) from the day that Test and Protect has told them to self-isolate. Test and Protect will further advise on what other support for isolation is available locally.
If employers choose to take precautionary measures by keeping an asymptomatic member of staff away from the workplace, the employer is strong advised to ensure they are providing them with the correct support.
Meantime, they should:
- Avoid contact with people at high increased risk of severe illness from coronavirus, such as people with pre-existing medical conditions.
- Take extra care in practising social distancing at 2 metres at all times and good hygiene.
- Watch out for symptoms and self-isolate if they also show signs of coronavirus.
Employers should not attempt to trace any contacts within or beyond the workplace, but should refer these cases to the local Health Protection Team. Employers need to advise the positive individuals to self-isolate pending NHS results.
16. What an employer can do with the results
Employers can use virus detection test results to understand who in their workforce currently has asymptomatic COVID-19 and who needs to isolate following a positive COVID-19 virus detection test.
Any positive test through an employer's non-NHS testing program must be retested at an NHS lab. Until this is done it is an unconfirmed positive result.
The legal basis by which the personal identifiable information is shared between the non-NHS Diagnostic Lab and the NHS Lab under Data Protection legislation is 6.1(e) processing is necessary for the performance of a task carried out in the public interest and 9.2 (i) processing is necessary for reasons of public interest in the area of public health.
They can also use antibody test results to understand the percentage of their workforce that has already potentially had COVID-19.
17. What an employer cannot do with the test results
An employer must ensure that any lists of members of staff made from collecting their sensitive health data, including their test results, do not result in any unfair or harmful treatment of employees.
Information must not be used shared or retained for purposes different to what it was collected for nor would not reasonably expect.
If a member of staff receives a positive antibody test result, employers cannot assure them that they are immune, or allocate to them any form of immunity certification, for example an 'immunity passport'.
Employers should not treat staff who have had a positive antibody test any differently from staff who do not.