Having inadequate communicable-illness policies and response plans related to coronavirus could expose companies to a laundry list of HR-related legal concerns including workers’ compensation, invasion of privacy, discrimination, unfair labor practice, and negligence lawsuits. With careful attention to employee safety and legal preparedness employers can minimize employees’ risk of infection and their own legal risks. This article covers eight steps companies should take.

Aleksandr Zubkov/Getty Images

Leer en español In these difficult times, we’ve made a number of our coronavirus articles free for all readers. To get all of HBR’s content delivered to your inbox, sign up for the Daily Alert newsletter.

With the rapid global spread of coronavirus, companies should focus first and foremost on employee safety. And as they’re reviewing their strategies, policies, and procedures, many leaders are specifically wondering about their legal risk. Not having adequate communicable-illness policies and response plans could expose them to a laundry list of HR-related legal concerns.

Most countries have laws designed to protect employees from physical harm at work. In the United States, employees are protected under the Occupational Safety and Health Act, so if an employee becomes infected at work, in some circumstances the employer may face penalties. Unprepared employers may be exposed to lawsuits related to workers’ compensation, invasion of privacy, discrimination, unfair labor practice, and negligence.

The good news is that with careful attention to employee safety and legal preparedness, employers can minimize employees’ risk of infection and their own legal risks. Following are eight steps companies should take to these ends. The value of these efforts, of course, is relevant to any life-threatening infectious disease, not just coronavirus.

Stay informed

Start by identifying authoritative sources of public health guidance on the epidemic, and stay up to date on officially recommended and mandated actions in the applicable jurisdictions. These sources include The Centers for Disease Control and Prevention, The World Health Organization, The European Center for Disease Prevention and Control, and country-specific public health guidance such as this for Singapore and this for the United Kingdom.

This official guidance should serve as the foundation for organizational decisions about health- and legal-risk mitigation. Being able to demonstrate corporate policy alignment with official recommendations can be an important legal safeguard in cases where the company’s infection-control efforts are challenged.

Intensify communications and hygiene

For legal and practical reasons, companies need to be able to show that they have given employees accurate information about ways to prevent the spread of infection — and that they have provided people with the means to act on that information. Thus, organizations should educate employees, in advance of any workplace infection, about modes of transmission and symptoms by sharing specific public health guidelines and, more broadly, directing staff to the official sources of information on which the organization will rely.

In addition, employers must implement measures to reduce the risk of workplace transmission. For example, public health guidance for reducing transmission includes ensuring that employees have easy access to handwashing facilities and/or hand sanitizers and that public surfaces such as counters, doorknobs, and elevator buttons are regularly disinfected. Employers may also consider changes to reduce overcrowding, such as facilitating remote work, shift work, and perhaps physical layout changes. Such measures may help protect workers from infection and help protect organizations from liability.

Employers should also instruct staff to inform management if they have been exposed to the virus or show symptoms of infection, or if they, or a member of their household, have particular vulnerabilities such as a weakened immune system that may require enhanced protections from infection. Further, staff with symptoms of infection should be sent home or instructed to stay home, and visitors who have been exposed or who have symptoms should be excluded from the workplace. Failure to provide this guidance can potentially expose a company to liability should employees become infected in the workplace and it can be shown that management had not communicated about this policy. (Although disability discrimination laws protect employees with covered health conditions, limitations can generally be imposed if there’s a direct threat to the health or safety of others.)

Consider restrictions on returning to work

While employers risk discrimination claims if they base decisions to restrict employees from work on grounds of race or national origin, they can impose reasonable, fact-based restrictions if there is a direct threat to the health or safety of others. An employer can judge, by applying official guidelines or with input from a medical consultant, whether and when an employee who has been ill or who has potentially been exposed can safely return to work. Written policies should be explicit about when employees with potentially transmissible conditions will and will not be allowed back, and relevant communications should be documented.

Be mindful of an employer’s duty of care

Most countries have laws designed to protect employees from physical harm at work. For multinational employers and those with mobile employees, it is important to identify the applicable country laws (which may be more than those of a single jurisdiction in some cases), as one size will not fit all.

In the United States, employees are protected under the Occupational Safety and Health Act (OSH Act). Section 5(a)(1) of the OSH Act is the general duty clause, which requires employers to provide their employees with a workplace “free from recognized hazards … likely to cause death or serious physical harm.” The federal Occupational Safety and Health Administration (OSHA) can cite employers for violating the general duty clause if there is a recognized hazard and they do not take reasonable steps to prevent or abate the hazard. However, OSHA citations can only be based on standards, regulations, or the general duty clause.

State-mandated workers’ compensation programs, and a separate program for federal workers, provide benefits to eligible employees who suffer job-related injuries and illnesses (these vary state by state). As a rule, where the harm arises out of and in the course of employment, employees are limited to the prescribed workers’ compensation benefits and cannot recover damages for pain and suffering or mental anguish. Some states allow additional awards — beyond normal workers’ compensation awards — when injury results from an employer’s “willful” or “intentional” act, which might include failure to provide appropriate protections.

Businesses also have to consider liability to third parties, such as customers, which may not be so limited. For example, a restaurant employee infected on the job will only be entitled to workers’ compensation, but theoretically the patrons they may infect could seek greater damages.

Evaluate leave and pay

Employers should analyze their legal obligations to provide employees with leave in the event of sickness or disability and evaluate whether their policies need to be adjusted in the current circumstances. In the U.S., the Family and Medical Leave Act (FMLA), the Americans with Disabilities Act (ADA), and state workers’ compensation laws will apply, as well as any contract and policy language. Exclusions from insurance policies should be identified — for example, many travel insurance policies exclude pandemics.

Drawing on this analysis, companies should consider under which circumstances they would want to extend or expand benefits and protections, and they should evaluate their level of income protection for employees on leave, perhaps adjusting benefits plans for employees who exceed their sick-day allotment in order to support sick employees who must stay home.

It is important to look beyond the immediate legal requirements to the broader business and legal implications. For example, a business may not be legally required to pay an employee during a period it bars him or her from the workplace because that individual was on personal travel to a place where transmission was occurring. However, choosing not to do so makes it more likely that they prematurely return to work, thereby infecting other staff, risking business continuity, legal liability from third parties such as customers, and contributing to an increase in infections.

Alleviate stress and anxiety

Stress and anxiety related to coronavirus infection could also become a legal concern. The legal standards will vary by jurisdiction. For example, employers in the United Kingdom have a duty to assess the risk of stress-related, ill health arising from work activities, and they are required to take reasonable measures to control such risks. In some cases, this may mean taking steps beyond the minimum if doing so is not unduly burdensome to the employer and mitigates the psychological burden on the employee. For example, rather than terminating the employee for refusing to come to the office due to fear of contagion, even though all officially recommended precautions have been taken, an employer might be more flexible in allowing time off or remote working arrangements. Such steps can help U.K. employers avoid claims of unfair dismissal.

Employers should be aware that mental health conditions such as germophobia may be protected as a disability under laws such as the Americans with Disabilities Act and require that employers take a modified approach pursuant to reasonable accommodation requirements.

Protect privacy

Employers should understand which personal health data an employee might be obligated to disclose if he or she becomes infected or is at high risk for infection — likely, anything that could interfere with the employee’s ability to perform the essential functions of the job, or that could increase the risk to coworkers or third parties through workplace contact. Failure to understand the legal obligations in relation to such data could expose the company to breach of privacy claims.

Fortunately, even rigorous privacy rules allow employers to disclose employees’ protected health information to authorities for public health purposes. That said, all such data must be handled within the organization’s data privacy protection framework, and if such data is being transmitted from the European Union to the United States, care should be taken to do so in compliance with the General Data Protection Regulation (GDPR).

Plan for a worst-case scenario

Contingency planning may include, for example, temporary succession planning for key decision-makers, and understanding and preparing in advance for the legal requirements in cases of furloughs and layoffs. Many jurisdictions require more formal procedures and notifications for layoffs above a certain number of employees. A failure to comply can have severe penalties for employers and even personal liability in some cases for their leadership. Planning ahead in order to stay compliant is an important part of an organization’s resilience program.