United States: University Preparedness For A Pandemic: Key Testing And Privacy Considerations Every University Should Be Aware Of

Introduction

The leadership of every university and institution of higher learning is currently struggling with when and how to open for on-campus learning, and whether it can do so in a way that complies with federal guidelines, state and local orders, and the concerns of parents, students, faculty, staff, and the community. As they wrestle with questions involving class size, dormitory space, dining facilities, labs, sports, the arts, and other student activities, perhaps the most significant and complicated challenges involve the availability and frequency of testing. This Advisory highlights key considerations for obtaining, analyzing, and reporting the testing of students and employees—including associated privacy concerns—that universities should keep in mind as they refine their pandemic response plans and prepare for a safe reopening.

Securing Testing for Students

An effective pandemic preparedness and response plan for any institution includes a means for early detection of infection, typically through testing, in order to effectively and efficiently contain the spread of illness throughout the community.¹ Those concerns are particularly acute for institutions of higher learning whose very essence has always been for students and faculty from all over the world to come together in close proximity for extended periods of time.

After a declaration of a public health emergency, as the Secretary of Health and Human Services (the HHS Secretary) did during the current pandemic², an institution of higher learning has several options to secure testing for its students and employees when there is not yet one that the Food and Drug Administration (FDA) has cleared or approved: (1) develop its own test and obtain emergency use authorization (EUA) from FDA or through a sanctioned state pathway (if applicable); (2) acquire a third-party test for use on campus; or (3) partner with a third party for off-campus testing.

Developing a Test and Obtaining an EUA or Pursuing a Sanctioned State Pathway

Under the Food, Drug, and Cosmetic Act (FD&C Act), FDA has authority to regulate medical devices, including in vitro diagnostic tests. Generally, FDA requires such devices to be cleared by the Agency prior to their marketing within the United States.³ However, pursuant to section 564 of the FD&C Act, the HHS Secretary can authorize the use of an unapproved/uncleared medical product for certain purposes after a declaration of emergency or threat that justifies the exception.⁴ In such circumstances involving an epidemic or pandemic, an institution may circumvent the generally required premarket clearance and obtain an EUA to develop and use its own test for the duration of the emergency.⁵

In order to obtain such an EUA, an institution must provide FDA with material sufficient to show that the test's potential benefits in facilitating the diagnosis or identification of the illness outweigh the known and potential risks associated with the test's use.⁶ If FDA determines that the totality of the circumstances and information support issuance of an EUA, FDA will issue a letter to the sponsor institution that describes, among other information, the scope of authorization and any conditions, such as limitations on the type(s) of laboratories that may administer the test.⁷

States may also authorize their own pathways as an alternative to seeking an EUA from FDA. During the current pandemic, the President issued a Memorandum on Expanding State-Approved Diagnostic Tests⁸ that directed the HHS Secretary to facilitate requests by States to authorize laboratories to develop and perform tests that detect COVID-19. See "Analyzing Testing" section below. Pursuant to this memorandum, FDA is permitting states and territories to do so for laboratories that are certified to perform high-complexity testing under the Clinical Laboratory Improvement Amendments (CLIA) (42 U.S.C. § 263(a)).⁹

Acquiring a Third-Party Test

Institutions that may not want to pursue the potentially lengthy and complicated process of developing a test and obtaining an EUA or state authorization, but are interested in testing on campus, may prefer to acquire a third-party test that is already subject to an EUA. However, it is important to keep in mind that some EUAs may restriction who may conduct particular tests and which laboratories are authorized to process and analyze the collected specimens. For example, an EUA may limit testing to the laboratory that developed the test. Similarly, an EUA may describe the certification a laboratory must possess in order to perform testing (i.e., the EUA may limit testing to specific laboratories certified under the Clinical Laboratory Improvement Amendments (CLIA) to perform certain types of testing). In other words, universities cannot assume that they may simply acquire third-party tests, and then choose laboratories with which to contract for processing and analysis. If the EUA for a third-party test imposes restrictions, universities may need to identify another suitable test that does not come with the same limitations.

Partnering with a Third Party for Off-Campus Testing

Alternatively, a university could consider partnering for off-campus tests with a third party that has authorization to perform them. In other words, rather than testing its students and faculty on campus, a university could opt to contract with nearby facilities in the same way that health care providers often send their patients for blood work. Universities choosing this option should exercise due diligence to ensure that the tests being administered are authorized by FDA and are analyzed in a CLIA-certified laboratory.

Analyzing Testing

In addition to securing testing options for students, universities must also ensure that they have appropriate laboratory access for analysis. They effectively have two options: (1) they can have the samples examined in their own CLIA-certified laboratory facilities; or (2) they can arrange for an external laboratory to do so. Each avenue raises its own discrete issues.

Analyzing Tests in On-Campus Laboratories

In order to analyze tests on campus and report results, a university must have a CLIA-certified laboratory. CLIA applies to all laboratories that examine "materials derived from the human body for the purpose of providing information for the diagnosis, prevention, or treatment of any disease or impairment of, or the assessment of the health of, human beings,"¹⁰ which would include those analyzing tests to detect COVID-19 and other infectious diseases. Although the CLIA program is operated by the Centers for Medicare and Medicaid Services (CMS), the requirements apply even if the specimens are from those not enrolled in those programs.¹¹  Notably, CMS is not empowered to waive the CLIA requirements during an emergency (such as a pandemic).¹² And, although CLIA is a federal program, it is administered by state agencies, many of whom are also enforcing their states' own additional laboratory licensing requirements—all of which would apply in this context as well.

Sending Tests to External Laboratories

Many universities may choose to test students on campus and send specimens to external laboratories for analysis—an option that does not require the university to have a CLIA-certified laboratory.¹³ However, universities must still ensure that they have a process in place to properly ship specimens to labs for testing.

The shipment of infectious disease specimens (such as those collected when a student or employee is tested) is regulated by the Pipeline and Hazardous Materials Safety Administration (PHMSA) of the US Department of Transportation, and the requirements vary based on the infectious disease. Category A infectious substances are those that are transported in a form that, were exposure to occur, could cause life-threatening illness or death in an otherwise healthy human or animal.¹⁴ All other infectious substances are designated as Category B.¹⁵ In the current pandemic, PHMSA has determined that specimens from patients being tested for COVID-19 are Category B infectious substances.¹⁶

PHMSA imposes specific packaging, shipping and labeling requirements on Category B infectious substances. For example, such substances must be placed in triple packaging, the packaging must pass a "drop test," the labeling must uniquely identify the contents as infectious substances; and the specimens may require refrigeration.¹⁷ Because these requirements are so stringent, universities choosing to collect samples on campus for shipment to an external laboratory for analysis should be certain whether the external laboratory is taking responsibility for compliance.

Reporting Positive Tests

While the universities' primary interest in testing is to protect the health and safety of its community, and to make appropriate decisions about cohorting and treatment, the universities' decision to embark on widespread testing carries obligations to report positive results to a variety of federal, state, and local authorities, including FDA, the Centers for Disease Control and Prevention (CDC), and state health departments. These requirements can be complicated, and may often overlap. For example, while the CDC has been working with state and local health departments across the country to collect COVID-19 testing data,¹⁸ there are often duplicative reporting requirements. Additionally, FDA has included a requirement in the EUAs for COVID-19 that results be reported to relevant public health authorities. As such, universities should develop a process for the prompt reporting of positive test results in accordance with federal, state, and local requirements, while also protecting the privacy of students and employees.

Privacy Implications

While testing students and employees on campus can provide convenience and peace of mind, it also raises significant privacy concerns, particularly if universities are required to report positive test results to local, state, or federal public health authorities. And, to the extent universities also undertake contact-tracing,¹⁹which can be a very valuable part of a multipronged approach to further contagion,²⁰ additional privacy considerations exist.

The privacy of student health records is protected by the Family Educational Rights and Privacy Act (FERPA) to the extent that the records are maintained by an educational institution that receives funds under any US Department of Education program.²¹ Under FERPA, postsecondary educational institutions may not disclose personal identifying information (PII) from a student's education records absent prior signed and dated written consent from the student, unless an exception applies.²²

The Department of Education has also issued guidance on FERPA in the context of the COVID-19 pandemic which is instructive for universities as they develop plans to respond to future pandemics.²³

In particular, the guidance highlights that FERPA contains a "health or safety emergency exception." Pursuant to that exception, a university may disclose PII from a student's education records to appropriate parties, such as a public health agency or medical personnel, without obtaining prior consent if necessary to protect the health and safety of the student or others.²⁴ As a prudential matter, however, universities should minimize any disclosures of PII, if doing so will not undermine public health goals. When deciding whether the disclosure of student PII is necessary, a university must consider the totality of the circumstances to determine whether there is a significant and articulable threat to the health and safety of a person at the university or elsewhere.²⁵ Within a reasonable amount of time after the disclosure, a university must document in the student's education records the threat that justified the release of the PII and the parties to whom the PII was disclosed.²⁶

Universities should also take care that they disclose PII about a student's diagnosis only to "appropriate parties."²⁷ Typically, "appropriate parties" are unlikely to include other students, professors, and most staff.²⁸ Thus, in disclosing that a student has been infected, universities may generally disclose to those groups only the fact of such infection in a student, without revealing his or her identity.²⁹ Not only may the university not release information that would make the student immediately identifiable (e.g., the student's name), but it also may not release multiple pieces of information that would allow a reasonable person to identify the student at issue (e.g., releasing a single student's class year, schedule, and dormitory).³⁰

Notably, FERPA applies only to health information about students; it does not protect the health information of others, such as faculty and staff.  A university will have privacy obligations with respect to their employees, however, under other law. To the extent a university provides healthcare to employees, such as through an on-campus clinic, the clinic (and potentially the university itself) may be a "covered entity" under the privacy regulations implementing the Health Insurance Portability and Accountability Act (HIPAA).³¹  Much like FERPA, the HIPAA privacy rules generally require that covered entities obtain written consent before using or disclosing personal health information (PHI) in these types of circumstances, but provide an exception where use or disclosure is necessary to "prevent or lessen a serious or imminent threat to the health or safety of a person or the public," so long as the disclosure is to a person who is "reasonably able" to prevent or lessen the threat.³² As discussed in our prior advisories on HIPAA and COVID-19, HHS has underscored that the HIPAA privacy rules will not stand in the way of uses and disclosures of PHI, without obtaining an authorization from the individual to whom the PHI pertains, for key COVID-19 prevention purposes.³³

Finally, the Americans with Disabilities Act and the Family Medical Leave Act restrict what employee health information a university may request, and how a university may respond once it receives this information. For example, in the event of a pandemic, a university should inform others on campus of the diagnosis of an employee, but should not disclose the identity of the diagnosed employee. Universities may wish to also ask diagnosed employees for a list of work-related persons—including coworkers and students—with whom they had contact and inform those people of the diagnosis (without identifying the employee, unless the university has received consent, ideally in writing). For additional information about privacy considerations for employers during a pandemic, please see our prior Advisory on the subject.

Other Key Considerations

While the specific steps that a university will need to take to ensure student and employee safety will depend on the particular disease, universities should expect that they will need to regularly clean and disinfect living areas, classrooms, offices, and common areas; provide adequate space within these areas for social distancing; require and provide masking, gloves, hand sanitizer, or other measures where warranted; and institute appropriate screening in certain situations. Guidance issued by the Centers for Disease Control and Prevention and Occupational Health & Safety Administration relating COVID-19 can assist universities navigate the current crisis and serve as a guidepost in the event of a similar episode.

Although state and local requirements are likely to evolve during a pandemic, there are several additional labor and employment issues that universities should be prepared to address as well. For additional information about important pandemic considerations for employers, please see our Advisory here.

Additionally, universities should prepare to respond to federal, state, and local legislation relating to sick leave requirements. Such legislation passed during the COVID-19 pandemic has required many employers to provide employees with up to 10 days of sick leave. Universities should anticipate similar measures in the event of a future pandemic, and should have a plan to monitor and quickly respond to the passage of such legislation. A pandemic response plan should also include a procedure for laying off, furloughing, or reducing the hours of employees during a pandemic. This procedure should be consistent with relevant wage and hour laws, and should also anticipate circumstances in which employees refuse to come to work as a result of pandemic fears. Of note, even if employees at a university are not unionized, the National Labor Relations Act protects the rights of employees to engage in "concerted activities" relating to working conditions.³⁴

Finally, included in any university's pandemic preparedness plan should be a strategy to engage with federal, state, and local stakeholders (e.g., elected officials, public health agencies). Given the potential for diverging pandemic messaging at all levels of government, as has been the case during the COVID-19 pandemic, universities would be well advised to have a means of obtaining accurate, real-time information and guidance. A well thought out plan will help identify the key stakeholders and provide a step-by-step strategy of how to best engage them.

Key Takeaways

After a semester of on-line learning, members of every university community are eager to return to campus, but apprehensive about how those universities will mitigate the risk of infection and contagion. Every university's highest priority must be the safety of students, faculty, and staff, and it will require extensive, detailed planning to reassure them—as well as parents and the communities in which universities are located, and individual states—that the universities have taken all reasonable and appropriate measures. One critical component of every university's plan must be a rigid protocol of testing that goes far beyond buying enough test kits. Rather, universities must be sure to create and implement a plan that complies with complicated federal (i.e., FDA, CDC, CMS), state, and local requirements. For additional guidance on these requirements, Arnold & Porter is well positioned to help.

Footnotes

1. See e.g., FDA's "Policy for Coronavirus Disease-2019 Tests During the Public Health Emergency (Revised)",May 11, 2020, at 4 ("Rapid detection of COVID-19 cases in the United States requires wide availability of testing to control the emergence of this rapidly spreading, severe illness."); id. at 5 ("To respond effectively to the COVID-19 outbreak, rapid detection of cases and contacts, appropriate clinical management and infection control, and implementation of community mitigation efforts are critical.").

2.  Pursuant to the HHS Secretary's declaration of emergency or threat justifying emergency authorized use under 21 U.S.C. § 360bbb-3(b), unapproved/uncleared/unlicensed drugs, devices, or biologics may, in accordance with the requisite authorization under 21 U.S.C. § 360bbb-3(a), be introduced into interstate commerce and used during the duration of the declared emergency against the identified threat.

3. See 21 U.S.C. § 360k. See also FDA Information on Laboratory Developed Tests. To be sure, navigating the regulatory landscape of laboratory developed tests ("LDTs")-a type of in vitro  diagnostic test that is designed, manufactured and used within a single laboratory-presents its own challenges. Most notably, FDA has not articulated a clear framework for regulating LDTs, but instead has been selectively enforcing premarket clearance requirements against them. However, Congress, with the introduction of the 2020 VALID Act, seeks to lump all diagnostic tests (whether commercial or laboratory developed) under one category-in vitro clinical tests-to be regulated equally by FDA.

4. 21 U.S.C. § 360bbb-3.

5. 21 U.S.C. § 360bbb-3(f).

6. See 21 U.S.C. § 360bbb-3(c). See also FDA, Emergency Use Authorization of Medical Products and Related Authorities, Guidance for Industry and Other Stakeholders, at 8 (Jan. 2017). To note, FDA must also find that the pathogen identified in the HHS Secretary's EUA declaration is "capable of causing a serious or life-threatening disease or condition," that the test in question "may be effective" in diagnosing said disease or condition, and that there are no "adequate, approved, and available alternative" to the test. Id. at 7-8.

7. Id.

8. 85 Fed. Reg 15335.

9. See supra note 1; see also, FDA, FAQs on Testing for SARS-CoV-2. So far, the following states have authorized laboratories within their jurisdiction to develop and perform tests for SARS_CoV-2: Connecticut, Maryland, Mississippi, Nevada, New Jersey, New York, and Washington.

10. 42 U.S.C. § 263a(a).

11.  See Centers for Medicare & Medicaid Services, State Operations Manual, Chapter 6 - Special Procedures for Laboratories, at 17.

12. See e.g.,  CMS, Frequently Asked Questions (FAQs), CLIA Guidance During the COVID-19 Emergency.

13. Centers for Medicare & Medicaid Services, State Operations Manual, Chapter 6 - Special Procedures for Laboratories, at 18.

14. U.S. Dept of Transp., Pipeline & Hazardous Materials Admin., Transporting Infectious Substances Safely (Oct. 1, 2006), at 6-7.

15. Id.

16. IATA, Novel Coronavirus (COVID-19), Dangerous Goods (Including Alcohol Based Sanitizers), Guidance for Operators (March 7, 2020).

17. 49 C.F.R. 173.199.

18. See Centers for Disease Control and Prevention, Reporting COVID-19 Laboratory Data. By way of example, the State of New Jersey requires laboratories to "immediately report results of laboratory examinations of specimens of humans, animals, or birds indicating or suggesting the existence of communicable diseases to the Department of Health, to the physician or veterinarian submitting the specimen and . simultaneously forward a copy thereof to the health officer having jurisdiction where the patient is located." N.J.A.C. 8:44-2.11 (emphasis added).

19. As defined by the CDC, "contact tracing" involves working with infected individuals to help them recall everyone with whom they have had close contact during the timeframe while they may have been infectious. Contact Tracing: Part of a Multiprong Approach to Fight the COVID-19 Pandemic. Public health staff then warn these exposed individuals (contacts) of their potential exposure as rapidly and sensitively as possible. Id.

20. See e.g., CDC's COVID-19 Contract Tracing Training: Guidance, Resources, and Sample Training Plan.

21. 20 U.S.C. § 1232g(a)(3); Joint Guidance on the Application of the  Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to Student Health Records.

22. 34 C.F.R. § 99.30. PII includes information such as a student's name or student number, as well as "indirect identifiers" such as a student's date and place of birth, or information that "is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty." 34 C.F.R. § 99.3.

23. U.S. Dep't of Educ., Student Privacy Policy Office, FERPA & Coronavirus Disease 2019 (COVID-19) Frequently Asked Questions (FAQs) (March 2020).

24. 34 C.F.R. §§ 99.31(a)(10), 99.36.

25. Id. § 99.36(c).

26. Id. § 99.32(a)(5).

27. Id. § 99.31(a)(10), 99.36.

28. U.S. Dep't of Educ., Student Privacy Policy Office, FERPA & Coronavirus Disease 2019 (COVID-19) Frequently Asked Questions (FAQs) (March 2020) at 4-6.

29. U.S. Dep't of Educ., Student Privacy Policy Office, FERPA & Coronavirus Disease 2019 (COVID-19) Frequently Asked Questions (FAQs) (March 2020); 34 C.F.R. § 99.31(b).

30.  Id.

31. U.S. Dep't of Health & Human Services, Health Information Privacy: Can a Postsecondary Institution Be a "Hybrid Entity" Under the HIPAA Privacy Rule? (last updated July 26, 2013).

32. 45 C.F.R. § 164.512(j).

33. See  https://www.arnoldporter.com/en/perspectives/publications/2020/04/personal-health-information-privacy-and-covid-19 ;  https://www.hhs.gov/sites/default/files/february-2020-hipaa-and-novel-coronavirus.pdf.

34. 29 U.S.C. § 157.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.