Can we require employees to tell us about their allergies so we can make appropriate arrangements in our emergency response policy?
Yes, as long as you ask the right way.
Information about an employee’s medical allergies is personal health information (PHI) that you’re generally not allowed to collect under privacy laws. One way to get around that problem is to ask employees to disclose their allergies without disclosing their identities. That’s because for medical information to be PHI, it must be traceable to an identifiable individual. So, allowing employees to disclose the information anonymously means it’s not privacy-protected.
If you do need to know which employees have which allergies, you can still collect the information provided that:
- You do it for a legitimate purpose, which would include preparing an emergency response plan;
- Collecting the information is reasonably necessary to carry out the purposes;
- You ask for only the minimum information you need to accomplish the purpose; and
- You notify employees why you’re collecting the information and how you intend to use it; and
- Keep the information secure and confidential and refrain from using or disclosing it for any other purpose.