Coronavirus Disease 2019 (COVID-19) is a respiratory disease caused by the SARS-CoV-2 virus. It has become a worldwide epidemic and on March 11, 2020 the World Health Organization declared it a global pandemic.  The United States declared it a National Emergency on March 13, 2020 prompting states and municipalities to issue mandatory stay at home orders for the general population.  As we determine how to resume routine business operations special considerations are being discussed.

This pandemic has affected all aspects of daily life including routine business operations for the entire world.  As a result, most businesses have suspended normal operations and workers are sheltering-in-place.  This unprecedented disruption will require new ways of working going forward.  Companies are interested in providing safe workplaces for their employees.  This paper will address suggested best practices for re-starting operations and considerations for those office and support employees returning to work.

The life sciences community, and particularly manufacturers are considered essential businesses and have continued critical operations in order to produce lifesaving medicines, equipment, and the equally essential personal protective equipment (PPE) that our healthcare professionals, first responders and other essential workers require.  This paper will not address ongoing manufacturing operations since those areas have well established and validated processes in place.

This is Part one of a two-part series.  Part 2 will address additional topics relevant to the re-start.  These topics will include Quarantine Protocols, Engineering and Facilities Controls, Travel Considerations, Cleaning and Disinfection, and also Training Programs for the implementation of newly defined processes.

Executive Summary

Employers should prepare an Infectious Disease Preparedness Plan if they have not already done so.  Many employers may have already prepared such a document in order to be ready for an outbreak of other coronaviruses and influenzas.  If such a plan doesn’t exist within your company, both OSHA and CDC have special websites (CDC COVID 19 and OSHA COVID 19) related to COVID 19 where guidance documents are available.  These pages are updated daily and contain the most current information on pandemic response measures.

Additional resources from the following entities are available:

Each employer should consider monitoring employee health through a flexible, risk-based program that can be easily modified as more information (particularly around community transmission) becomes available.

This paper summarizes the current thinking on actions that can be taken to slow the spread of the disease and actionable procedures that companies can implement to support that effort.

Ingressing Employees and Visitors on the Site/Campus

Both OSHA and CDC have prepared advisory guidance documents to help employers manage the potential impact as employees return to work.  Experience with other countries that are further along the pandemic curve than the US, has demonstrated that managing the re-opening of sites is complex and challenging.  This transition has proven particularly difficult in urban areas where community transmission is a greater risk due to higher population density and greater use of mass transit.

Employers should consider how they will migrate employees from their current work-from-home situations back to a regular work shift at the employer’s site.  Consideration should be given to continued telecommuting and work-from-home options where appropriate.  If on-site presence is required, the employer should give strong consideration to the following options:

  • Utilizing a phased re-opening approach whereby employees are given a staggered return to work schedule. This soft re-opening will allow employers to make the necessary logistical arrangements and help to acclimate employees to the new work routines in a less stressful environment.
  • Staggered start times should be considered to support social distancing requirements – often medical device and biopharmaceutical companies have badged access facility entry control points that can create a bottleneck at high volume times like start and end of shift. Staggered starts will minimize this hazard.
  • Flexible work hours are another option to help with social distancing practices. It will also help sites where employees use public transportation in order to get to work.  Flexible work hours will allow those employees to get to work during non-peak transit times.
  • Staggered break times are another method to allow sites to more easily comply with social distancing requirements in shared areas. Consideration should also be given to making physical engineering changes to cafeteria and break rooms– removing a portion of the tables and chairs as well as considering the physical size of break areas, introducing physical barriers (partitions) and unidirectional traffic patterns, and introducing hand sanitization and disinfectant stations.
  • Monitoring Protocols for allowing employees, visitors and vendors access to sites/campuses should be seriously considered. Companies are beginning to implement routine temperature monitoring as a first line screening protocol.  Some questions remain around the reliability of thermometers being used, calibration requirements for the instruments, and concerns around the range of “normal” body temperatures.  Answers to these issues are still evolving and the CDC is continually updating their site with the current thinking and information.
  • Restricting visitor access to contained conference room or guest areas and limiting movement of visitors within facilities. Also restricting vendor and delivery driver access to dock areas of the warehouse.  All visitors and drivers should be made to sign an entry and exit log, as well as have a badge issued for the duration of their time on site.
  • Daily health questionnaires are another mechanism being used by companies as a first line screening option for all employees, vendors and visitors to the site. Washington State Department of Health has published a guidance document (Daily Health Questionnaire) template. The reliability of the responses is variable, but this questionnaire can be an effective first line screening tool.
  • Other monitoring options include rapid response testing – both diagnostic and immunity testing. These options are being considered but the reliability of these tests is quite variable, and this is still a very fluid situation with ongoing discussions in the public health community.  Until the reliability and test availability questions are resolved, this option is probably not viable as a first line screening protocol.  Some countries and companies are considering implementing voluntary screening as a method to provide reassurance to employees.

Office and Support Staff Security

OSHA guidance suggests a job hazard classification system for triaging which employees are in critical roles that may have a higher exposure risk.  These roles require more stringent PPE and engineering controls to maintain a safe work environment.  In order to slow the spread of the disease and to help isolate employees who have potentially been exposed to the virus by a known infected employee, companies are considering many of the following controls:

  • Job Hazard Classification System and Assignment by Employee Security Badges – Create a hierarchy classification system based on the OSHA guidance document (OSHA Guidance). Use visual cues on the badge that indicate what classification a specific employee holds, and what PPE is required for the employee.
  • Institute a requirement to wear masks while on premises. This requirement may require accommodations in alignment with the ADA.  EEOC has published guidelines related to a company’s obligations related to ADA (EEOC Guidance).
  • Utilize GPS tracking mechanisms, or bar code technology to implement a badge tracking program in order to track employee interactions while on-site, in order to isolate those individuals who have had recent contact with an employee (or visitor) who later reports having been infected. Privacy issues related to this option are still ambiguous and will be addressed further in part 2 of this paper.

Administrative and Policy Controls

COVID 19 presents new challenges to all businesses and therefore employers should appoint a COVID 19 coordinator who will be the subject matter expert for the site/campus.  This person should be the primary resource for current information on managing COVID 19 within the business.

The business should assure that the development of policies and procedures is in alignment with CDC and OSHA guidance documents (CDC Guidance and OSHA Guidance) along with state and local regulations and responses to COVID 19 conditions within the locality.

If the business has not already done so, an Infectious Disease Preparedness Plan (IDPP) should be created.  If a plan already exists, it should be revisited and modified to include those elements of best practices that are unique to SARS-CoV-2, the virus that causes COVID-19.  A discussion of the actions and considerations that should be included in the IDPP can be found on the OSHA website (IDPP Discussion).

Disclosure of Health Information – HIPAA

The EEOC has also produced guidance for industry to help inform the best practices relating to maintaining privacy of employee medical information (EEOC COVID 19).  CDC also addresses briefly the need to avoid the following:

To prevent stigma and discrimination in the workplace, use the guidance only to determine risk of COVID-19 infection. Do not make determinations of risk based on race or country of origin and be sure to maintain confidentiality of people with confirmed coronavirus infection. There is much more to learn about the transmissibility, severity, and other features of COVID-19 and investigations are ongoing. 

On February 3, 2020 the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) issued a Bulletin addressing HIPAA privacy and novel coronavirus.  The bulletin speaks to the ways that patient data and privacy information related to COVID 19 in the workplace may be shared.  Two key excerpts from the bulletin:

Treatment:  Under the Privacy Rule, covered entities may disclose, without a patient’s authorization, protected health information about the patient as necessary to treat the patient or to treat a different patient. Treatment includes the coordination or management of health care and related services by one or more health care providers and others, consultation between providers, and the referral of patients for treatment.

To persons at risk of contracting or spreading a disease or condition if other law, such as state law, authorizes the covered entity to notify such persons as necessary to prevent or control the spread of the disease or otherwise to carry out public health interventions or investigations.

And regarding sharing protected information internally or with public health authorities the bulletin states:

Minimum Necessary:  For most disclosures, a covered entity must make reasonable efforts to limit the information disclosed to that which is the “minimum necessary” to accomplish the purpose. (Minimum necessary requirements do not apply to disclosures to health care providers for treatment purposes.) Covered entities may rely on representations from a public health authority or other public official that the requested information is the minimum necessary for the purpose, when that reliance is reasonable under the circumstances. For example, a covered entity may rely on representations from the CDC that the protected health information requested by the CDC about all patients exposed to or suspected or confirmed to have Novel Coronavirus (2019-nCoV) is the minimum necessary for the public health purpose.  In addition, internally, covered entities should continue to apply their role-based access policies to limit access to protected health information to only those workforce members who need it to carry out their duties.

SafeguardingPatient Information:  In an emergency situation, covered entities must continue to implement reasonable safeguards to protect patient information against intentional or unintentional impermissible uses and disclosures.  Further, covered entities (and their business associates) must apply the administrative, physical, and technical safeguards of the HIPAA Security Rule to electronic protected health information.

About Validant

At Validant, our vision is to ensure safe and reliable access to the world’s life-saving healthcare products.  As the leading Quality, Compliance, and Regulatory consulting firm, we blend industry expertise with innovation to create custom solutions for companies on the frontier of health.  We can help you to structure and implement your COVID 19 Resumption of Business Response plan.  If required, we can also help you to develop and implement your infectious disease response plan.  For inquiries please contact Stephanie Colotti at scolotti@validant.com or info@validant.com.  Validant is a GHO company.

About the Author:  Stephanie Colotti is an industry expert in the area of Aseptic Manufacturing and serves as a Senior Partner with Validant.  She has worked in the regulated pharmaceutical and consulting industries for over 30 years.  Her background in validation, aseptic parenteral manufacturing, clean room and barrier isolator manufacturing, and delivery of various quality compliance remediation/rescue programs are among her unique qualifications.  She can be reached at scolotti@validant.com.

Primary sources of information were the CDC, OSHA and WHO guidance documents and COVID 19 websites.