Since the onset of COVID-19 shelter-in-place and related public health orders in jurisdictions throughout California, schools, and colleges have grappled with how to protect students, staff, and other school community members, from coming into contact with the virus on their campuses. In some California jurisdictions, schools that resume in-person instruction must require student and staff COVID-19 testing in the event these individuals develop COVID-19 symptoms, or if one of their household members or a close contact tests positive. Schools may similarly be required to screen students and staff daily for COVID-19 symptoms, and to encourage staff to undergo routine testing unrelated to known exposure.
In relation to these requirements and recommendations for safe re-opening, schools are contracting with COVID-19 testing vendors that range from local nonprofit entities to national health services corporations. The potential legal issues associated with school-sponsored testing and the contracts these vendors offer to school clients are equally broad in range. For this reason, it is important that schools: (1) ensure they have written agreements with COVID-19 testing vendors; and (2) that such agreements address the following concerns.
Most healthcare vendors know about their obligations relating to “protected health information” under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the electronic transition of health information under the Health Information Technology for Economic and Clinical Health Act (HITECH). These Acts embody Federal law applicable to jurisdictions throughout the United States. However, these same vendors may not have considered their obligations under California’s Confidentiality of Medical Information Act (CMIA). CMIA is similar to HIPAA in that it requires protocols to protect medical information, as that term is used under CMIA. Importantly, however, CMIA has more stringent medical release requirements than HIPAA, and it is, therefore, essential that a vendor contracting to create or collect CMIA covered medical information on behalf of a California school understand that they are additionally required to comply with any obligations under this law. As the entity providing testing, we recommend that schools prepare and collect CMIA-compliant waivers from their community members directly for COVID-19 testing purposes. Relatedly, the school and its vendor should discuss how and when waivers will be issued and formalize any agreement on this issue in their vendor contracts.
Some vendors focus on employee testing and know how to comply with various privacy and employment implications related to the same. Some vendors focus on academic settings. Even then, the vendor may have created a contract that works in the public school setting, but with terms that are inapplicable to private schools. Assuming a school is contracting with a vendor to provide testing to its employees and its students, the school will need to ensure that both of these populations are sufficiently contemplated by the vendor agreement. Different issues arise depending on the population being tested. For example, if the tested person is a student, a parent or legal guardian’s consent may be required and should be addressed by the vendor contract. Most employees, on the other hand, will be able to consent to test on their own behalf. As further discussed below, testing costs may also depend on who is being tested, and whether an individual staff member or student’s health care insurance provider will be billed for the test.
In some instances, schools may agree to cover the costs of testing; and may be required to cover the cost of testing it mandates for its employees. At the same time, depending on an employee’s required duties, their insurer may be required to cover the cost. In short, there are many variables pertaining to testing costs, and any agreement with a vendor to conduct COVID-19 testing on campus should detail who will cover costs, and in what order. For example, if insurers will be billed first, the agreement should state the same, and also identify who is billed should insurance deny the claim.
By now, you have probably learned that not all COVID-19 tests are the same. An individual can obtain, and a vendor may provide molecular, antigen, and/or antibody testing. Molecular testing may be “pooled” or individualized. Some tests are faster, some less expensive, and may have varying reliability. For all of these reasons, it is important that a COVID-19 vendor agreement identify the type of testing that will be provided to school community members under the contract. Schools screening vendor options should also be sure to ask questions about the dependability, timing, and costs associated with the type of testing provided. Schools should address all of these variables in the resulting vendor agreement.
Logistically, a school entering into a contract with a COVID-19 testing vendor should work with the vendor to identify which party – the school or the vendor – will provide staffing to administer tests if the tests are not self-collected. The parties will similarly need to identify who will be responsible for properly storing test samples until they can be transported to any off-site lab site (if necessary), and who will be responsible for the transport. In relation to these duties, someone will need to be responsible for appropriate record-keeping in relation to collected samples, and, as noted above, ensuring compliance with HIPAA and CMIA protocols relating to those collections. To the extent a school expects its vendor to manage these issues, it should ensure this is explicitly covered by the vendor agreement.
If school staff will be responsible for managing any COVID-19 test collection, storage, or transport, the contract with its vendor should specify who will provide necessary training on testing protocols. This training will also need to cover HIPAA and CMIA compliance obligations. Conversely, if the vendor is managing test collection, storage, and transport, its contract with the school specifies that the vendor is responsible for ensuring that its staff or contractors have the requisite training to provide the contracted services.
As with other vendor agreements, a school contracting for COVID-19 testing services should ensure that the vendor has adequate general and professional liability insurance, workers compensation insurance, as well as employer’s liability insurance. Depending on the services provided, the school should also insist that it be named as additional insured under the general liability policy and require the vendor to provide it with proof of coverage. Schools should include language stating that the vendor’s liability should not be limited to the coverage provided in the contract.
Schools should also ensure that their vendors indemnify them against any claims or harm resulting from the vendor’s conduct, and the conduct of its contractors.
In some instances, COVID-19 testing providers offer additional services, such as contact tracing. If contract tracing depends on the software that school employees or other school community members download on a mobile device, schools must be mindful of additional privacy concerns and potential harm that can arise from software hacks and mishaps.
As with any contract, and in addition to the above recommendations, schools that contract with vendors to provide COVID-19 testing should ensure that the contract contains provisions sufficiently addressing the term of the agreement, how the agreement may be terminated, options for extending the agreement, if any, and what process applies in the event of a breach in the agreement. We further recommend general provisions relating to notice, severability, assignment, and contract modifications to address potentially changing needs as the pandemic spread fluctuates.