Liability and HIPAA

The law causing the most consternation for multifamily community residents trying to cope during this crisis was passed in 1996 with the best of intentions. The Health Insurance Portability and Accountability Act—commonly known as HIPAA—makes it illegal to divulge or disseminate the particulars of any individual’s health information without their prior consent. According to the U.S. Department of Health and Human Services (HHS), HIPAA “establish[ed] national standards to protect individuals’ medical records and other personal health information...The Rule requires appropriate safeguards to protect the privacy of personal health information, and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization.”

While few would argue that keeping people’s personal health information private is a good move for an array of reasons, there are times when the regulations can seem cumbersome, or even counterproductive. This writer has had personal experience with this law over the past 25 years, and can attest to the fact that it can sometimes make dealing with medical emergencies (the care of a suddenly sick parent, for example) more complicated. 

And that’s just one person who happens to be a close blood relative—what about a residential community of unrelated individuals? As the COVID-19 pandemic has spread and intensified, attorneys, managers, and The Cooperator itself have been inundated with questions from residents, board members, and others expressing concern—and sometimes anger—that they cannot be informed by name of neighbors in their building or association who have tested positive for the novel coronavirus. Their argument is that knowing who and where the infected individuals are would enable others in the community to take more effective steps to protect themselves and their families from the virus. 

While this may seem to be common sense, legal pros point out that compromising privacy in such a way could open boards, associations, and individuals to serious liability, regardless of whether an infected resident became the target of ‘public ridicule or shame’ (to borrow language from several of the responses to this question in our Legal Q&A section) or any other negative treatment as a result of their status being improperly disclosed. 

That said, a board-management team’s hands are not completely tied when it comes to informing community members about COVID infections in their building or HOA. According to a number of legal experts, if a board or manager has reason to believe that a resident has contracted COVID-19 or is experiencing symptoms of the virus, they are advised to let building staff such as supers, porters, and other maintenance workers know, and direct them to follow recommended protocols from the CDC and/or local and state health agencies if they need to enter the resident’s unit for any reason, such as to carry out an emergency repair. Building staff should also be provided with the recommended personal protective equipment when calling on a resident who has tested positive or is symptomatic. 

In terms of notifying neighbors, legal pros advise alerting all residents that there may be a confirmed case in their midst, reminding them to follow public health guidelines to protect themselves, and letting them know exactly what the building or association is doing to prevent the spread within their community (rigorous cleaning/disinfection of high-touch/high-traffic common areas, verifying that the infected resident(s) are self-quarantining, etc.).

Michael C. Kim, an attorney specializing in condominium community law and affiliated with Schoenberg Finkel Newman & Rosenberg in Chicago, stresses that utmost care should be taken to ensure the privacy of individual residents, while at the same time assuring the safety of all others. According to him, “Boards and management may notify residents if a person has tested positive, but may not divulge that person’s identifying information.” And of course, Kim continues, if a staff member has symptoms or a positive test, “Have that staff not come to work, and only come back when they’ve been medically cleared as appropriate.”

Again, a COVID-positive individual’s name and/or unit number should not be disclosed to anyone outside the board, management, and necessary support staff without the individual’s written consent. If other residents demand to know particulars, boards and managers should reiterate that it is both illegal and improper to disclose personal medical information. All that being said, however, if an infected person is not following proper protocols for self-isolation and containment, then community administrators are obligated to alert the appropriate public health authorities, such as their city or state department of health, or the CDC. 

What Is the Board’s Fiduciary Responsibility?  

According to Mark Hakim, of counsel with Schwartz Sladkus Reich Greenberg Atlas, based in New York City, “The board has a fiduciary duty, and must act in the best interests of its shareholders or unit owners. They are on the forefront here, and have to make decisions for the building as a whole, taking into consideration the needs of the many, and not necessarily the needs of the few, or the one. This would include restricting or eliminating the use of amenities (like the gym, for example), prohibiting move-ins and move-outs, and stopping non-essential work and alterations—which may be unpopular with some.”

 On the other hand, he continues, “A board cannot, however, exceed the authority granted to it either by statute or its bylaws—though during emergencies, the very authority it is granted permits it to take these extraordinary measures.”

 Sheila Van Duyne, principal of the Van Duyne Law Firm in Reno, Nevada, observes that “Associations and community management companies are essential businesses—and as such, they continue to operate as everyone is figuring out how to work around the new social distancing requirements that now govern our daily lives. Here in Nevada, we’ve received several updates and notices from the Nevada Real Estate Division on how to best run our associations during this crisis. City, county, and state governments are also issuing frequent updates and newsletters on how to continue to operate a functioning business during a pandemic. Boards now meet telephonically, or via other video conferencing technology. Community managers work in offices closed to typical public entry, relying on email and phone. The work still needs to be done—it just requires different approaches.”

Kim adds that, “Neither the board nor management are guarantors of individual residents’ personal safety, but they do have a duty to act reasonably to avoid foreseeable harm. In certain instances, that duty to not act negligently may be similar to the fiduciary duty to operate the association in accordance with applicable law and the governing documents, but it’s not exactly the same thing. In times of emergency (such as now, when a public health crisis has resulted in both National and State declarations of emergency, with accompanying restrictions on both public and private entities), boards have the authority to exercise their inherent power more broadly than would otherwise apply in ‘normal’ circumstances.”

Not that any of that is easy, Kim continues. “Convenience is not even to be considered as a legitimate factor,” he says. “In emergencies, you are dealing with competing necessities. Flexibility is key, as well as coolheadedness. Panic and extremism cannot be the motivation.”

Some Reasonable Actions

Even under normal circumstances, a board’s decision-making must entail a balance of considerations. During a time such as the one in which we currently find ourselves, the stakes are raised considerably. A board-management team must weigh risks to the health of their staff and community as a whole against the necessity of carrying out vital tasks and business decisions. Boards and managers must act reasonably, with maintenance and cleanliness taking top priority, along with limiting direct contact between the residents, management, and staff.

According to Kim, “Restricting or closing down amenities like meeting rooms and fitness centers, requiring ‘social distancing’ in the common areas, restricting deliveries, suspending any unnecessary construction work in common areas and individual units, limiting or prohibiting brokers’ home showings, switching to virtual meeting formats, acting without having an open meeting, deferring annual elections and meetings are all reasonable responses.” 

Hakim agrees, and suggests that “Boards should review their bylaws and governing documents, and should ensure that the residents are following them, as well as any other applicable law. We recommend that every board be open and communicative with residents; this allows them to understand and correspond with the board (via electronic means), and helps avoid even the appearance of any over-reaching or authoritarianism.”  

Of course, even if a board is committed to transparency and candor, Hakim says “There is always a risk that some may feel a board has overstepped its authority and may sue, whether it is because the board adjourned, rightfully, an annual or other meeting, eliminated a non-essential service, or instituted restrictions that some find overreaching. Obviously, you cannot please everyone, but to the extent that a board is following their own governing documents, or the CDC’s or other government guidelines, and advice of counsel, we believe they will generally be protected.” 

“HOAs need to make sure our communities are safe, maintained, and financially sound,” adds Van Duyne; that’s their main function and obligation, after all. “I think the best thing for us all to do is attempt to maintain normalcy, if at all possible. Continue to have your meetings and hearings, continue to enforce the basic rules of your association, continue to keep the community going. There are a lot of new technology options that can help with these efforts.”

The Grey Areas

This crisis is forcing co-op and condo boards and their managing agents to walk a fine line, says Hakim. “A board that fails to take basic steps or fails to adhere to applicable law could find itself on the wrong side of a lawsuit, without knowing whether its directors’ and officers’ insurance would cover such a failure. So far most of our boards have sought legal counsel as to what they should do, and for how long. We understand that people’s daily lives are affected, but a board failing to take necessary or preventative steps will have a far worse result—possibly counted in the number of illnesses or deaths, unfortunately. This is one of those times where it is far better to be safe than sorry.”

"Of course, anyone can sue anyone, even if not well-founded,” says Kim. “In Illinois, our courts have essentially closed down except for emergencies. My recommendation is to do what you must and should do, and worry about the lawsuits later, as long as you have a bona fide legal opinion to support your actions or inactions.”

Perhaps Van Duyne says it best when considering our path forward. “Even in the short time we have been facing this crisis, I have seen a real upswing in people ‘losing it’ for a time”—whether that be bending (or breaking) rules they would ordinarily abide by, making unreasonable demands, or just operating on a very short fuse in general. “Our associations are faced with walking a line between enforcing their governing documents and showing compassion for understandable failures to abide by the rules.”  

Overall, the pros advise everyone to keep in mind that this crisis will eventually pass—and when it does, we will still be neighbors, so as abnormal and disorienting as this situation is, we should still strive to maintain our sense of community, cooperation, and compassion.

A.J. Sidransky is a staff writer/reporter for The New Jersey Cooperator, and a published novelist.