Penn State University Reference and Instruction Librarian Sarah Hartman-Caverly holds privacy in high regard. That is why she has not disclosed her vaccination status to her employer. She says vaccination mandates should stimulate a public conversation about medical and digital privacy.
She works at the Berks County campus of Penn State University. Penn State required employees to be vaccinated by Jan. 4. Employees who did not get vaccinated face disciplinary actions including termination for some, depending on their job classification.
“I’m actually now involved in kind of two noncompliance procedures,” Hartman-Caverly, a privacy scholar, told The Epoch Times. “The first is related to the vaccination mandate which is somewhat on pause due to the nationwide injunction, and the second noncompliance procedure is related to mandatory surveillance testing for employees who have not disclosed their vaccine status.”
Because she will not disclose her status, the university assumes she is unvaccinated. Hartman-Caverly must test weekly to show she does not have COVID-19. But instead of working with her doctor as she would like, she says Penn State requires her to test through Vault Health, the company the university contracted with to handle COVID-19 tests.
The test is done by video conference.
“You request the test kits by mail. You have to sit on Zoom with a monitor from Vault Health—they have to watch you take the test. You mail it in. You get your results, and then your results are also communicated to the university through the cloud on Salesforce,” Hartman-Caverly said. “One of my concerns about this protocol is that I’m being asked to work with a third-party health care provider whom I don’t recognize as a health care provider of my personal choice, and then they’re transmitting my health-related data through another third party data cloud provider and then to my employer. So, there is no room in the conversation for concerns about medical autonomy and medical privacy. Your only choice is to opt-in and consent to these processes, and you’ve got no room to work with your own health care provider of choice and to ensure the confidentiality of your health care data.”
When she first received a digital notification to test, she clicked through to read the terms and conditions.
“I found I was consenting to allow Penn State to release my testing results to any third party, without limitation, and so that was my initial contact with human resources. I asked what is my recourse if I don’t consent to these terms? Back in 2020, I had the option of continuing to work 100 percent remotely.” She then went on maternity leave.
“Fast forward to fall 2021, they’ve removed that option but I was on maternity leave so everything with me is on pause. And now we’re in 2022, and the university is saying if I’m not willing to disclose my vaccine status, and I’m not willing to participate in the mandatory testing, then I’m deemed unable to perform my work duties.”
In addition to testing requirements, she has had meetings with supervisors asking about her vaccination status and asking “what is your plan?”
She tells them her plan is to continue performing her job duties in a manner that significantly exceeds expectations, since that is how her performance evaluations describe her work.
She notes that none of her supervisors, or anyone at work who has talked to her about vaccination, is a doctor.
“I think is in the public interest to consider under what conditions any employer, be they public or private, can compel medical decisions and act as a health care provider on behalf of the employee, and ask any personal medical question,” Hartman-Caverly said. “There is a discussion to be had about public interest, during a pandemic yes, but medical privacy and medical autonomy cannot be removed from that conversation. They’re integral to personal and public health, not in conflict with it.”
This so-called “systemic coercion of digital participation” could impact her future employment opportunities. Refusal to disclose vaccination status is written in her record. Will it mean she will be passed over for a future promotion? Will the university decide not to award tenure in a few years on the basis of her noncompliance with the COVID mitigation protocols?
“My record may be used to negate any merit based increase I would otherwise receive.
“There’s a lot of research and discussion around what happens with this data once it’s in these systems. There’s no way to prevent what’s called downstream use or redisclosure or secondary use,” Hartman-Caverly said. “We don’t know what kind of inferences might be made on this data. We don’t know what kind of decisions or opportunities may be made based on this data down the line and what I find most interesting is, even with my decision to keep my health data personal, the system has already decided that means essentially that I’m not vaccinated, regardless of my status in real life, and so I’m being put through these noncompliance protocols for employees who are not vaccinated regardless of my actual status.”
In response to this story, Penn State Assistant Director of Strategic Communications Wyatt DuBois provided this statement: “All COVID-19 testing and vaccination data are stored in software/databases that are approved for this level of information, in accordance with all applicable federal and state laws and per Penn State’s Information Assurance and IT Security Policy and Privacy Policy. Testing data are only shared to inform individuals of their status, and as necessary to accomplish legitimate business purposes/needs, including, but not limited to, diagnostics, treatment, contact tracing, and public health and safety activities. Vaccination status is only available to university personnel directly involved in the COVID-19 response and mitigation efforts, and to public health officials. University personnel with access to vaccination records or status are prohibited by university policy from disclosing that information except as described above.”
