When government regulates the vast diversity and complexity of markets and other institutions, it can never plan for every unexpected turn of events. Yet during such an emergency, rules that a regulated sector could otherwise live with may no longer make sense. Then regulation becomes the enemy of resilience.

COVID-19 exposed some of these weaknesses in a dramatic way. In quieter times, Congress and the Food and Drug Administration (FDA) had asserted regulatory authority over medical testing and medical devices, the latter defined broadly to include not only implanted pacemakers and radiation units but a host of simple products such as bedpans, tongue depressors, surgical masks, and glass pipettes.

When the pandemic hit, the FDA’s requirement for preclearance of new tests cost precious months and obstructed promising avenues such as at-home testing while stealing precious time in ramping up availability of such needed items as medical-grade masks and gowns, vials and their stoppers, and pulse oximeters. Preclearance was often needed, for example, to start a new production line for items of this sort.

To be sure, some parts of the regulatory system did show a capacity to respond quickly and nimbly. With long-haul trucking, food labeling, and occupational licensing, many regulators at both federal and state levels moved within days or weeks to allow needed flexibility through waivers and discretionary suspensions of rules.

There’s another set of regulatory problems that has gotten less attention and where there has been comparatively little flexibility or relief. It’s the dilemmas faced by employers and enterprises that would like to reduce the risk of virus exposure for their employees and customers yet find that the law stands in their way.

For many employers, the first major operating shock of the pandemic came with the realization that they would need to ask many employees to work from home.

In principle, this sort of shift should have posed no novel questions of compliance, since telecommuting was an already well-established practice. True, some employers for whom it was new might have been unpleasantly surprised to discover that they were now exposed to new legal risks of overtime class actions based on claims that they knew, or should have known, that employees would work longer hours by keeping work open on their screens at odd hours, responding to emails, etc. The surest precaution was to begin requiring home-based workers to track their time, even if they had not been under any such requirement at the office.

Where the trickier legal problems began was in deciding which employees should work from home, assuming a skeleton staff was still needed at headquarters. And suddenly, the stakes were high indeed. Some employees were at seriously elevated risk should they catch the virus from coworkers, customers, or vendors. In fact, they might be at seriously elevated risk from even the commute to work, in a carpool or on a public bus.

On May 20, 2020, the state of Connecticut put out its reopening plan for businesses as the first wave of the pandemic receded. Among other directives, it specified: “Individuals over the age of 65 or with other health conditions should not visit offices, but instead continue to stay home and stay safe.”

As lawyers soon pointed out, what Connecticut had just told its private employers to do was not lawful. Under the federal Age Discrimination in Employment Act of 1967 (ADEA), it is unlawful to deprive employees of any opportunity because they are older than their colleagues. You might think that being asked to work at home at full salary doesn’t really count as “adverse” action or the deprivation of an opportunity, but lawyers have argued otherwise. For example, at-home employees might benefit from less mentoring or have fewer promotion opportunities.

Let’s set aside the legalities for a moment and go back to the assignment question with one thought uppermost in mind: minimizing the dangers of virus spread. To do this, employers would probably plan to keep at home not only the older workers but also those with a variety of co-morbidities linked to greater COVID-19 risk, including diabetes, morbid obesity, chronic lung disease, or an immunocompromised condition.

But that would just be the start of any calculations.

Some employees are a higher risk socially speaking because of their household situations. A middle-aged employee in good personal health who lives in a small apartment with an immunosuppressed spouse and two elderly parents might be a high risk from a community perspective even if a low risk personally.

For many employers, the safest course to minimize the risks of death and disability would be to make sure the oldest employees and those with serious predisposing conditions are assigned to work from home. If employers suspect certain employees have specific medical pre-conditions or live with someone who does but aren’t sure, the employers would ask them.

Employers could also consider whether employees have already had COVID-19. Let’s say three employees got sick with what was probably COVID-19 before tests were available. They’ve all recovered fully, and assuming it was COVID-19, they may have developed some immunity, making it possible that they won’t catch or spread the virus any time soon. Employers would want to include them in the skeleton staff, especially in positions where high personal contact is needed, because they may be some of the safest people in those jobs. But employers would want to ask them, as a precaution, to take one of the antibody tests to confirm previous COVID-19 infection.

Unfortunately, this safe assignment plan violates at least five separate provisions of federal law and who knows how many state laws. It’s also set up liability on multiple lawsuits on multiple theories.

Under the Americans with Disabilities Act of 1990 (ADA), employers can’t ask employees whether they have specific predisposing medical conditions, and if employers know it anyway, they are not always allowed to require employees to stay home. The ADA does give a little more leeway than the ADEA, because the ADA allows employers to withhold an assignment that they can prove would be a “direct threat” to an employee’s health. Unfortunately, the law makes direct threat hard to prove—a mere heightened risk is not enough; a virtual certainty of injury probably is; anything in between risks litigation. Even if employers can establish a direct threat, the federal Equal Employment Opportunity Commission (EEOC) says they still can’t make the assignment until they’ve engaged in an interactive process with the employee to make sure there isn’t some accommodation that would work.

As for inquiring about family members, per the EEOC, “the Genetic Information Nondiscrimination Act (GINA) prohibits employers from asking employees medical questions about family members.”

Employers also can’t ask about antibody testing. The ADA governs employers’ use of medical exams, which an employer can use only if (to quote the legal formula) “job related and consistent with business necessity.” The EEOC concedes that testing employees for current COVID-19 infection does meet that standard but says that antibody tests don’t meet the standard and are thus off limits.

Even if an employer can’t tell a 75-year-old worker to work from home, the employer could bring up the issue and see whether the employee would volunteer. But such conversations can make for a legal minefield since an adverse lawyer might accuse the employer of “steering.”

Now let’s address how best to protect customers and employees once offices open. Two of the most common ideas are requiring everyone to wear face masks and screening newcomers at the entrance with a forehead temperature gun to see whether they’re running a fever.

Unfortunately, these practices are also somewhat legally questionable.

While customer temperature checks are the less controversial of the two, the American Civil Liberties Union (ACLU) has come out against them, saying they have the potential to violate a host of existing laws. As for masks, by summer 2020, lawsuits were being filed regularly in federal court—nine in one week—claiming that retailers’ mask policies violate customers’ rights under the ADA.

Many customers don’t feel like wearing masks, and almost as soon as stores began adopting mask policies, word got around that the thing to do was to announce that you had a medical condition that entitled you not to have to wear one. And if you look perfectly healthy and seem to breathe normally? Well, disabilities can be non-obvious or “invisible.”

Now, it is true that there are some medical conditions for which wearing a surgical mask is contraindicated, although many people in such a category are so medically frail that it might be hard for them to go out in the first place. However, the ADA does not require customers to state what their disability is or provide a note from a doctor offering an expert opinion on either the disability itself or the mask issue.

In other words, it’s an honor system. The Pennsylvania guidance for businesses is explicit: “individuals who cannot wear a mask due to a medical condition … may enter the premises and are not required to provide documentation of such medical condition.”

Even if a business strongly suspects a customer is lying, the less risky legal course—albeit riskier from a health standpoint—is to back off. So, although the ADA supposedly entitles employers to enforce a policy that they can show is a “legitimate safety requirement,” in practice they cannot rely on any legal right to do so.

That’s not the end of the legal hassle. If a business wants to set a safety policy notwithstanding the ADA, it is supposed to have gathered adequate evidence to justify use of the exemption beforehand, not after the fact. So before adopting a mask policy, even a basic one that mirrors what the state has recommended, the owner of a store should line up some scientific documentation to avoid any legal issues.

So, what happens if COVID-19 gets into the workplace? Coworkers especially are going to be interested in who got it, not just from idle curiosity but because they want to estimate their own risk. While employers may not have to do all-out contact tracing, it would certainly make sense to alert people who have been placed at higher risk. However, federal employee privacy law sharply limits management’s right to disclose things it may know about employees’ medical conditions.

The EEOC concedes that some people may need to be told the name of an employee who has contracted COVID-19, but it emphasizes limiting the number of people who know by resorting to vague phrases such as “someone on the fourth floor.” Regardless, employees may spread rumors, and employers may be legally unable to set things straight. Customers who came in contact with the workforce also may find out someone contracted COVID-19. In the absence of any real safe harbor legally speaking, employers might find it prudent to tell them as little as possible.

As employers investigate active cases, more cautions kick in. It is legally better for an employer to ask all employees whether they may have COVID-19 if the employer suspects someone to be a risk rather than asking only that one person or a few. A person’s showing actual symptoms is probably a good enough reason to ask, but that person’s having attended a local superspreader event probably isn’t. And once again, family members are off limits because of GINA.

Some regulated sectors have a separate heavy overlay of privacy regulation to restrict what can be said. For example, consider universities. Universities are governed by the Family Educational Rights and Privacy Act of 1974 (FERPA), which is a federal law that sharply limits disclosure of information about students—even to people with some plausible interest in knowing, such as family members and professors whose classes the students attend. Faculty have complained that FERPA-shy college administrators have refused to inform them about outbreaks involving students whose presence in their classes might have put them, the faculty members, or other students at risk.

An unfortunate feature of the U.S. system’s interplay of law, litigation, and regulation is that businesses can get sued if they do and sued if they don’t.

Business owners can get sued a dozen different ways over precautions meant to reduce the chance that someone will contract COVID-19 at their business. But if fear of those exposures causes a business owner to drop some of the precautions, someone who contracts COVID-19 at the business can sue for damages. (In fact, class action lawyers have sued in situations where no workplace transmission has been alleged at all on the grounds that a business’s practices are improperly exposing staff to a greater risk of being infected.)

When suits such as these move forward, the lawyers pressing them will be on the lookout for omissions by which businesses allowed risks to occur, such as letting customers go running around the premises without masks or refraining from doing temperature checks because someone had read what the ACLU had said about checks.

The law is supposed to make it clear to actors ahead of time how to act legally. For that to happen, laws are supposed to be reasonably ascertainable, clear, and noncontradictory.

Alas, contemporary employment law often falls short of these basic requirements. The law is either obscure or leaves the meaning of a prohibition to guesswork after the fact, or various parts of the law contradict each other. These defects defeat advance knowledge and planning, especially by less-than-legally-sophisticated actors, which is what many small businesses are. The state of Connecticut would generally count as a sophisticated actor—it does not lack for lawyers on its payroll—but it still gave legally erroneous advice not to recall elderly workers to the office, having been led dangerously astray legally the same way a business would, by simple humanity and common sense.

How much of a difference does all this legal uncertainty and exposure make to total virus risk? No doubt many businesses are willing to ignore a bad law and risk getting sued if they see their actions as the best way to do the right thing for their workforce. And if some are scared out of precautions, perhaps those precautions were imperfect at best—temperature screening is far from a reliable screen, for example, because only some contagious people have fevers.

Unfortunately, bad legal incentives can hurt even if they deter only some steps to take care. That is because virus precautions should be multilayered—no single precaution screens perfectly, but their effectiveness is multiplicative. Masks help; so does de-crowding; so do plastic partitions; so does improved ventilation. Some of these might cut risk by more than half, some by a mere 10 or 20 percent, but cumulatively, many less-than-perfect safety measures can add up to good overall protection. If seven precautions are available, each of which screens out 40 percent of the risk, the total risk can be reduced by about 97 percent. If three of those seven precautions are discarded, effectiveness falls to 87 percent.

And the laws we have been talking about, framed as civil rights and privacy laws, often lay out near-absolute standards befitting a law whose purpose is moralistic at base—“business necessity,” “direct threat,” and so forth. Who would dare introduce cost-benefit balancing into a law couched as remedying discrimination? Who would introduce easy or flexible waiver provisions into a law characterized as vindicating civil rights?

Which brings us to a salient fact about most of the laws that fall under the anti-discrimination rubric—unlike laws about truckers’ hours or the labeling and packaging of emergency supplies, they typically have no waiver provisions at all. The EEOC’s role is advisory; it cannot give employers a pass from age discrimination or ADA law, which are mostly enforced through private litigation. There is no one to provide a green light, no one to set aside the workings of a law that has ceased to make sense in context.