Is it a HIPAA Violation to ask about the COVID Vaccine?

Over the years, the Health Insurance Portability and Accountability Act (HIPAA) has proven to be one of the most misunderstood and incorrectly applied laws. Throughout the ongoing pandemic, a consistent point of contention has been what information is and is not protected by HIPAA related to employers, employees, and vaccination status.

When Personal Health Information (PHI) or medical issues are of concern, many fall back on HIPAA’s strict governance of information. HIPAA protects against the improper and unauthorized disclosure of PHI by covered entities. These are defined as health plans, healthcare clearinghouses, healthcare providers, and certain business associate vendors. HIPAA generally does not apply to employers, stores, schools, etc.

With the vaccine mandate deadline looming for many, the Department of Health and Human Services (HHS) and the Office for Civil Rights (ORC) have recently released much-needed guidance on the applicability of HIPAA to COVID-19 vaccination status.

1. HIPAA rules do not prohibit or prevent any person or business from asking whether or not its customers or clients have received the COVID-19 vaccine. In addition, HHS notes that the privacy rule only applies to covered entities, and provides several examples where the HIPAA does not apply:
   1. An individual may be asked about their vaccination status by a school, employer, store, restaurant, entertainment venue, or another individual.
   2. An individual may ask another individual, their doctor, or service provider whether or not they are vaccinated.
   3. An individual may ask a company—for example, a home health agency—whether or not their workforce is vaccinated.

There may also be other state or federal laws that dictate where individuals are obligated to disclose whether or not they have been vaccinated under certain circumstances.

2. HIPAA does not prevent employers from requiring their workforce to disclose their COVID-19 vaccination status. HIPAA privacy rules do not apply to employment records. They do not regulate what information may be requested from employees as part of the terms and conditions of their employment. However, documentation must be kept confidential and separate from the employee’s personnel files under Title I of the Americans with Disabilities Act (ADA).
3. Federal anti-discrimination laws do not prevent an employer from requiring all employees entering the workspace to be vaccinated and provide proof they satisfy the requirement. This requirement is subject to reasonable accommodation provisions and other equal employment opportunities.

Striking a balance between the return to normal and a safely modified workplace can present many challenges for employers. Our Aldrich Benefits team is here to support you, and ensure compliance across an increasingly complex legislative environment. If you have questions about how HIPAA may or may not apply to your business or employees, reach out to your Aldrich Advisor.