Your Vaccination Status Is Not Covered by HIPAA Rules

The Department of Health and Human Services' (HHS) Office for Civil Rights issued guidance today explaining that COVID-19 vaccine status would not be covered under Health Insurance Portability and Accountability Act (HIPAA) privacy rules.

Within its new guidance, HHS reminded that HIPAA does not apply to employer or employment records on the grounds that the rules only apply to HIPAA-covered entities like health care providers conducting electronic transactions.

It also states that HIPAA does not regulate covered entities' abilities to request information from patients and visitors. Rather, it regulates how entities use this information. So, a business associate may inquire about vaccine status but could be regulated in how they share that information.

"We are issuing this guidance to help consumers, businesses, and health care entities understand when HIPAA applies to disclosures about COVID-19 vaccination status and to ensure that they have the information they need to make informed decisions about protecting themselves and others from COVID-19," Lisa Pino, director of HHS' Office for Civil Rights, said in a statement.

The report went on to clarify that HIPAA does not bar schools, stores, restaurants, entertainment venues, or other individuals from asking about one's vaccine status. It also allows agencies to ask companies about the vaccine status of their workforce.

Where HIPAA does generally come into play is in situations where an entity makes an inquiry into one's medical information through issuing the request to one's medical provider. One's doctor cannot disclose something like COVID-19 status unless authorized by the individual or under specific circumstances.

These circumstances include proving vaccination in order for an insurance provider to offer coverage of the vaccine. Status may also be offered to public health agencies requesting the minimum amount of information necessary to conduct studies.

When it comes to offering information to one's workplace, a physician may provide information relating to COVID-19 status in order to support an employer conducting an evaluation of medical surveillance in the workplace, such as monitoring the spread of COVID-19 within the office. They may also ask when evaluating an individual for work-related illness.

This guidance has become increasingly relevant as a growing number of private and public employers have issued workplace vaccine mandates.

President Joe Biden issued a September requirement that all Medicare and Medicaid-certified facilities mandate their workers received the vaccine. United Airlines followed suit, stating those who did not take the shot would lose their jobs. McDonald's issued a mandate that applied to those in its corporate offices.

"We've been patient. But our patience is wearing thin, and your refusal has cost all of us," Biden said in an announcement last month. "[The unvaccinated minority] can cause a lot of damage, and they are."

Correction 10/04/2021, 4:25 p.m. ET: The headline of this article was corrected to reflect the updated acronym of the Health Insurance Portability and Accountability Act.