For the last few months of 2021, due to Coronavirus prevention measures, there arose many questions about the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. One of the most popular is whether HIPAA rules apply to disclosures and requests for information about whether a person has received a COVID-19 vaccine.
Let’s find the answer to this question in this post.
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights reminds the public that the HIPAA Privacy Rule does not apply to employers or employment records. The reason is the HIPAA Privacy Rule only applies to HIPAA-covered entities (health plans, health care clearinghouses, and health care providers that conduct standard electronic transactions).
The guidance under discussion addresses common workplace scenarios and answers questions about whether and how the HIPAA Privacy Rule applies.
“We are issuing this guidance to help consumers, businesses, and health care entities understand when HIPAA applies to disclosures about COVID-19 vaccination status and to ensure that they have the information they need to make informed decisions about protecting themselves and others from COVID-19.”
OCR Director Lisa Pino
So, let’s dive into this deeper.
Can businesses or individuals ask whether their customers or clients have received a COVID-19 vaccine?
Yes. The Privacy Rule does not prohibit any person (e.g., an individual or an entity such as a business), including HIPAA-covered entities and business associates, from asking whether an individual has received a particular vaccine, including COVID-19 vaccines.
The Privacy Rule applies only to covered entities(health plans, health care clearinghouses, and health care providers that conduct standard electronic transactions) and, to some extent, their business associates. It does not prohibit a covered entity (e.g., a covered doctor, hospital, or health plan) or business associate from asking whether an individual (e.g., a patient or visitor) has received a particular vaccine, including COVID-19 vaccines, although it does regulate how and when a covered entity or its business associate may use or disclose information about an individual’s vaccination status.
Can HIPAA Privacy Rule ensure customers or clients of a business that the information whether they have received a COVID-19 vaccine will not be disclosed?
No. The Privacy Rule does not prevent any individual from disclosing whether that individual has been vaccinated against COVID-19 or any other disease. The Privacy Rule does not apply to individuals’ disclosures about their own health information. It applies only to covered entities and, to some extent their business associates. That is why the Privacy Rule does not apply when an individual tells a colleague, for example, about their own vaccination status.
Can HIPAA Privacy Rule prohibit an employer from requiring a workforce member to disclose whether they have received a COVID-19 vaccine to the employer, clients, or other parties?
The answer is no, as the Privacy Rule does not apply to employment records, including employment records held by covered entities or business associates in their capacity as employers. Overall, the Privacy Rule does not regulate what information can be requested from employees as part of the terms and conditions of employment that an employer may impose on its workforce, still, some state laws do address terms and conditions of employment.
Please note that the Privacy Rule does not prohibit an individual from choosing to provide any of these individuals or entities with information regarding their vaccination status.
