It Is Not a HIPAA Violation to Ask About Vaccination Status

Misbar’s investigation has determined that it is not a HIPAA violation to ask someone’s vaccination status or to implement vaccine passports. For example, a business can ask a customer about their vaccination status, and the customer has a right to refuse to answer. They may also be legally asked to leave the premises.

One of America’s top medical schools, University of Michigan, Ann Arbor, has stated that HIPAA, which stands for Health Insurance Portability and Accountability Act, is one of the U.S.’s most misunderstood medical laws. The source clarifies that HIPAA laws only apply to certain organizations and individuals, namely clinicians, hospitals, and other health care entities. They also state that HIPAA does not universally protect people from having to disclose their health information. 

Healthcare lawyer Abbye Alexander explains that employers can ask employees if they are vaccinated but that HIPAA would apply if the employer asked the employee’s healthcare provider for vaccination confirmation. In that instance, the employee would need to provide their employer with written authorization to access this information. She also stated that employers would be restricted from asking employees to disclose vaccine information in regards to a disability, due to the Americans with Disabilities Act. This situation is easily avoidable by employers asking employees for their vaccination status while making it clear that they are not requesting further medical information. 

The same logic applies to so-called vaccine passports. As Becker’s Health IT states, HIPAA does not prevent companies such as airlines from requesting documentation of vaccine status. However, as formal documentation is protected health information, they have to follow privacy and identity theft laws, meaning that they have a duty to protect any vaccine data that they have received from their customers. 

Lastly, HIPAA privacy information is readily available on the U.S. Department of Health & Human Services website. This site clearly states that the privacy rule within HIPAA applies to health plans, health care providers, health care clearinghouses and the business associates/business associate contractors of these entities.