As you may have noticed, the Health Insurance Portability and Accountability Act (HIPAA) comes up frequently in conversations about COVID-19. HIPAA includes a privacy rule that establishes limits for who can share health records. Some people have tried to invoke HIPAA when declaring their rights, sometimes arguing that businesses cannot ask about their vaccination status because of HIPAA.
So, just what is the story regarding HIPAA, vaccination requirements, and how businesses are responding? Here’s what you need to know …
Asking About an Employee’s Vaccination Status
Some employers – notably Delta Air Lines – have announced that they will charge unvaccinated workers a health insurance surcharge. Other employers have offered incentives, and some are flat out requiring vaccination.
According to a Gallup poll taken in August, 19% of those surveyed said they expected their employer to require the COVID-19 vaccine in order to return to work, and another 55% expected the employer to encourage vaccination. In May, only 5% of respondents expected to the vaccine to be required.
Regardless of the strategy used, employers are going to need to ask about vaccination status. According to HHS, that’s fine. HHS says that the HIPAA privacy rule does not apply to employment records, and that HIPAA does not prohibit an employer from requiring a worker to disclose their vaccination status. Employers are allowed to ask about vaccine status, whether it’s the COVID vaccine, the flu vaccine or something else.
Asking Customers and Clients for Proof of Vaccination
To keep their workers safe and to avoid liability issues stemming from an outbreak, some businesses want to require proof of vaccination for all customers on their property. These inquiries may even be required under local law. In King County, Washington, for example, people will be required to show proof of vaccination or a negative test result to enter many indoor establishments starting on October 25. To comply with this rule, bars, restaurants and other businesses will have to ask customers to show proof of vaccination or a negative test result. Many may be wondering if this will put them in noncompliance with HIPAA. According to HHS, it won’t.
HHS says that the HIPAA privacy rule does not ban people from asking about vaccination status. A business can ask if customers or clients are vaccinated. Likewise, customers can ask if the workers at a business are vaccinated.
Other Regulations
Although HIPAA does not prevent businesses from asking about vaccination status, compliance is still an issue, and there are other regulations to consider.
According to the EEOC, federal EEO laws do not prevent employers from making the COVID-19 vaccine mandatory for workers who are at the physical workplace, but employers may need to make accommodations under Title VII and the ADA. Employers have also been permitted to conducted COVID screenings or require COVID testing during the pandemic.
However, under the ADA, employers must keep medical information confidential, and medical information must be stored separately from the employee’s personnel file to help preserve confidentiality.
Of course, these are general guidelines and it’s up to each business to decide their approach. As always, consult your legal counsel to advice pertaining to your specific situation. For more information on EEOC laws and COVID, see What You Should Know About COVID-19 and the ADA, the Rehabilitation Act, and Other EEO Laws.