Is Asking for Proof of Vaccination a HIPAA Violation?
After a long year of postponing and cancellations due to COVID-19, restrictions have relaxed and you're finally able to take that vacation to Hawaii. But in order to get on the plane, the airline requires that you provide proof of your vaccination. Hey wait a minute, isn't that a HIPAA violation? If you're confused about what the Health Insurance Portability and Accountability Act (HIPAA) actually entails, you're not alone. From government leaders to average citizens, many people argue that HIPAA protects you from being asked about your COVID-19 vaccination status. However, that's not quite true. Let's take a look COVID-19 vaccination requirements and how they relate to HIPAA rules.
Confusion About What Constitutes A HIPAA Violation
In late May, the CDC updated its recommendations for mitigating the spread of COVID-19, stating that fully vaccinated individuals no longer needed to mask while indoors. As vaccination rates across the US have increased, many states relaxed their own restrictions, which allowed businesses and events to resume normal activity. However, COVID-19 is still present in our communities, and businesses and individuals are tasked with determining how they will continue working to keep employees and customers safe. The logical solution is to require employees and customers to provide proof of vaccination where appropriate. But some individuals, confusing HIPAA with "health privacy," think the law protects them from needing to divulge this information. HIPAA only applies to specific entities, such as a healthcare provider, or a health insurance company. It protects your privacy by preventing them from sharing your health information, but it does not protect you from being asked questions about your health. HIPAA violations are very serious and have significant consequences. Heavy fines and even jail time may be incurred, depending on the severity of the violation. Therefore, it is important to understand where HIPAA does and does not apply.
HIPAA and Business Service Refusal
As businesses resume normal operations, some specify that unvaccinated individuals must continue to wear masks or use alternate methods to receive service. Some may require proof of vaccination to attend special events on their premises. But the question on the minds of many Americans is, "Can a business really refuse me service if I don't provide proof of a COVID-19 vaccine?" HIPAA does not apply to most businesses, therefore they may ask about your vaccination status. They may also require you to provide proof that you received your COVID-19 vaccine. Due to other laws, such as the Americans with Disabilities Act (ADA), businesses cannot outright refuse to serve you. If you cannot provide proof of a COVID-19 vaccine, the business must provide some accommodations. Since the beginning of mask mandates and social distancing requirements in 2020, businesses have created ways to safely serve individuals while minimizing contact. The positive reception to these actions has prompted many businesses to keep these options available, even as restrictions ease. A grocery store may offer curbside pickup, or a restaurant may offer delivery. Retail stores request that you continue to wear a mask. These are all reasonable accommodations for people who cannot provide proof of a COVID-19 vaccination. The business can deny service to you if you refuse to disclose your vaccination status, and refuse to utilize alternative methods of service. So yes, the airline can refuse to let you fly if you do not provide proof of vaccination and refuse to wear a mask.
Employers and COVID-19 Vaccine Status
In previous years, employers, especially healthcare employers, have required proof of a flu vaccination as an employment requirement. Naturally, people are wondering, "Can my employer ask if I received the COVID-19 vaccine?" Under HIPAA, it is permissible for your employer to ask about your vaccination status. However, your employer cannot call your doctor to obtain that information. An employer may have special policies in place for people who cannot provide proof that they have received a COVID-19 vaccine. For example, your employer may also require you to wear a mask or work in a different location if you refuse to provide proof of your vaccination status. You may have to work from home or take on different responsibilities. In fact, the Equal Employment Opportunity Commission (EEOC) determined that requiring employees to provide proof of vaccination did not break any federal laws. Some individuals are concerned that an employer may be able to terminate employees for refusing to provide proof of a COVID-19 vaccination. HIPPA does not prevent this action from being taken, but state and local laws may dictate specific information about acceptable consequences that an employer may enact. Each employer must determine the importance it places on employee vaccination and it will vary based on the type of business it operates.
Concerns About Pushback
Although they are not bound by HIPAA, some businesses are concerned about public response to asking about an employee or customer's vaccine status. Given the political implications surrounding the response to COVID-19, it is understandable that businesses and employers may fear pushback. However, it is not a HIPAA violation to ask. Each business and employer will have to determine whether they will ask about vaccination status, and if so, how it will be done. Each business will also have to determine if it the costs of enforcing policies outweigh the benefits. Some businesses may decide not to ask customers about vaccination status, while others may see it as a vital measure for safety. Regardless of the decision, transparency is key in ensuring effective policies. Businesses should be clear about why they are asking for the information, and approach the subject of vaccination status in a respectful manner. There should be specific protocols for how an unvaccinated individual can, or cannot, receive service. These protocols should be clearly communicated to both employees and customers. Respect and communication will help businesses navigate through any public pushback, while also maintaining appropriate levels of safety.
Your Health Privacy Rights
With COVID-19 vaccinations being the highlight of the healthcare news, and proof of vaccination being a requirement in many places, some are concerned about their right to privacy about their health. Although an employer or a business can ask you about your COVID-19 vaccination status, you are free to refuse to provide that information. However, you are not free from the consequences of refusal. It is important to remember that although restrictions are easing for fully vaccinated people in the US, businesses still have an obligation to keep the workplace safe. This means keeping both employees and customers healthy. It is important for them to have you follow their safety protocols in order to keep everyone safe. This means that your employer can ask if you are experiencing COVID-19 symptoms, can take your temperature, and even ask for proof of a vaccine. They may also keep records regarding employee health, but the EEOC stresses the importance of keeping such information confidential. Disclosing some information about your personal health may feel uncomfortable, but it is legal for employers and businesses to ask reasonable questions in order to maintain safe environments. However, this does not mean that you must share every detail about your personal health history. While you can be asked about your vaccination status, follow-up questions about why you have not been vaccinated may be subject to ADA standards. Unless the information affects your job, you may not need to disclose your reason for your vaccination status.
