Is it a Violation of HIPAA to Ask Someone if they’ve Been Vaccinated?

Josie shared on social media that she and her teenage son and daughter just got vaccinated against COVID-19. In a conversation at the school, Mary shared that she saw Josie’s post and that the three of them got their first dose. Was Mary violating Josie’s Health Insurance Portability and Accountability Act (HIPAA) rights by sharing information about her friend’s health decisions with others? No, in this instance, Josie is not covered by HIPAA and Mary is not breaking the law by sharing about Josie’s family’s vaccines.

What if, in the same situation, the nurse who gave Josie and her teenagers their shots took a picture of them and posted it on her own social media account without getting Josie’s signed consent? Would that be a HIPAA violation? Absolutely. Luckily, nurses are trained in how to abide by the law, and they and their employers are subject to fines and public reporting if they violate HIPAA, so what’s described typically does not happen. What has been happening is that HIPAA has caused some confusion when it comes to COVID vaccines. I’ll explain more in this article.

There’s Lots of Confusion About HIPAA and COVID Vaccines

The COVID-19 vaccine has been widely accessible for some time now. As a result, some businesses and workplaces now require full vaccination. Many private and public colleges are requiring it as well.

A question that has been recently trending on social media is whether it’s a violation of HIPAA to ask someone if they’ve been vaccinated? Many have been wondering specifically about restaurants, retail stores, grocery stores, or employers.

Very Few People Understand What HIPAA Actually Means

HIPAA, a federal law that went into effect in 1996, includes a medical privacy provision that was added in 2003 to protect a person’s identifying health information from being shared without their knowledge or consent. Under HIPAA, information from your doctor is private. Sounds simple, but HIPAA is actually one of the most misunderstood health laws in the country.

Many people are under the misconception that HIPAA provides comprehensive privacy protections for health information in all circumstances, but in reality, it doesn’t. HIPAA only governs certain kinds of entities, including your clinician, hospital, others in health care, and health insurance providers, and it doesn’t apply to the average person or to a business outside of health care.

Still, some Americans are claiming the HIPAA federal privacy law protects them from having to answer questions about their COVID vaccination status. This is simply not true. HIPAA doesn’t give someone personal protection against ever having to disclose their health information.

HIPAA has become one of the “most misunderstood statutes in existence,” said Glenn Cohen, a Harvard Law School professor who is an expert on health law and bioethics. “People think it does a lot more than it’s actually doing.”

So, if someone is asked a question about their health that they view as intrusive, such as whether they had a COVID vaccine, they might mistakenly say, “I can’t tell you because of HIPAA,” when what they actually mean is that they consider the information private. Remember, you can always decline to share your vaccination status if someone asks and you choose to do so, unless it’s in a few instances, which I will describe.

Who Can Legally Ask Me About My Vaccination Status?

Under federal laws, there are very few, if any, situations in which businesses, airlines, employers, schools and even those covered by HIPAA are prohibited from asking you to share your vaccination status or show your vaccine record card.

Employers are legally allowed to ask about or require proof of vaccination from employees. A December guidance, the Equal Employment Opportunity Commission, which enforces federal workplace anti-discrimination laws, confirmed that there’s no indication that there’s any federal law that would be violated by the employer asking this question.

“When it comes to safety, it’s appropriate, given what we know about COVID, to say that an employer has the right and maybe should do whatever they can to reduce the risk to everyone,” Cohen said.

Why HIPAA is Important

HIPAA doesn’t protect people from nearly as much as they imagined. So, why is it still so important?

HIPAA was created for several reasons—mainly to solve issues dealing with continuing health coverage for people who lose their jobs, reducing health care fraud, creating industry-wide standards, and protecting private health information. There are four key aspects of HIPAA that make it important for patients: privacy of health information, security of health data, notification of breaches of medical records, and the right to obtain copies of healthcare data. Here are some other important facts about HIPAA:

• HIPAA establishes a procedural framework for doctors, hospitals and other health-care players to exchange information without compromising patient privacy.
• HIPAA enables discussions with relatives, friends, or anyone else identified by the patient in their documents to receive health information from medical professionals.
• HIPAA is often singled out as the basis of patient confidentiality.
• HIPAA defers to state laws that are “more stringent” or protective of patient rights. HIPAA does override other federal laws.
• Even where HIPAA allows health information to be shared, it almost never requires it. Doctors and hospitals must be cognizant of other applicable laws or professional ethics guidelines that impose stricter limitations.

In incapacity planning, a HIPAA Waiver allows you to get the same medical information the patient would get – complete access to the patient’s medical records and any information from the doctors, the hospital, or the nursing home that you need about the patient’s health or health care.

Planning for Incapacity

To ensure your wishes are met and that you have a HIPAA waiver on file that gives access to medical information to someone you trust, it is important to start your planning now.

If you have not done Incapacity Planning, Estate Planning, or Long-Term Care Planning, or if you have a loved one who is nearing the need for long-term care or already receiving long-term care, please contact us for an initial consultation: