Is it a HIPAA violation to ask someone about their COVID vaccine status? What to know

As the United States faces the threat of the delta coronavirus variant, people are being asked to reveal whether they’ve been vaccinated against COVID-19 — leading many to question what that means for medical privacy.

Some patient information is required to be protected under the Health Insurance Portability and Accountability Act (HIPAA), a 1996 rule that is designed for businesses in the medical field.

For that reason, many legal experts say someone asking about your vaccination status typically doesn’t violate HIPAA. Instead, it’s a personal choice to reveal if you’ve gotten your shot, news outlets reported.

“HIPAA does not prevent anyone from asking anything,” Alan Meisel, a University of Pittsburgh professor, told the Associated Press. “What it does is prohibit certain health care entities from revealing certain health information about patients.”

What if businesses ask for proof?

The topic of medical privacy gained renewed attention after the Centers for Disease Control and Prevention in May relaxed its guidance on mask wearing. With the change, health officials said fully vaccinated people could go inside public places without face coverings.

The new recommendations prompted some businesses to lift mask restrictions for vaccinated customers, leading some to wonder whether HIPAA’s privacy rule could be applicable.

The rule was created to “assure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public’s health and well being.” It applies to businesses that are related to the health care field, including hospitals and insurance companies.

“Because the average business is not a covered entity or a business associate of a covered entity within the meaning of HIPAA, the statute does not prohibit them asking them about vaccination status,” Glenn Cohen of Harvard Law School told TEGNA in May.

But some legal experts think there’s a gray area if businesses ask for vaccine cards, so it could be up to courts to rule if that’s allowed, McClatchy News reported. There could also be trouble if the business denies serving people on a discriminatory basis, attorney J. Malcolm DeVoy told KSNV.

What if an employer wants me to be vaccinated?

With the more contagious delta variant spreading across the nation, several companies have considered vaccine mandates for workers. As with most business situations, experts say HIPAA doesn’t generally apply to job records.

“If an employer asks an employee to provide proof that they have been vaccinated, that is not a HIPAA violation, and employees may decide whether to provide that information to their employer,” the U.S. Department of Health and Human Services said on its website.

But what about in other circumstances? Some public figures recently have cited the health care privacy law when speaking to reporters about COVID-19 vaccines.

For example, U.S. Rep. Marjorie Taylor Greene, a Republican from Georgia, was asked last week whether she had gotten a COVID-19 shot.

“Your first question is a violation of my HIPAA rights,” Greene said, according to the journalism school Poynter. “You see, with HIPAA rights, we don’t have to reveal our medical records, and that also involves our vaccine records.”

And Dak Prescott, quarterback for the Dallas Cowboys, mentioned HIPAA while declining to share his vaccine status during a news conference on Thursday, the Fort Worth Star-Telegram reported.

But legal experts have said both Greene and Prescott had it wrong.

“It is not a general shield that permits individuals to avoid disclosing their own health information,” said Mark Rothstein, a professor at the University of Louisville, according to Poynter. “Individuals often must disclose their health information, or authorize the disclosure by a HIPAA covered entity, when applying for employment, life insurance, etc. The individual does not have to release the health information, but then they may not be hired or offered insurance.”