The Latest on HIPAA Privacy and COVID-19 Vaccinations

The Department of Health and Human Services (“HHS”) stated that the HIPAA Privacy Rules do not prohibit covered entities and business associates from asking whether an individual has received a COVID-19 vaccine. The HHS explained the rule in a series of Qs & As.

The HIPAA Privacy Rule (the “Privacy Rule: or “Rule”) exists to protect individuals’ medical records and other protected health information (“PHI”) by establishing specific standards to implement appropriate safeguards that apply to “covered entities.” These include group health plans, health care clearinghouses, and health care providers that handle some transactions electronically.

The Privacy Rule requires covered entities and their business associates to implement these protections to safeguard the privacy of PHI. In addition, the Privacy Rule regulates how and when covered entities and business associates are permitted to use and disclose PHI.

The HHS states that the Privacy Rule does not regulate the ability of “persons,” including covered entities and business associates, to request information from employees, patients, or visitors. Instead, the Rule prescribes limits and conditions for the uses and disclosures of PHI without patients’ authorization. This information includes whether an individual has been vaccinated.

Thus, the Privacy Rule does not prohibit any entity or business associate covered by HIPAA from asking whether an individual has received a COVID-19 vaccine. It regulates how and when a covered entity or a business associate may use or disclose information, such as whether an individual has received a COVID-19 vaccination.

In effect, the Privacy Rule has no application when a school, employer, store, restaurant, entertainment venue, or other individual asks another person about their vaccination status.

It is important to note that the Privacy Rule does not apply to employment records. These include records possessed by covered entities or business associates in their capacity as employers. In most cases, the Privacy Rule does not regulate the information requested from employees as part of the terms and conditions of employment imposed by an employer on its workforce. The HHS notes that other federal or state laws do address terms and conditions of employment.

HBL has experience in all areas of benefits and employment law, offering a comprehensive solution to all your business benefits and HR/employment needs. We help ensure you are in compliance with the complex requirements of ERISA and the IRS code, as well as those laws that impact you and your employees. Together, we reduce your exposure to potential legal or financial penalties. Learn more by calling 470-571-1007.

The following two tabs change content below.

Hall Benefits Law, LLC

HBL offers employers comprehensive legal guidance on benefits in mergers and acquisitions, Employee Stock Ownership Plans (ESOPs), executive compensation, health and welfare benefits, healthcare reform, and retirement plans. We counsel a wide spectrum of clients including small, mid-sized, and large companies, 401(k) investment advisors, health insurance brokers, accountants, attorneys, and HR consultants, just to name a few. HBL is passionate about advising clients, and we are dedicated to our mission: to provide comprehensive, personalized, and practical ERISA and benefits legal solutions that exceed client expectations.