There Are a Lot of Misperceptions About HIPAA and COVID-19 Vaccination Status. This May Help

As states allow public venues and private businesses to relax standards regarding attendance and social distancing, the question of who is vaccinated and who is not is becoming more prevalent—and more contentious. Some athletic stadiums have established special sections where people who are fully vaccinated against COVID-19 (and who can prove it with a vaccine “passport”) can sit closer together, forego masks, and even enjoy different concession-stand items than their unvaccinated peers. This has raised red flags with some unvaccinated individuals who say their rights are being assaulted, and that being asked to declare their vaccine status constitutes a violation of the Health Information Portability and Accountability Act. As noted in an article just published by The Washington Post, however, this is simply not the case. For one thing, as the article details, not everyone is bound by the limits of HIPAA, which applies to specific covered entities like insurers. While state and other federal privacy statutes vary, there is simply nothing under HIPAA that would prohibit a restaurant, an airline, or your employer from asking about your health (including COVID-19-related questions) or vaccination status. That includes requiring someone to prove their status by producing a vaccination card. Further, the Post article explains, there is nothing in the Americans with Disabilities Act or the Genetic Information Nondiscrimination Act that imposes such limitations on employers. One exception would be a situation in which disclosing an employee’s status would equate to disclosing information about a disability. What would be a violation would be to discriminate against someone eligible for a medical or religious exemption. [Editor’s note: One caveat to keep in mind when discussing this issue with patients is that Emergency Use Authorizations—such as the one under which the COVID-19 vaccine is being administered—do prohibit employers and other entities from requiring vaccination.]