HIPAA, COVID-19 Vaccinations and the Workplace

November 3, 2021 | Category: News

By Rebecca Bruch, Esq.

Long before COVID (do we even remember that?) there has historically been a lot of confusion about what HIPAA means and to whom it applies. There is a mistaken belief by most employees that HIPAA applies to employers, and employees throw around the H-word in a way that causes many employers to run for cover. To clear up that misbelief, first, please be aware that HIPAA defines “Covered Entities” to generally include health care providers, health plans, health care clearinghouses, or an entity that maintains a self-insured health plan. Unless you are a covered entity, you are not subject to HIPAA’s restrictions on disclosure of PHI (personal health information). That general rule applies to most all scenarios, not just COVID.  That being said, any information you request or gather regarding COVID does not violate HIPAA, whether you are a covered entity or not. The who, what, when, where and why of disclosure of HIPAA-protected health information is triggered if you are a covered entity.  Only then do you need to be sensitive to what you can and cannot disclose. To be clear, employers who do not fall into the definition of “covered entities” are  not subject to HIPAA

Notwithstanding the limited scope of HIPAA, employers do not have carte blanche to share an employee’s health information with the whole wide world. So, for instance, if you have collected information from employees related to COVID and their vaccination status, remember that the ADA requires employers that obtain medical information through inquiry or examination to keep it in a confidential medical file and keep it separate from the employee’s personnel file. This information includes the following: the CDC and EEOC have encouraged employers to question their employees regarding travel, exposure, or symptoms related to COVID. Any information you receive as part of that inquiry should be treated as confidential. But you are not prohibited from asking. To take it a step further, if a positive case is identified in the workplace, employers are encouraged to investigate the exposure of others in the workplace without disclosing the name of the individual or any personally identifiable information about the person. In addition, employers who believe an employee who tests positive may have exposed other employees, is obligated to inform the employees about the potential exposure but may not disclose the name of the person who tested positive.

In September 2021, the federal Department of Health and Human Services issued FAQs to assist as you weave your way through the daily COVID issues that you continue to face.   Here are just a few that you may be helpful:

  1. Does the HIPAA Privacy Rule prohibit businesses or individuals from asking whether their customers or clients have received a COVID vaccine?

No. The Privacy Rule does not prohibit any person, individual or entity such as a business, including HIPAA-covered entities and business associates from asking whether an individual has received a particular vaccine, including COVID vaccines. The Privacy Rule covers how and when covered entities are permitted to use and disclose PHI. The Privacy Rule does not apply when an individual:

  • Is asked about their vaccination status by a school, employer, store, restaurant, entertainment venue, or another individual.
  • Asks another individual, their doctor, or a service provider whether they are vaccinated.
  • Asks a company whether its workforce members are vaccinated.
  1. Does HIPAA prevent customers or clients of a business from disclosing whether they have received a COVID vaccine?

No.  The Privacy Rule does not apply to individuals’ disclosures about their own health information.

  1. Does HIPAA prohibit an employer from requiring a workforce member to disclose whether they have received a COVID vaccine to the employer, clients, or other parties?
  • HIPAA does not apply to employment records. Generally, HIPAA does not regulate what information can be requested from employees as part of the terms and conditions of employment that an employer may impose on its workforce. Other federal or state laws do address terms and conditions of employment. For example, federal antidiscrimination laws do not prevent an employer from choosing to require that all employees physically entering the workplace be vaccinated against COVID and provide documentation or other confirmation that they have met this requirement, subject to reasonable accommodation provisions and other equal employment opportunity considerations.
  1. Does HIPAA prohibit a covered entity from requiring its workforce members to disclose to their employers or other parties whether the workforce members have received a COVID vaccine?
  • HIPAA does not regulate what information can be requested from employees as part of the terms and conditions of employment that a covered entity may impose on its workforce, such as the ability to require its workforce to provide documentation of their vaccination against COVID or to disclose whether they have been vaccinated to their employer, other workforce members, patients, or members of the public. For example, HIPAA does not prohibit an employer from requiring or requesting each workforce member to:
    • Provide documentation of their COVID or fly vaccination to their current or prospective employer.
    • Sign a HIPAA authorization for a covered health care provider to disclose the workforce member’s COVID or varicella vaccination to their employer.
    • Wear a mask – while in the employer’s facility, on the employer’s property, or in the normal course of performing their duties at another location.
    • Disclose whether they have received a COVID vaccine in response to queries from current or prospective patients.

I can promise you that long after COVID is a distant memory, employees will continue to believe that HIPAA prohibits employers from asking about certain health information. In the meantime, these FAQs provide good guidance as to when HIPAA is triggered and when it is not.

If you have any questions, or need help with developing policies, you are invited to contact  any of the employment lawyers at Lemons, Grundy & Eisenberg.