HIPAA and COVID-19 vaccinations: What is considered a violation?

As vaccinated Ohioans can ditch masks and those who are not vaccinated are being asked to continue wearing them through June 2, the question continues to come up: Is someone asking my vaccination status a violation of the federal law HIPAA?

HIPAA stands for the Health Insurance Portability and Accountability Act of 1996. The law is designed to protect an individual’s private health information.

>> Fauci: COVID-19 booster shot will likely be needed within year of being vaccinated

Under the law, the only entities that must follow the regulations in the law, according to the U.S. Department of Health & Human Services, are:

• Health Plans: These include health insurance companies and government programs like Medicare and Medicaid
• Most Health Care Providers: People like doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists.
• Health Care Clearinghouses: These are places that entities that process nonstandard health information they receive from another entity.

The U.S. Department of Health and Human Services says business associates of the above entities must also follow parts of HIPAA.

“Often, contractors, subcontractors, and other outside persons and companies that are not employees of a covered entity will need to have access to your health information when providing services to the covered entity,” according to U.S. HHS.

These entities are the only ones who can violate HIPAA and could face financial penalties if they do so.

So, if you are planning to visit a private business, like a store, restaurant or other establishment, they can legally ask you whether you’ve received a COVID-19 vaccine without violating HIPAA.

However, you don’t have to provide that information, but the private business does have a right to refuse service.

Employers also are able to ask whether you’ve been vaccinated, according to the Ohio Bar Association.

“With or without implementing a vaccine mandate, employers can ask employees to provide proof of their vaccination as long as it does not contain any other medical information,” said Jade Robinson, a Cincinnati attorney who practices employment law. “Any information collected regarding vaccinations should be treated as confidential.”

Cox Media Group