COVID vaccines: When is employee’s vaccination status HIPAA-protected?

Whether an employee’s COVID-19 vaccination status is protected by the Health Insurance Portability and Accountability Act (HIPAA) has been (or should be) on the minds of all HR personnel as of late. That’s especially true as we await the Occupational Safety and Health Administration’s (OSHA) impending rule that will likely require employers with 100 or more employees to ensure their workforce is either vaccinated or regularly tested.

What to consider

In the interim, you should become familiar with the HIPAA privacy rule’s application to vaccination status by asking whether it prohibits businesses or individuals from (1) asking customers whether they have gotten the shots or (2) requiring a workforce member to disclose whether they have received a vaccine to the employer, clients, or other parties.

Fortunately, the U.S. Department of Health and Human Services (HHS) recently addressed many such frequently asked questions in new guidance. Below is a quick refresher on the privacy rule as well as the HHS responses to the common inquiries.

Privacy rule refresher