The Health Insurance Portability and Accountability Act does not prohibit an individual or business from asking whether someone has received a particular vaccine, including a COVID-19 vaccine, nor does it prevent people from disclosing whether they have been vaccinated against COVID-19 or any other disease, according to guidance issued last week by the U.S. Department of Health and Human Services’ Office for Civil Rights.
The Office for Civil Rights has determined that, as always, the HIPAA privacy rule does not apply to individuals’ disclosures of their own health information. If an employee discloses vaccination information to an employer, the employer must keep the documentation private from others.
The HIPAA privacy rule does not regulate what information an employer can ask as part of a worker’s employment record, the Office for Civil Rights said. Employers, therefore, may require a worker to wear a mask, receive flu and COVID-19 shots, and sign a form allowing a healthcare provider to disclose the worker’s vaccination status. Without such authorization, a physician may not disclose the information unless “expressly permitted or required by the privacy rule.”
