Content created by OCR Press Office
1. Does the HIPAA Privacy Rule prohibit businesses or individuals from asking whether their customers or clients have received a COVID-19 vaccine?
No. The Privacy Rule
First, the Privacy Rule
Second, the Privacy Rule does not regulate the ability of covered entities and business associates to request information from patients or visitors. Rather, the Privacy Rule regulates how and when covered entities and business associates are permitted to use
Additional examples. The Privacy Rule does not apply when an individual:
- Is asked about their vaccination status by a school,
While the Privacy Rule does not regulate whether schools can ask individuals whether they have received a vaccine, the HIPAA Rules may regulate how the information is handled once it is in the possession of a school when that school is subject to the HIPAA Rules (i.e., when the school is a covered entity) and the health information does not meet the definition of “education records” covered by the Family Educational Rights and Privacy Act (FERPA). See 45 CFR 160.103 excluding individually identifiable health information in education records covered under FERPA from the definition of “protected health information.” See also Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) And the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to Student Health Records, US Department of Health and Human Services and US Department of Education (December 2019), available at https://www.hhs.gov/sites/default/files/2019-hipaa-ferpa-joint-guidance.pdf, opens in a new tab, describing what types of institutions FERPA applies to and what information is included in “education records.” employer, store, restaurant, entertainment venue, or another individual. - Asks another individual, their doctor, or a service provider whether they are vaccinated.
- Asks a company, such as a home health agency, whether its workforce members are vaccinated.
Other state or federal laws address whether individuals are required to disclose whether they have received a vaccine under certain circumstances.
2. Does the HIPAA Privacy Rule prevent customers or clients of a business from disclosing whether they have received a COVID-19 vaccine?
No. The Privacy Rule does not prevent any individual from disclosing whether that individual has been vaccinated against COVID-19 or any other disease. The Privacy Rule does not apply to individuals’ disclosures about their own health information. It applies only to covered entities
3. Does the HIPAA Privacy Rule prohibit an employer from requiring a workforce member to disclose whether they have received a COVID-19 vaccine to the employer, clients, or other parties?
No. The Privacy Rule does not apply to employment records, including employment records held by covered entities
4. Does the HIPAA Privacy Rule prohibit a covered entity or business associate from requiring its workforce members to disclose to their employers or other parties whether the workforce members have received a COVID-19 vaccine?
No. The Privacy Rule does not apply to employment records, including employment records held by covered entities
For example, the Privacy Rule does not prohibit a covered entity or business associate from requiring or requesting each workforce member to:
- Provide documentation of their COVID-19 or flu vaccination to their current or prospective employer.
- Sign a HIPAA authorization for a covered health care provider to disclose the workforce member’s COVID-19 or varicella vaccination record to their employer.
See 45 CFR 164.508(b)(4)(iii). - Wear a mask--while in the employer’s facility, on the employer’s property, or in the normal course of performing their duties at another location.
- Disclose whether they have received a COVID-19 vaccine in response to queries from current or prospective patients.
Other federal or state laws address whether an employer may require a workforce member to obtain any vaccinations as a condition of employment and provide documentation or other confirmation of vaccination. These laws also address how employers must treat medical information that they obtain from employees. For example, documentation or other confirmation of vaccination must be kept confidential and stored separately from the employee’s personnel files under Title I of the Americans with Disabilities Act (ADA).
5. Does the HIPAA Privacy Rule prohibit a doctor’s office from disclosing an individual’s protected health information (PHI), including whether they have received a COVID-19 vaccine, to the individual’s employer or other parties?
Generally, yes. The Privacy Rule prohibits covered entities
Generally, where a covered entity or business associate is permitted to disclose PHI, it is limited to disclosing the PHI that is reasonably necessary to accomplish the stated purpose for the disclosure.
For example, if consistent with other law and applicable ethical standards, under the Privacy Rule:
- A covered physician is permitted to disclose PHI relating to an individual’s vaccination to the individual’s health plan as necessary to obtain payment for the administration of a COVID-19 vaccine.
See 45 CFR 164.506(c)(1). - A covered pharmacy is permitted to disclose PHI relating to an individual’s vaccination status (e.g., that an individual has received a COVID-19 vaccination, the date of vaccination, the vaccine manufacturer) to a public health authority, such as a state or local public health agency.
See 45 CFR 164.512(b)(1)(i). In such situations, the covered pharmacy may rely, if such reliance is reasonable under the circumstances, on a representation by the public health authority that the information requested constitutes the minimum necessary for the stated purpose(s) of the disclosure (e.g., to track and compare the effectiveness of different COVID-19 vaccines).See 45 CFR 164.514(d)(3)(iii)(A). - A health plan is permitted to disclose an individual’s vaccination status where required to do so by law.
See 45 CFR 164.512(a). - A covered nurse practitioner is permitted to provide PHI relating to an individual’s COVID-19 vaccination status to the individual.
See 45 CFR 164.502(a)(1)(i) (permitting a covered entity to use or disclose an individual’s PHI to the individual). Note, when an individual, or their personal representative, requests access to the individual’s PHI, in addition to the disclosure being permissible, it is also required under an individual’s right of access. See 45 CFR 164.524 (providing individuals with the right of access to inspect and obtain a copy of PHI about the individual in a designated record set). - A covered clinician who is an investigator in a COVID-19 vaccine clinical trial is permitted to use or disclose PHI to the vaccine manufacturer and FDA about clinical trial participants for the purpose of activities related to the quality, safety, or effectiveness of the COVID-19 vaccine.
See 45 CFR 164.512(b)(1)(iii). Such purposes include:- To collect or report adverse events, product defects or problems (including problems with the use or labeling of a product), or biological product deviations.
- To track FDA-regulation products, including COVID-19 vaccines.
- To enable product recalls, repairs, replacement, or lookback (including locating and notifying individuals who have received products that have been recalled, withdrawn, or are the subject of lookback).
- To conduct post-marketing surveillance.
- A covered hospital is permitted to disclose PHI relating to an individual’s vaccination status to the individual’s employer so that the employer may conduct an evaluation relating to medical surveillance of the workplace (e.g., surveillance of the spread of COVID-19 within the workforce) or to evaluate whether the individual has a work-related illness,
See 29 CFR 1904.5 (definition of “Work-related illness”). See also OSHA’s website, links to an external website for guidance on the application of OSHA requirements to COVID-19. ,See 45 CFR 164.512(b)(1)(v). See also FAQ 301, https://www.hhs.gov/hipaa/for-professionals/faq/301/does-the-hipaa-public-health-provision-permit-health-care-providers-to-disclose-information-from-pre-employment-physicals/index.html. and all of the following conditions are met:- The covered hospital is providing the health care service to the individual at the request of the individual’s employer or as a member of the employer’s workforce.
See 45 CFR 164.512(b)(1)(v)(A). - The PHI that is disclosed consists of findings concerning work-related illness or workplace-related medical surveillance.
- The employer needs the findings in order to comply with its obligations under the legal authorities of the Occupational Safety and Health Administration (OSHA), the Mine Safety and Health Administration (MSHA), or state laws having a similar purpose (e.g., under OSHA’s recordkeeping requirements, worker side effects from vaccination constitute a “recordable illness,” and thus, employers are responsible for recording such side effects in certain circumstances
See OSHA, Protecting Workers: Guidance on Mitigating and Preventing the Spread of COVID-19 in the Workplace, at § 9 (June 10, 2021), available at https://www.osha.gov/coronavirus/safework, links to an external website (describing recording and reporting requirements related to COVID-19 infections and deaths and the current exception to requirements to record worker side effects from COVID-19 vaccination through May 2022). ).See 45 CFR 164.512(b)(1)(v)(C). ,Covered entities must implement policies and procedures with respect to PHI that are designed to comply with the requirements of the Privacy Rule, which would include, if applicable to the covered entity, a policy and procedure to ensure that disclosures to an employer under 45 CFR 164.512(b)(1)(v) meet the conditions specified in that paragraph. See 45 CFR 164.530(i)(1). - The covered health care provider provides written notice to the individual that the PHI related to the medical surveillance of the workplace and work-related illnesses will be disclosed to the employer. (This can be accomplished by providing the individual with a copy of the notice at the time the health care is provided, or by posting the notice in a prominent place at the location where the health care is provided if the health care is being provided on the work site of the employer.)
See 45 CFR 164.512(b)(1)(v)(D).
- The covered hospital is providing the health care service to the individual at the request of the individual’s employer or as a member of the employer’s workforce.
In other circumstances, the Privacy Rule generally requires a covered entity to obtain an individual’s written authorization before disclosing the individual’s PHI,
- A sports arena or entertainment purveyor.
- A hotel, resort, or cruise ship.
- An airline or car rental agency.
NOTE: The Privacy Rule does not prohibit an individual from choosing to provide any of these individuals or entities with information regarding their vaccination status.
For additional information on the Privacy Rule and its application, visit https://www.hhs.gov/hipaa/for-individuals/index.html.
Resources
The CDC issued “Updated Healthcare Infection Prevention and Control Recommendations in Response to COVID-19 Vaccination,” available at https://www.cdc.gov/coronavirus/2019-ncov/hcp/infection-control-after-vaccination.html.
OSHA, at the U.S. Department of Labor, published “Protecting Workers: Guidance on Mitigating and Preventing the Spread of COVID-19 in the Workplace”, available at https://www.osha.gov/coronavirus/safework, links to an external website. Additional guidance and resources on COVID-19 and the workplace, are available at https://www.osha.gov/coronavirus, links to an external website.
The U.S. Equal Employment Opportunity Commission issued guidance entitled, “What You Should Know About COVID-19 and the ADA, the Rehabilitation Act, and Other EEO Laws,” available at https://www.eeoc.gov/wysk/what-you-should-know-about-covid-19-and-ada-rehabilitation-act-and-other-eeo-laws, links to an external website.