“Vax records, along with ALL medical records are private due to HIPPA rights,” Greene recently tweeted, misspelling the law’s acronym.
In the caption of an Instagram post that was flagged for containing false information, another person wrote, “If anyone asks for your vax status, tell them they have no right to know.”
That’s a common misconception but is “simply untrue,” said Robert Gatter, a professor with the Center for Health Law Studies at St. Louis University School of Law. Citing HIPAA as a reason to not disclose vaccination status is often a “knee-jerk reaction” that “quickly gets turned into a statement that sounds like law,” Gatter said. People sometimes say, “‘But I have a right not to be asked that question,’” he continued, “and it’s just not the case.”
Here’s what he and other experts say you need to know about the law.
What is HIPAA?
HIPAA, also known as the Health Insurance Portability and Accountability Act of 1996, and its subsequently added Privacy Rule include provisions to protect a person’s identifying health information from being shared without their knowledge or consent. The law, though, only applies to specific health-related entities, such as insurance providers, health-care clearinghouses, health-care providers and their business associates.
That means that even if your friend, favorite restaurant or grocery store were to publicly share private details about your health, they would not be in violation of HIPAA because they aren’t one of the “covered entities,” Gatter said. There are other federal and state confidentiality laws that may require employers and schools to protect your privacy. And, experts emphasized, there is nothing in HIPAA that bars asking people about their health — including vaccination status — or requiring proof that the information is accurate.
“It’s not really a prohibition on asking, it’s a prohibition against sharing,” said Kayte Spector-Bagdady, an associate director at the Center for Bioethics and Social Sciences in Medicine at the University of Michigan. The law, she added, “doesn’t mean you never have to tell anyone about your health information.”
HIPAA has become one of the “most misunderstood statutes in existence,” said Glenn Cohen, a Harvard Law School professor who is an expert on health law and bioethics. “People think it does a lot more than it’s actually doing.”
The misconceptions about the law likely stem from people widely using it in conversation as a “shorthand for privacy,” said Joshua Sharfstein, a public health expert at Johns Hopkins Bloomberg School of Public Health. If someone is asked a question about their health that they view as intrusive, he said, they might say, “I can’t tell you because of HIPAA,” when what they actually mean is that they consider the information private.
Who can legally ask me about my vaccination status?
Under federal laws, there are very few, if any, situations in which businesses, airlines, employers, schools and even those covered by HIPAA are prohibited from asking you to share your vaccination status or show your vaccine record card, experts said.
“Whether those two things are effective in keeping unvaccinated people out of your store is a different issue,” Spector-Bagdady said. “But it’s not a HIPAA problem.”
It would, however, be a violation of HIPAA if your health-care provider shared your vaccination status without your consent to someone who asked. “I can’t call your doctor and say, ‘Hey, this is Kim from Target, and I want you to tell me whether this customer standing in front of me is vaccinated,’” Spector-Bagdady said. “As that doctor, under HIPAA, I am prohibited to share that medical information without my patient’s permission.”
Employers are also legally allowed to ask about or require proof of vaccination from employees. In a December guidance, the Equal Employment Opportunity Commission, which enforces federal workplace anti-discrimination laws, essentially confirmed that “there’s no indication that there’s any federal law that would be violated by the employer asking this question,” Cohen said.
According to the EEOC, employers would not be violating the Americans with Disabilities Act or the Genetic Information Nondiscrimination Act as long as they were careful about what vaccination-related questions they asked. A possible violation might be if an employer’s attempt to find out why a worker didn’t get vaccinated could elicit information about a disability.
It’s equally important to be mindful of state laws, Cohen said. Although it doesn’t violate federal laws to ask, those laws don’t make asking a requirement. “If the state says you can’t ask, then I think employers are likely to be governed by that state law,” he said.
Do I have to answer?
No, you can always decline to share your vaccination status. But, experts said, there are likely going to be consequences if you choose not to disclose.
“I would expect businesses to treat people who have not been vaccinated and people who refuse to say whether they have been vaccinated the same, because otherwise there’s no way to tell the difference,” Spector-Bagdady said.
Federal laws don’t prohibit private businesses that serve the public from requiring workers and customers to be vaccinated, Gatter said, as long as the businesses do not discriminate against anyone eligible for a medical or religious exemption. But it would also be within a state’s authority to pass new laws banning employment or entry conditions related to vaccines, masking and social distancing, he said.
In the absence of a state-level prohibition, Gatter said, private businesses are free to operate within the bounds of existing law. While they can’t refuse service based on race or gender, there isn’t a law saying “businesses cannot discriminate on the basis of your vaccination status with respect to covid during the pandemic,” he said.
When is it appropriate to ask?
That largely depends on the situation and risk factors.
In places where there might be increased risk of transmission, such as a crowded indoor workplace, concert or choir practice, “I would understand why people might want to ask,” Sharfstein said.
Employers and others should also feel comfortable asking when the answer is relevant to safety, Cohen said. “It’s entirely appropriate, given what we know about covid, to say that an employer has the right and maybe should do whatever they can to reduce the risk to everyone.”
But if you are asking, you should be prepared to have potentially awkward conversations and face pushback, Gatter said. “It’s sort of like me asking you your age or your income,” he said. Some people won’t respond well to that or to being told that they can’t do something unless they share information about themselves or put on a mask, he said.
How can I have respectful conversations?
Be transparent and honest about why you need to know someone’s vaccination status, experts said. Sharfstein suggested also explaining what the information gathered will be used for and how. “It respects people’s autonomy to tell them a little bit more rather than just asking a question,” he said.
If you’re being asked and you feel uncomfortable, Cohen said, don’t hesitate to bring up your own questions, such as, “Why are you asking this?” and “How will my answer affect me?” In situations where it’s a business or restaurant asking, he added, remember that you can always go somewhere else.
Gatter urged people reluctant to share their vaccination status to consider the safety of others. “When someone’s asking your vaccination status where the vaccine is about a novel virus that has caused a pandemic, and you work at a nursing home or you’re a student at a residential university,” he said, “I think you should be able to understand that, ‘That’s a worthwhile invasion of my privacy.’”