No, it’s not a HIPAA violation for businesses to ask for proof you’ve been vaccinated. Here’s what the healthcare privacy law actually means and what it protects.
No, it’s not a HIPAA violation for businesses to ask for proof you’ve been vaccinated. Here’s what the healthcare privacy law actually means and what it protects.
Later this month, New York City will start requiring proof of vaccination if you want to participate in indoor activities.
The mandate, which was handed down by Mayor Bill de Blasio on Tuesday, will require people to show either their paper vaccine card or one of two types of digital passes to enter venues like gyms, restaurants, and performances. While many businesses across the country have opted to require vaccine proof for several months, New York will be the first major US city to enforce this type of mandate.
And while some are quick to show proof, others are reticent to disclose their status, pointing to privacy laws like HIPAA as a justification for not having to share whether they've gotten the jab.
So, is asking someone's vaccination status a HIPAA violation? The short answer: No.
As Insider's Carla Delgado explains, HIPAA includes a privacy standard that makes it illegal for certain "covered entities" to disclose your medical information. That group includes:
Healthcare providers. Doctors, nurses, dentists, nursing homes, and psychologists fall under this category.
Health plans. This includes health insurance companies, Medicaid, Medicare, and veteran healthcare programs.
Health clearinghouses. These are entities that process health information, such as billing services, community health information systems, or repricing companies.
Business associates of covered entities. This could include consultants or third-party administrators who engage with those organizations.
GRANT HINDSLEY/AFP via Getty Images
If someone asks to see proof you've been vaccinated against COVID, is it a HIPAA violation?
No.
HIPAA only applies to entities within the healthcare field and it does not prohibit asking questions about someone's health.
"People just generally think that HIPAA protects all health information at any time for any purpose whatsoever, no matter who is involved. And that's absolutely not true," Deven McGraw, cofounder of consumer health technology company Ciitizen, recently told NPR.
"It does not cover restaurants. It does not cover stores. It does not cover your employer," she said. "And it doesn't cover you personally."
Why do some people think vaccine requirements violate HIPAA?
Questions over whether or not someone has gotten the jab have led to pushback from public figures in recent months.
Last month, Rep. Marjorie Taylor Greene, a Republican from Georgia, was asked during a news conference whether she was vaccinated - she responded that the question was "a violation of my HIPAA rights." Mark Robinson, the lieutenant governor of North Carolina, shared a similar sentiment on Facebook in July, writing that President Joe Biden's campaign to encourage vaccines was "violating HIPAA laws."
The phrase has also surfaced in the sports world. Dallas Cowboys quarterback Dak Prescott was recently asked during a press conference if he's vaccinated, to which he responded: "I don't necessarily think that's exactly important ... I think that's HIPAA."
These claims are incorrect and perpetuate harmful anti-vaccine narratives, Tara Kirk Sell, an assistant professor of health security at Johns Hopkins's Bloomberg School of Public Health, told The New York Times.
"The HIPAA laws are real and they do something important," she said. "The misinterpretation of what it's all about just adds to this firestorm of anti-vaccine sentiment."
