Posted by Post Authored By: Laura Wibberley
HIPAA is often misunderstood by the general public. As we are finally entering the end-stages of the COVID-19 pandemic, there are new questions emerging regarding the new vaccinations and potential HIPAA violations. New guidance from the Centers for Disease Control and Prevention (CDC) on May 16, 2021 recommends that if you are fully vaccinated, you can safely resume activities without wearing a mask or physically distancing. Exceptions apply including where federal, state, local laws, rules, or regulations still require masks to be worn. Persons are considered fully vaccinated two weeks after their second dose in a 2-dose series, which would include the vaccines produced by Pfizer and Moderna or two weeks after their dose in a single dose series such as the Johnson & Johnson vaccine. However, now the question becomes how to verify one’s vaccination status for the benefit and safety of the general welfare while balancing an individual’s privacy concerns. In the midst of this balance is HIPAA. However, HIPAA is largely confused by the public in this context. Some erroneously believe that merely asking an individual whether he or she has received a vaccine constitutes a HIPAA violation.
First, your vaccination status is considered protected health information under HIPAA. The Health Insurance Portability and Accountability Act (“HIPAA”), including all subsequent amendments and the various Privacy Rules, including Privacy Rule 45 CFR Part 160 and Part 164, establishes standards to ensure the privacy and protection of patient medical records and other protected health information. HIPAA protects protected health information, which is “individually identifiable health information” that relates to the persons physical or mental health. See 45 C.F.R. § 160.103. This language is broad such that, arguably, one’s vaccination status could be considered protected health information subject to protection under the Act.
However, the caveat is that HIPAA only applies to “covered entities” and does not act to prevent an individual from disclosing his or her vaccination status. For example, “covered entities” subject to HIPAA may include hospitals, nursing homes, doctors, pharmacies, and health insurance companies. “Business associates” are also subject to HIPAA and can include consultants or third parties that assist with or have access to protected health information. Per the statute, in order for a covered entity to disclose a patient’s health information, such as one’s vaccination status, it must first obtain the patient’s written authorization of consent when the disclosure is not for the purposes of further medical treatment, medical payment issues, or similar health care issues. See 45 C.F.R. § 164.508. In fact, if a covered entity fails to abide by these strict privacy laws, it can be subject to sanctions of monetary fines and investigations by the Department for Health and Human Services, as well as the Office for Civil Rights. 45 C.F.R. § 160.
Thus, while your physician cannot disclose your vaccination status absent certain exceptions, you certainly are not prohibited from doing so under HIPAA. Of course, an individual can choose to refrain from providing this information, but he/she should be prepared to maintain proper social distancing precautions and facial coverings for the safety of those around since vaccination status cannot be properly verified.
About the Author:
Laura Wibberley practices in general litigation with a concentration in the area of medical negligence with the privilege of serving in the defense of hospitals, physicians, nurses, and other healthcare providers. She also serves in the defense of long-term care facilities and assisted living facilities. In order to achieve early and favorable results, Laura is involved in pre-litigation investigations. She has also assisted with presentations at health care facilities designed to educate practitioners on challenges and concerns in the context of litigation. Laura Wibberley graduated Valedictorian and summa cum laude from The John Marshall Law School.