The guidance does not establish any new principles with respect to HIPAA, but it does provide helpful information and examples clarifying that HIPAA’s privacy rules are not a barrier to an employer that would like to establish a vaccination requirement for its employees and customers.

The guidance

The guidance restates an established principle: that HIPAA’s privacy rule only applies to covered entities, including health plans, certain healthcare providers and healthcare clearinghouses and their business associates. The HIPAA Privacy Rule does not apply to employers or employment records.

The guidance states that HIPAA does not prohibit anyone, including a HIPAA covered entity or business associate, from asking whether an individual has received a particular vaccine, including COVID-19 vaccines. It does regulate how and when a covered entity or its business associate may use or disclose information about an individual’s vaccination status. Consequently, nothing in HIPAA’s Privacy Rule prohibits employers from requiring an employee to disclose whether they have been vaccinated and provide documentation of this requirement. Documentation of vaccination and other records must be kept confidential under the Americans with Disabilities Act.

The Privacy Rule also does not prohibit an employer from requiring an employee to wear a mask or sign a HIPAA authorization permitting a provider to disclose the employee’s vaccination status to their employer.

These rules complement guidance issued by the Equal Employment Opportunity Commission (EEOC) in May 2021 concerning vaccine requirements for employers. The EEOC guidance addresses certain issues relating to vaccines.

Additional guidance is likely

The Biden administration is likely to continue to publish guidance concerning the application of existing laws and regulations to COVID-19 vaccination policies.