Recent guidance confirms that employers may ask if their clients, employees or customers have received a COVID-19 vaccine without violating the HIPAA rules.
The HIPAA Privacy Rule does not prohibit an employer to ask if an individual has been vaccinated for COVID-19. Many employers are requiring their customers to report vaccination status and requiring employees to be vaccinated. The U.S. Department of Health and Human Services said that the HIPAA Privacy Rule is not violated when an individual
- Is asked about their vaccination status by a school, employer, store, restaurant, entertainment venue, or another individual.
- Asks another individual, their doctor, or a service provider whether they are vaccinated.
- Asks a company, such as a home health agency, whether its workforce members are vaccinated.
Since HIPAA does not apply to employment records, the Privacy Rule does not regulate what information an employer can require its employees to provide as a term and condition of employment. Employers are permitted to ask employees about vaccination status. Documentation of vaccination should be kept confidential and separate from an employee’s personnel file, as an employment record it is not subject to HIPAA.
For more guidance on how the HIPAA Privacy Rule impacts employer inquiries about vaccination status, refer to new FAQs which may be accessed by clicking here.
