The Department of Health and Human Services’ (HHS) Office of Civil Rights (OCR) recently issued guidance to help the public understand when the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule applies to disclosures and requests for information about whether a person has received a COVID-19 vaccine. The guidance reminds the public that the HIPAA Privacy Rule does not apply to employers or employment records. This is because the HIPAA Privacy Rule only applies to HIPAA covered entities (health plans, health care clearinghouses, and health care providers that conduct standard electronic transactions), and, in some cases, to their business associates. The Privacy Rule does not apply to individuals’ disclosures about their own health information.
The guidance, HIPAA, COVID-19 Vaccination, and the Workplace, covers many concerns about sharing vaccination status and disclosing information about vaccination status that employers are struggling with during the pandemic.
