Since the COVID-19 vaccines became a reality in late 2020, the media have been discussing vaccine cards and vaccine passports. Now that obtaining the vaccine is theoretically possible for nearly every American adult who wants it (I say theoretically because there are structural barriers in place for many Americans that make it difficult for them to get to vaccine sites), we’re starting to hear about the possibility, or in some cases a mandate, of businesses requiring the vaccine for entry and vaccine requirements for work or school. To be clear, at the time of this post, the U.S. has not adopted any policy regarding vaccine passports or issued guidance on businesses and schools requiring proof of vaccination. But these conversations inevitably lead to someone asking, “Isn’t that [sharing vaccination proof] a HIPAA violation?” The answer is, “No, HIPPA doesn’t cover that.”
It’s wonderful that people realize there is a regulation that protects their privacy as a patient because patients should always understand their rights. But we need to clear up some confusion as to what, exactly, HIPAA is and what it protects as well as what is legally allowed to be mandated at this time.
What is HIPAA?
The Health Insurance Portability and Accountability Act (HIPAA) protects a patient’s private health information in a number of ways, with the most common way being that it limits how much and what kind of your private health information healthcare providers or covered entities may share. The key here is it limits how healthcare providers and other covered entities may share your information. It doesn’t limit how you may share your health information, and businesses operating outside of the scope of health care and insurance are not covered entities.
What does HIPAA cover?
As noted above, HIPAA covers interactions between covered entities like healthcare professionals and insurance companies. It ensures the minimum amount of a patient’s health information is shared, and the information should only be shared for the purpose of treating the patient. So, a physician can’t share information about you with anyone in general conversation. They may only share information about your health with other providers who will be treating you, and even then, they must only share the minimum amount of information necessary to treat you at that time.
HIPAA regulations may be waived by patients to allow others not involved directly in their treatment to see their private health information. For example, if a family member is caring for you, you may allow a physician to discuss your medical records with that family member.
To learn more about HIPAA, visit the U.S. Department of Health and Human Services’s HIPAA FAQs guide.
How can I be forced to show proof of vaccination?
According to Olson (2021), no federal law prohibits private businesses from requiring proof of vaccination for you to voluntarily take advantage of their services or employment. In fact, public health expert and Georgetown law professor Lawrence Gostin says requiring proof of vaccination for work or obtaining service from a business is “legal and ethical” because these businesses have an obligation to provide a safe environment for employees and customers (as cited in Watson, 2021). Employers are legally required to offer religious and medical exemptions for required vaccinations.
Are vaccination requirements and proof new?
Proving you have received required vaccinations for work, school, and travel is not new.
Davis (2021) explains businesses have historically been able to require their employees to receive certain vaccinations as a condition of employment as long as employers can show vaccination is a business necessity or is justified by a “direct threat” to the health and safety of the workforce.
States have been able to set their own laws for vaccinations for entry into public schools. According to Flanagan-Klygis (2003), mandatory vaccination for schools began in the U.S. in the 19th century after a smallpox epidemic in Massachusetts when the state’s Supreme Court upheld a ruling that the state could enact universal vaccination requirements as part of the state’s powers to protect public health. There is no federal government mandate for vaccines required for public school students, however all 50 states have adopted some kind of vaccine requirements for students with varying degrees of exemptions.
Colleges and universities may require proof of vaccinations for attendance, and failing to obtain vaccinations may result in acceptance being revoked even if you meet all other acceptance requirements. According to Nadworny (2021), the states in which these institutions reside may have laws that impact what the institution may require; for example, a state constitution may grant certain rights to public institutions while private institutions may have more leeway to make their own decisions. Vaccine mandates have been challenged in the past, but generally they have been upheld in the courts. Many institutions offer medical exemptions. In addition to these legal precedents, Nolan, a attorney specializing in employment and education law, says students attending a college or university are agreeing to abide by the rules of the institution, and sometimes these rules are necessarily intrusive (as cited in Berman, 2021).
Countries may also require proof of vaccinations for travelers. The CDC (2021) website provides a country directory listing required and recommended vaccinations for travelers. Common requirements include routine vaccines that U.S. citizens should receive throughout their lifetimes. Other vaccines are required or recommended depending on the country and its common health issues and healthcare systems, but may include rabies, polio, cholera, malaria, yellow fever, and COVID-19.
Can COVID-19 vaccines be required now in the U.S.?
What makes the legality of requiring COVID-19 vaccinations, and the resulting proof of vaccination, questionable is that, as of the time of this writing, the vaccinations are operating under an emergency use authorization (EUA). Traditionally, vaccines have not been mandated while under EUA. Berman (2021) explains the language in EUA stresses people must be informed of their right to refuse a vaccination. This language has traditionally been interpreted to mean a vaccine under EUA can’t be mandated, but the language is open for interpretation. We will surely see the language interpreted differently with COVID-19, and the courts may need to decide just just how much this language is open to interpretation.
However, also at the time of this writing, Pfizer/BioNTech and Moderna are seeking full approval from the FDA for its COVID-19 vaccinations for people as young as 16 (Keown, 2021). If these vaccinations are given full FDA approval, the legality of mandating them can still be disputed, but the argument in favor of mandates would be much stronger.
Christina J. Steffy 