As employees in the United States begin to return to their offices after working from home, many have been faced with a Covid-19 vaccination mandate or are being asked to disclose their vaccination status by their employer. There has been some confusion over the legality of these mandates and whether or not requiring vaccine disclosure is a HIPAA violation. This article will explain what HIPAA is and what a violation of that would be, as well as the legality of vaccine mandates.
In 1996, the Health Insurance Portability and Accountability Act, or more commonly known as HIPAA, was enacted as a requirement to protect a patient’s sensitive health information from being shared without their knowledge. Within the act, there is a “privacy rule” which determines who needs permission to provide a patient’s information. Organizations that are subject to follow this rule include healthcare providers, health plans, healthcare clearinghouses, and business associates related to healthcare.
Additionally for these organizations, “personal details such as whether or not an individual has been vaccinated…comes within the ‘provision of care’ classification of health information that should be protected when it can be combined with other personal details (i.e., name, social security number, etc.) that can identify the individual”. Yet, only the covered entities listed above are subject to these rules, and many businesses in the United States are not considered to be within these categories.
This means that, for instance, your healthcare provider can not disclose your private health information to your employer without your consent. But, if your employer is not one of these covered entities, then it is within their right to ask you for proof of a vaccination or to wear a face mask when in the workplace. This kind of requirement occurs already in many forms, such as colleges requiring certain vaccinations in order for their students to attend. Asking about vaccines can become a violation of someone’s rights when an employer asks why an employee does not have their vaccination. It is not against HIPAA to ask an employee for proof of vaccination, but it would be a violation for an employer to ask an employee’s healthcare providers for additional information about the reason they can not get a vaccine.
Another issue that people disagree about in regards to the Covid vaccine are vaccine mandates. Recently, President Biden issued a vaccine mandate for federal government employees, which many people saw as an illegal use of power. But many employers already have vaccine mandates, such as hospitals and healthcare clinics, in order to protect their patients from viruses. In December 2020, it was decided by the Equal Employment Opportunity Commission that, “employers can have a mandatory vaccination policy, including for COVID-19, as long as employers comply with federal laws stipulating that reasonable accommodations should be made for workers who cannot be immunized because of a disability or religious reason”. Many states have exceptions that waive vaccine mandates for people with religious or philosophical reasons. Courts decided this by referencing Roe v. Wade, and ruling that people have a right to medical privacy and what to do with their body. But this ruling is not unlimited, and a person’s right to medical privacy can be disregarded for the state’s interests. As with the smallpox vaccine mandate in the 1800s, “as long as the public health need for widespread vaccination exists, the courts will not recognize a privacy right to refuse state-mandated vaccination”.
The second issue people have with requiring the Covid vaccine is the fact that it is only approved for Emergency Use Authorization (EUA) by the Food and Drug Administration (FDA).* Under an Emergency Use Authorization, “FDA may allow the use of unapproved medical products… in an emergency to diagnose, treat, or prevent serious or life-threatening diseases or conditions when certain statutory criteria have been met, including that there are no adequate, approved, and available alternatives”. Some take issue with the notion of mandating the usage of an EUA, but there is currently no state law permitting or prohibiting mandates. Because of this, determining its legality will be decided by future court decisions and until then a company can require its employees to have a Covid vaccine.
To conclude, during this continuing pandemic it is important to know where your rights as an employee begin and end with regards to the Covid vaccine. As of now, you can be required to disclose your vaccine status with your employer, and there is no current ruling on the legality of a mandate for an EUA vaccine. As people return to work and face these requirements, we will probably see many court cases which will help decide the legitimacy for the Covid vaccine, and possible future pandemic vaccines.
*The Pfizer vaccine was fully approved on August, 23 2021 by the Food and Drug Administration
References:
Emergency Use Authorization for Vaccines Explained. (2020, November 20). U.S. Food and Drug Administration. Retrieved August 13, 2021, from https://www.fda.gov/vaccines-blood-biologics/vaccines/emergency-use-authorization-vaccines-explained
Malone, K. M. & Hinman, A. R. (n.d.). Vaccination Mandates: The Public Health Imperative and Individual Rights. Centers for Disease Control and Prevention. https://www.cdc.gov/vaccines/imz-managers/guides-pubs/downloads/vacc_mandates_chptr13.pdf
Gore, D. (2021, May 10). Exploring the Legality of COVID-19 Vaccine Mandates. FactCheck.org. https://www.factcheck.org/2021/05/exploring-the-legality-of-covid-19-vaccine-mandates/
FACT SHEET: President Biden to Announce New Actions to Get More Americans Vaccinated and Slow the Spread of the Delta Variant. (2021, July 21). The White House. Retrieved August 12, 2021, from https://www.whitehouse.gov/briefing-room/statements-releases/2021/07/29/fact-sheet-president-biden-to-announce-new-actions-to-get-more-americans-vaccinated-and-slow-the-spread-of-the-delta-variant/
Is it a HIPAA Violation to Ask for Proof of Vaccine Status?. (2021, May 25). HIPAA Journal. Retrieved August 12, 2021, from https://www.hipaajournal.com/is-it-a-hipaa-violation-to-ask-for-proof-of-vaccine-status/
Health Insurance Portability and Accountability Act of 1996 (HIPAA). (2018, September 14). Centers for Disease Control and Prevention. Retrieved August 12, 2021, from https://www.cdc.gov/phlp/publications/topic/hipaa.html
