Misuse and misconceptions about HIPAA have been circulating in the news recently, with some falsely claiming the privacy law prohibits being asked about COVID-19 vaccination status, according to Robert Shmerling, MD.
In an Aug. 19 op-ed for Harvard Health Publishing, Dr. Shmerling, senior faculty editor for Harvard Health Publishing and an associate medicine professor at Harvard Medical School, shared key facts about HIPAA and said the law is unrelated to vaccination disclosures.
Seven things to know about HIPAA regarding vaccination status, according to Dr. Shmerling:
1. Some fake mask exemption cards, which are available online and intended to let the owner forego wearing a mask for medical reasons, falsely claim that the card's owner is not required to answer any questions about their medical condition. This is not true under HIPAA.
2. HIPAA privacy rules prohibit the release of protected health information, known as PHI, by others without your consent and "they have nothing to do with whether you can or should answer questions about your vaccination status, or any other health issue," Dr. Shmerling wrote.
3. HIPAA defines PHI as health information that is "individually identifiable," meaning it includes details that identify you, such as name, address and birth date; information about physical or mental health conditions you have or have had previously; details on healthcare you've received; and information about payments made for your healthcare services.
4. HIPAA requires that anyone who has access to your PHI, such as healthcare providers, health insurers or medical billing companies, must ensure it is kept confidential, safe from security threats and ensure that employees are trained in handling the confidentiality of the information.
5. HIPAA does not prevent anyone from asking you about your vaccination status, and "there's nothing in it that prohibits businesses, such as restaurants, gyms, or movie theaters, or your employer from asking you for proof of vaccination," Dr. Shmerling wrote.
6. HIPAA privacy rules also do not prevent you from answering questions about whether you've been vaccinated. It is your decision to tell others whether you have been vaccinated.
7. If you decide not to disclose your vaccination information to your employer if it's requested, "you will likely be considered unvaccinated, and that could lead to changes in how or where you work, or even to loss of your job. But again, that’s unrelated to HIPAA," Dr. Shmerling wrote.