Vaccine mandates and HIPAA, experts weigh in

AUGUSTA COUNTY, Va. (WHSV) - With the FDA’s recent approval of the Pfizer COVID-19 vaccine and rates of vaccination increasing, vaccine mandates are becoming more popular, especially in concert venues and theatres.

The requirement has become a popular debate topic, with many citing HIPAA, the Health Insurance Portability and Accountability Act, as a reason to keep vaccination status private.

HIPAA protects a patient’s private health information from being disclosed to other entities, according to the CDC, but the Department of Health and Human Services says the protection exists primarily within the medical field.

The Virginia Department of Health said in an email, “Businesses may ask about a patron’s vaccination status without it being a violation of the Health Insurance Portability and Accountability Act (HIPAA).”

That’s because private businesses aren’t a covered entity within the law.

Augusta Health Compliance Officer D. Scott Jones says HIPAA applies to only covered entities, like most health care providers, contractors and subcontractors related to health care, billing companies within the medical field, and people like lawyers, accountants and IT specialists, among others.

Jones and the Department of Health and Human Services say anyone outside of the covered entities, like most schools, law enforcement officials and employers, don’t fall into HIPAA’s protection.

“Asking for vaccination status is not automatically a violation of HIPAA,” said Jones in an email. “Under the current national public health emergency conditions, the Department of Health and Human Services Office of Civil Rights has allowed HIPAA enforcement discretion.

Some states, like Florida, have implemented laws banning the use of vaccine mandates in private businesses.