What’s Happening in HR – Newsletter  
 
By Michael F. Weiner, Legislative Director - 10/4/2021

U.S. Department of Health & Human Resources Issues Guidance on HIPAA, COVID-19 Vaccination, and the Workplace
On September 30, 2021, the Department of Health & Human Resources Issued FAQs to address questions about when and how the HIPAA Rules apply to uses and disclosures of Covid-19 vaccination-related information, particularly in the workplace. The questions and excerpted answers are set forth below. The guidance and full answers can be found at https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-covid-19-vaccination-workplace/index.html

1. Does the HIPAA Privacy Rule prohibit businesses or individuals from asking whether their customers or clients have received a COVID-19 vaccine?
No. The Privacy Rule2 does not prohibit any person (e.g., an individual or an entity such as a business), including HIPAA covered entities and business associates, from asking whether an individual has received a particular vaccine, including COVID-19 vaccines.

2. Does the HIPAA Privacy Rule prevent customers or clients of a business from disclosing whether they have received a COVID-19 vaccine?
No. The Privacy Rule does not prevent any individual from disclosing whether that individual has been vaccinated against COVID-19 or any other disease. The Privacy Rule does not apply to individuals’ disclosures about their own health information.

3. Does the HIPAA Privacy Rule prohibit an employer from requiring a workforce member to disclose whether they have received a COVID-19 vaccine to the employer, clients, or other parties?
No. The Privacy Rule does not apply to employment records, including employment records held by covered entities or business associates in their capacity as employers. Generally, the Privacy Rule does not regulate what information can be requested from employees as part of the terms and conditions of employment that an employer may impose on its workforce. 

4. Does the HIPAA Privacy Rule prohibit a covered entity or business associate from requiring its workforce members to disclose to their employers or other parties whether the workforce members have received a COVID-19 vaccine?
No. The Privacy Rule does not apply to employment records, including employment records held by covered entities and business associates acting in their capacity as employers.

5. Does the HIPAA Privacy Rule prohibit a doctor’s office from disclosing an individual’s protected health information (PHI), including whether they have received a COVID-19 vaccine, to the individual’s employer or other parties?
Generally, yes. The Privacy Rule prohibits covered entities and their business associates from using or disclosing an individual’s PHI.