Bloomberg Law
Free Newsletter Sign Up
Bloomberg Law
Free Newsletter Sign Up

HIPAA Is No Excuse for Keeping Mum on Your Vaccination Status

Sept. 30, 2021, 9:17 PM

Federal health privacy law doesn’t protect workers, students, or customers from most requests for information about their Covid-19 vaccination status, the Department of Health and Human Services’ Office for Civil Rights said Thursday.

Privacy protections under the Health Insurance Portability and Accountability Act apply in the health-care sector only, and don’t place restrictions on most employers, schools, and businesses, the HHS said in a Sept. 30 guidance document.

Even within the health-care sector, HIPAA privacy rules limit the use and disclosure of health information but do nothing to prevent entities covered by the rule from requesting information from patients and visitors, including information about vaccination status, the department said.

“We are issuing this guidance to help consumers, businesses, and health-care entities understand when HIPAA applies to disclosures about Covid-19 vaccination status and to ensure that they have the information they need to make informed decisions about protecting themselves and others from Covid-19,” said OCR Director Lisa Pino, who was named to her position Sept. 29.

Entities covered by the HIPAA Privacy Rule include health-care providers, health plans, and health-care clearinghouses.

The HIPAA Privacy Rule doesn’t apply to employers and employment records, including covered entities acting as employers, the HHS said.

This means that the rule doesn’t limit what information employers can request as part of the terms and conditions of employment, and doesn’t prevent employers from requiring their workers to disclose their vaccination status to their employer, other workers, or the public, the agency said.

But HIPAA’s privacy protections would prevent a health-care provider from disclosing a patient’s Covid-19 vaccination status to an employer without the patient’s consent, the HHS said.

Other state or federal laws address whether individuals are required to disclose whether they have received a vaccine under certain circumstances, the guidance said.

To contact the reporter on this story: Christopher Brown in St. Louis at

To contact the editors responsible for this story: Alexis Kramer at; Karl Hardy at