Can businesses ask proof of COVID-19 vaccination? Experts explain HIPAA

As the national COVID-19 vaccination drive continues and workplaces navigate reopenings, some question whether businesses and employers can request proof of vaccination given patient privacy laws, like HIPAA.

Experts told FOX Business that both employers and businesses can legally request proof of COVID-19 vaccination status.

"The reason is simple: HIPAA provides all of us with assurance that our health care providers – doctors, dentists, nurses, psychologists, and more – as well as our health care insurers, will respect our privacy by not revealing information about our health without our knowledge and consent," said Eric Feldman, J.D., Ph.D., professor of medical ethics, health policy and law at the University of Pennsylvania Carey Law School, in a statement. 

"HIPAA does not prohibit businesses or employers from requesting health information, including information about vaccination status."

DESPITE CDC MASK GUIDANCE, BIDEN ADMIN MAY STILL ISSUE WORKPLACE MANDATE

HIPAA, the Health Insurance Portability and Accountability Act of 1996, is a federal law aimed to protect patient health information. Feldman explains that HIPAA specifically regulates health care providers, pharmacies and insurers, whereas businesses and employers fall beyond the scope of the law.

"Businesses and employers that reveal individual health information are also unlikely to run afoul of HIPAA because they are not ‘covered entities’ under the law," Feldman said, later adding, "there are other state and federal laws that may prohibit businesses and employers from sharing personal health information. Violating those laws does not mean that there has been a HIPAA violation."

According to Margaret Riley, law professor at the University of Virginia, "businesses are free to set whatever rules they like to protect their other customers and employees. A business that may have particularly vulnerable employees or customers may choose to apply stricter rules, including demanding proof of vaccination."

HALF OF US ADULTS TO BE FULLY VACCINATED AGAINST CORONAVIRUS, WHITE HOUSE SAYS

However, Riley doubts that most businesses, like retail, will request proof of vaccination.

"They are much more likely to use an ‘honor system,’" she said. "Such an honor system may take the form of a statement that customers that have been fully vaccinated may enter the premises without masks, while unvaccinated patrons are expected to wear masks.  No one will actually ask for proof because it is hard to do so. Even vaccinated individuals may not have that proof with them at the time they are coming to the business."

But businesses with a heightened risk of transmission (such as gyms, where patrons are breathing heavily for sustained periods of time) may request proof of vaccination, Riley said.

Nevertheless, people don’t have a legal obligation to share information they consider private, including vaccination status, experts said.

CDC REPORTS 10K BREAKTHROUGH COVID-19 CASES AMID 101M VACCINATED PEOPLE

"Failure to disclose that information, however, is likely to come with consequences such as being denied permission to enter a private business or a workplace," Feldman wrote, adding that the Equal Employment Opportunity Commission’s (EEOC) guidance on COVID-19 and the workplace offers added assurance to employers.

"It makes clear that asking employees for proof of vaccine status does not violate the Americans with Disabilities Act or the Genetic Information Nondiscrimination Act. It also underscores the legal obligation of employers to provide reasonable accommodation to employees who have legitimate medical or religious reasons to decline COVID-19 vaccination."