HIPAA Explained: Can a Business or Employer Ask for Proof of Vaccination?

With mask orders ending and COVID restrictions lifting for fully vaccinated people, many are wondering what is and isn't allowed when it comes to requesting proof of vaccination.

Some are questioning if requiring proof of vaccination violates HIPAA, or the Health Insurance Portability and Accountability Act of 1996.

HIPAA is a federal law that created "national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge," according to the U.S. Centers for Disease Control and Prevention. Under its privacy rule, health care providers and certain organizations are prevented from being able to share private health information about a person without their consent.

So does that apply to your vaccination status?

"HIPAA governs doctors, hospitals, companies like that," said Matthew Kugler, associate professor of law at Northwestern University. "If your restaurant says, 'Hey, show me your medical record,' that's something they can say. You don't have to say 'yes,' like you can be like, 'No, screw you, I'll go elsewhere.' But it isn't a HIPAA problem for them to ask to see it. It's only a HIPAA problem if they break into your doctor's office and steal it."

So far, many big box stores are relying on an honor system for customers, asking that those who are unvaccinated continue masking, but some businesses are requiring those who wish to go maskless to show proof of vaccination.

"In general, people are required to make reasonable accommodations for things," Kugler said. "So, that is why if you show up at a store and say, 'I want to go in,' and they say, 'Are you vaccinated?' and you say, 'No,' they're like, 'Oh here's your mask ' - that's a reasonable accommodation. I have difficulty seeing how asking someone to wear a mask would give grounds for a lawsuit."

The rules are similar when it comes to employers, but certain issues could arise when it comes to the Americans With Disabilities Act and anti-religious discrimination laws, Kugler said.

According to December guidance from the Equal Employment Opportunity Commission, asking an employee to show proof of vaccination would not violate the ADA. Asking for reasons why someone isn't vaccinated could pose a problem, however.

"Simply requesting proof of receipt of a COVID-19 vaccination is not likely to elicit information about a disability and, therefore, is not a disability-related inquiry," the commission states. "However, subsequent employer questions, such as asking why an individual did not receive a vaccination, may elicit information about a disability and would be subject to the pertinent ADA standard that they be 'job-related and consistent with business necessity.'"

The ADA, however, allows for an employer to have “a requirement that an individual shall not pose a direct threat to the health or safety of individuals in the workplace.”

"If a safety-based qualification standard, such as a vaccination requirement, screens out or tends to screen out an individual with a disability, the employer must show that an unvaccinated employee would pose a direct threat due to a 'significant risk of substantial harm to the health or safety of the individual or others that cannot be eliminated or reduced by reasonable accommodation,'" the guidance from EEOC reads.

For those with a religious exemption, the guidelines are similar.

"If an employee cannot get vaccinated for COVID-19 because of a disability or sincerely held religious belief, practice, or observance, and there is no reasonable accommodation possible, then it would be lawful for the employer to exclude the employee from the workplace," the guidance states.

This does not, however, mean an employer can immediately terminate an unvaccinated employee.

"Employers will need to determine if any other rights apply under the EEO laws or other federal, state, and local authorities," according to the guidance.