HHS issues guidance about when HIPAA applies to COVID-19 vaccinations

The Office for Civil Rights at the U.S. Department of Health and Human Services has unveiled guidance to clarify when the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule applies to disclosures about whether a person has been vaccinated for COVID-19.

The HHS says the guidance serves as a reminder that the HIPAA Privacy Rule does not apply to employers or employment records. That’s because the HIPAA Privacy Rule only applies to HIPAA covered entities, including health plans, health care clearinghouses, and health care providers that conduct standard electronic transactions, according to HHS.

The federal agency says the guidance addresses common workplace scenarios and answers questions about whether and how the HIPAA Privacy Rule applies.

"We are issuing this guidance to help consumers, businesses, and health care entities understand when HIPAA applies to disclosures about COVID-19 vaccination status and to ensure that they have the information they need to make informed decisions about protecting themselves and others from COVID-19," OCR Director Lisa Pino said in a prepared statement.

The Guidance on HIPAA, COVID-19 Vaccinations, and the Workplace may be found at this web page on the HHS website.