December 7, 2021

Disclosure of Employee Vaccination Status is Not a HIPAA Violation

Question: I’m frequently confronted by staff and patients with questions regarding their vaccination status. Can I ask them if they have been vaccinated? Can I disclose who has been vaccinated to patients? I’m always afraid to say anything about an employee’s health information because I don’t want to violate HIPAA. Can you provide me with or point me to guidance regarding what HIPAA allows me to say or inquire about when it comes to vaccination status?

Answer: Recently, the U.S. Department of Health and Human Services issued a set of frequently asked questions addressing how HIPAA applies to disclosures of vaccination status. These are available here. The following is a summary of the HHS guidance as it relates to the questions you raise:

  1. Does HIPAA’s Privacy Rule prohibit a dental practice from requiring patients to disclose their vaccination status or prohibit patients from requiring your employees to disclose their vaccination status? The answer to both questions is no. The Privacy Rule prohibits covered entities from making disclosures of the health information of others that they possess. It does not prohibit anyone from asking a question. Is also does not prohibit the disclosure of one’s own vaccination status or other health information. Individuals (patients or dental office staff) may refuse to answer when asked and suffer the consequences. Patients refusing to answer may not receive treatment. Dentists, hygienists, and others in your office refusing to answer a patient may cost the practice that patient.
  2. Does the HIPAA Privacy Rule prohibit a dental practice from requiring all its employees to disclose their vaccination status and proof upon request? Does it matter if the request is made by the dental practice or a patient? Again, the answer is no. The Privacy Rule does not prohibit the disclosure of vaccination status if it is acquired on a nondiscriminatory basis as a condition of employment. Employment records, including vaccination status, are not subject to HIPAA. Therefore, a dental practice employer may require all its employees to disclose their vaccination status to a patient upon the patient’s request.

Read the complete Q&A in the Journal of the Michigan Dental Association on page 24.

About the author:

Daniel J. Schulte answer questions about health care lawDaniel J. Schulte has more than 25 years of experience helping clients solve tough problems and capitalize on opportunities that require a blend of business and legal expertise. His practice focuses on addressing the legal, business, licensing, and regulatory challenges of health care professionals, organizations, and facilities. Dan understands how legal issues impact business objectives and, as a result, offers his clients practical, results-oriented advice. He is a Certified Public Accountant, former managing partner and current executive committee member of the firm. Dan also serves as co-chair of the firm’s Health Care Practice Group.

Other posts to consider:

Attorneys

Daniel J. Schulte

Practice Areas

Health Care Law