Vaccine Passport HIPAA

With the pandemic and now the Delta virus we now have actual vaccine passport kiosks available for sale and deployment. The impact being both on the general public in the role of customer, and with employees coming back to the office to work.

The arguments against disclosing vaccination status have, at times, focused on HIPAA. We have educated people telling people that “due to HIPAA, I cannot disclose my status”.  It’s actually more of Herman Melville Bartleby tactic where the fact is they prefer not to disclose.

The usual applications where HIPAA comes into play for kiosks can be Epic Welcome Kiosks for patient check-in for example, or any type of patient check-in. Generally unit collecting or touching patient information in health care provider, hospitals, nursing home or service providers.  Telehealth kiosks is another example.

Good article discussing.

In brief:

• #1 — It is not a HIPAA violation to ask someone their vaccine status
• Who does HIPAA regulate?
  • Health insurance companies, Medicare, Medicaid or employers who run self-funded health plans
  • Business associates, such as health care providers, hospitals, nursing homes or anyone actually delivering a health care service
  • Subcontractors of business associates, such as health care clearinghouses or billing companies that may transfer patient data
• You can ask. They do not have to answer.
• Some states are passing “Can’t Ask” laws and conflating them with HIPAA (e.g. home state of Oklahoma)

Article

As we return to learn and work in person, you might be wondering how to talk to others about whether they’ve gotten a COVID-19 vaccine — or if it’s even legal to ask.

When Rep. Marjorie Taylor Greene, R-Ga., was asked last month if she had been vaccinated against COVID-19, she said the question itself was “in violation of my HIPAA rights.”

“You see, with HIPAA rights, we don’t have to reveal our medical records and that also involves our vaccine records,” said Greene, who has previously pushed false claims about vaccines.

“HIPAA applies in many fewer circumstances than people think.”
Actually, that’s not true. “It is not a HIPAA violation to ask someone their vaccine status,” said Kayte Spector-Bagdady, who helps direct the University of Michigan’s Center for Bioethics & Social Sciences in Medicine. “HIPAA applies in many fewer circumstances than people think.”

HIPAA, or the Health Insurance Portability and Accountability Act, protects people’s private health information from being shared by certain health care entities without patient consent. But this 1996 law is far more narrowly defined than most people realize, Spector-Bagdady said.

Here’s what several health law experts say about the relevance of HIPAA and other rules when navigating interactions with others.

What does HIPAA cover?
Most people encounter HIPAA when signing consent forms at their doctor’s office. Typically, that is the extent of their exposure to this law or any other that governs health care and their privacy. So “there’s a lot of misapplication and misunderstanding in terms of what HIPAA does,” said Matthew Fisher, who serves as general counsel for Carium, a telehealth platform company, and has practiced health care law for more than a decade.

Here’s who HIPAA regulates:

Health insurance companies, Medicare, Medicaid or employers who run self-funded health plans
Business associates, such as health care providers, hospitals, nursing homes or anyone actually delivering a health care service
Subcontractors of business associates, such as health care clearinghouses or billing companies that may transfer patient data
That’s it. It doesn’t apply to conversations you might have on the street, said Margaret Riley, a professor of law at the University of Virginia and serves as legal advisor for the school’s Health Sciences Institutional Review Board.

“I can ask you on the street what your vaccine status is. I can ask you in my business what your vaccine status is. If I’m not your supervisor, that’s not a violation because I have no impact on you,” Riley said. “On the other hand, you have no obligation to answer me.”

The National Football League announced late last month it would penalize teams if they had COVID-19 outbreaks among unvaccinated players.

The decision came as more employers mandate that employees get vaccinated against COVID-19 to prevent outbreaks traced back to the workplace, preserving public health and productivity levels in one fell swoop. When New England Patriot quarterback Cam Newton was asked soon after in a news conference if he had been inoculated against the coronavirus, he sidestepped the question: “I think it’s too personal for each and every person to kind of discuss it, and I’ll just keep it at that,” he said.

“If I’m not your supervisor, that’s not a violation because I have no impact on you. On the other hand, you have no obligation to answer me.”
Newton is fully within his rights to not divulge his vaccine status to the news media. But there are many contexts where people might want to know if others with whom they have regular contact have gotten shots.

Claire Talltree, a retired epidemiologist and farmer in Snohomish, Washington, serves on the board of a nonprofit organization that meets regularly to discuss business. During much of the pandemic, those meetings took place virtually, but once vaccines became available and Washington lifted restrictions for social distancing, Talltree said the nonprofit’s board members suggested they all meet in person in restaurants and hold hourslong meetings over meals (which she said typically results in lax mask use). Because she was caring for vulnerable loved ones with compromised immune systems, Talltree, 64, asked if everyone had been vaccinated against COVID-19.

“I’ve been told it’s HIPAA, and they don’t have to tell me,” said Talltree, who added she is getting lots of pushback and has lost friends who died of COVID-19. “They want me to quit being fearful,” she said. “I’m not fearful. I just don’t want to catch this disease.”

Confusion beyond HIPAA
If HIPAA does not prevent you from asking most other people if they are vaccinated, new laws going into effect around the country may contribute to stifling conversation, if indirectly.

State lawmakers have submitted more than 150 bills tied to vaccine passports and mandates for employers and schools, according to the National Academy for State Health Policy. These orders come as the delta variant pushes the number of new infections to more than 100,000 each day — levels last seen in February before vaccines were widely available — and largely affecting unvaccinated swaths of the country.

In Oklahoma, Gov. Kevin Stitt signed into law on May 28 a mandate that prohibits colleges from requiring students to be vaccinated or wear masks, or from asking students if they are vaccinated.

That means that college instructor Dinah Cox, who is fully vaccinated but asthmatic, cannot even request that students in her English class wear a face covering. When classes resume in mid-August at Oklahoma State University in Stillwater, Cox said, she must teach in person in a windowless lecture hall. She is concerned that her preexisting health conditions might complicate an otherwise mild breakthrough infection. She has applied for medical accommodations to continue teaching virtual classes, but Cox said it is unclear if her request will be granted before school starts in mid-August.

“I prefer to teach in person. I just want to be protected when I do so and have my students protected,” she said. But she said she feels she must choose between her job and her health.

These state-based rules are creating confusion beyond what is often — and inaccurately — attributed to HIPAA, Riley said. “In that context, you’re going to have a lot of these conversations when people are seeking ways to protect themselves.”

This response is a “classic American public health response” with critical decisions being made at the “most local level possible,” said Jason Schwartz, an associate professor in the Yale School of Public Health.

“We’ve seen unhelpful restrictions in some states that have limited the ability of institutional leaders at schools, businesses and colleges to have the information they need about risk present in their community and ability to respond to it,” Schwartz said.

During a global pandemic with a highly infectious variant causing more infections, these incremental choices can ultimately hinder greater progress and harm more people, he added.