Due to the volume of federal, state, and international privacy regulations, it is understandable some businesses may be uncertain about whether you can ask for proof of COVID-19 vaccination status.
The short answer to the question is yes. There are no federal, state, or international privacy regulations that prohibit businesses asking employees, customers, or other third parties (i.e., visitors, contractors, etc.) about their COVID-19 vaccine status.
What complicates the answer is how businesses record individuals´ responses, whether or not they ask secondary questions, and how they react if an individual is unable to – or refuses to – provide proof of their vaccination status.
The Issue with How Businesses Record Answers to COVID-Related Questions
There is a lot of discussion in the media about whether asking individuals about their COVID-19 vaccination is a breach of HIPAA because you are asking them to disclose personal health information.
As mentioned above, there are no privacy regulations that prohibit asking the question, but there are privacy regulations relating to how personal information is recorded and stored to protect it against unauthorized use or disclosure.
With regards to HIPAA, although it is the most-commonly discussed privacy regulation, HIPAA only applies to organizations in the healthcare and health insurance industries and their third-party service providers (known as HIPAA Business Associates).
Businesses in other industries are not required to comply with HIPAA but may be subject to state privacy regulations (i.e., the California Privacy Rights Act) or international privacy regulations such as the EU´s General Data Protection Regulation (GDPR).
In these cases, it is important to be aware that if a business asks an individual about their COVID-19 vaccination status, and the individual lives in a state or country in which privacy regulations apply, the business asking the question is subject to those privacy regulations regardless of its own location.
The Issue with Secondary Questions
While it is okay to ask an individual for proof of their COVID-19 vaccination status, there are circumstances in which secondary questioning (i.e., “why have you not had the vaccine?”) can create problems that have the potential of deteriorating into legal issues.
There are circumstances in which people may not be able to have a COVID-19 vaccine for health reasons, and if an employer asks a secondary question that goes beyond being “job related and consistent with business necessity”, it is likely they will be in violation of the Americans with Disabilities Act – especially if the answer to a secondary question is subsequently used to support a discriminatory practice against the individual.
The same issue exists with asking secondary questions to people who have objected to being vaccinated due to their religious beliefs. Under Title VII of the Civil Rights Act 1964, individuals have the right to be free from discrimination on the basis of religion and employers are required to accommodate religious observances and practices, unless doing so imposes an undue hardship on the business.
What If an Individual Cannot or Refuses to Provide Proof?
There are scenarios businesses need to be prepared for before asking for proof of COVID-19 vaccination status. Individuals have the right to withhold personal information whether they are an employee, a customer, or third party, and there is very little businesses can do to force the disclosure of personal information.
In these cases, businesses should prepare policies in advance that stipulate what action(s) will be taken if an individual cannot provide proof or refuses to provide proof – notwithstanding that no healthcare provider will be able to disclose the vaccination status of a patient without the patient´s authorization under HIPAA.
Options for employers include enforcing COVID-19 mitigation strategies for employees who are unable or who refuse to prove their vaccination status (i.e., mask wearing and social distancing), while customers can also be asked to wear a mask while in a store, or the business can organize their purchase to be collected outside the business.
Conclusion
Businesses have a legal obligation to maintain safe workplaces and premises; and, in order to do this, it may be necessary to ask individuals about their COVID-19 vaccination status. Due to the potential pitfalls of not asking the right questions, or asking too many questions, businesses unsure of their options should seek professional compliance advice.
Video Training
Engaging Content
Perfect Refresher
Flexible/Convenient
Self-paced Learning
Multi-Choice Testing
Free Trial
HIPAA
Training for
Healthcare
Staff
