By Carole McNall

Picture this: Georgia Congresswoman Marjorie Taylor Greene is meeting with reporters in her office. One reporter asks her if she is vaccinated.

“Your first question is a violation of my HIPAA rights. You see, with HIPAA rights, we do not have to reveal our medical records and that also includes our vaccine records.”

Clear. To the point.

And absolutely wrong.

The congresswoman and many others have attempted to rewrite a 27-year-old federal law to make it cover people it does not cover and ban actions it does not ban.

HIPAA – the Health Insurance Portability and Accountability Act of 1995 – does restrict disclosure of a person’s identifying health information in some cases.

But the rules do not bar anyone – reporters, your employer, the owner of a restaurant or anyone else — from asking about your health information.

Employers, for example, can legally ask for health information if they need that information for purposes like health insurance and worker’s compensation, according to a U.S. Department of Health and Human Services website.

What matters is who the employer asks. A health care provider needs your permission to disclose information. But the law does not ban your employer from asking you directly.

Experts who spoke to the Washington Post in May 2021 said very few people or organizations are barred by law from asking about health information like vaccine status. Individuals may refuse to answer, but the experts warned that refusal may have consequences.

HIPAA’s privacy rules protect “sensitive patient health information from being disclosed without patient’s consent or knowledge,” according to cdc.gov. But again, if someone asks you for that health information, it is only being disclosed with your knowledge.

And those rules only cover “entities subject to the privacy rule.”

The list of those covered entities is far shorter than many people appear to believe. Covered entities fall into three groups:

• Health care providers
• Health plans
• Business associates of the above

Note who’s not listed. Coaches, for example. Employers in general.

And note this again: the rules cover disclosure of protected information. They do not cover someone asking an individual about that information.

So what is protected information?

Guidance on the HHS.gov website defines it as ‘individually identifiable health information held or transmitted by a covered entity or its business associate.” The website explains individually identifiable health information is information relating to the following:

• An individual’s past, present or physical or mental health or condition;
• The provision of health care to the individual, or
• The past, present or future payment for the provision or health care to the individual.

Again, the law only blocks disclosure of this information by covered entities, a fairly limited group. A pharmacy, for example, would need permission to disclose the fact that a patient had received the COVID-19 vaccine. The patient’s friend who drove her to get the shot would not be barred by HIPAA from talking about it. (Note that some state laws might block disclosure. And the friend would likely feel friendship blocked an answer to that question.)

Picture this: A politician speaks to reporters in her office. One of the reporters asks if she is vaccinated against COVID -19. The politician acknowledges the reporter’s right to ask, but replies that she prefers not to discuss her health care decisions in public.

Carole McNall, an attorney, is an assistant professor in the Jandoli School of Communication at St. Bonaventure University.

Categories: Jandoli Institute, Media