Features Navigation

Live Chat (800) 825-0224 Live Demo

← Back

Is Requesting Proof of COVID-19 Vaccine a HIPAA Violation?

Disclaimer: This blog article was written by an AdvancedMD partner. The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the official policy or position of AdvancedMD.

CoVID19 vaccine

The CDC has recently stated that individuals who have been vaccinated do not need to wear masks. As a result, many states have lifted mask restrictions. This begs the question of what to do if your state has lifted mask restrictions and somebody walks into your office without a mask?

The CDC stated that Americans no longer need to wear a mask outside or in MOST indoor spaces. States and business can still maintain their existing mask rules if they want.

How should you handle this in your office?

There are two groups of individuals we need to consider with discussing mask rules in a medical practice: staff and non-staff. Any patient, sales representative, delivery person or other person who comes into your office would be in the non-staff category.

With staff we have several federal and state employment rules that must be followed.

The EEOC has stated that employers may encourage or require COVID-19 vaccinations if their policies comply with the ADA, Title VII of the Civil Rights Act of 1964 (Title VII) and other relevant state and federal workplace laws.

The Americans with Disabilities Act (ADA) permits employers to prevent employees returning to the workplace if the employer can show that the employee would pose a direct threat due to a “significant risk of substantial harm to the health or safety of the individual or others that cannot be eliminated or reduced by reasonable accommodation.”

Can you ask an employee if they have had a COVID vaccination?

Can we require employees to continue to wear masks?

Under the Federal Rules we are aware of, the answer to both questions is YES.

What about patients?

You can ask your patients if they have had the vaccine, but nobody is obligated to provide you with an answer, but there may be other ways to get that information. Many states have immunization registries, these registries may have information on the COVID vaccination status of patients in your state. If your state registry has that information, you can query the registry about the patient’s vaccination status.

Under HIPAA The Privacy Rule permits covered entities to disclose PHI, without authorization, to public health authorities or other entities who are legally authorized to receive such reports for the purpose of preventing or controlling disease, injury, or disability.

A query about a patients COVID vaccination status is for the purpose of preventing or controlling disease.

You potentially have multiple methods of obtaining a patients COVID vaccination status, but it is still possible that do not know for sure.

What about requiring staff and patients to continue to wear masks in your office?

The published CDC guidelines are recommendations. They state that masks are not required in MOST indoor spaces. The key word here is MOST. The recommendations also allow businesses and states to continue to require masks. Especially in the healthcare environment, it may be wise to continue to require masks for a longer period than other indoor spaces, but it would be in your best interest to check with your state and local government to make sure that you do not violate a local rule or regulation by requiring the use of masks in your practice.

In my practice, I will continue to require the mask use by both staff and patients for now.

It is always advisable to consult with your healthcare attorney to ensure you are following all the local rules and regulations in your practice.

Michael Brody, DPM
Dr Brody has been actively involved in Computers and Medicine since the 1980’s. Dr Brody as a Residency Director at a VA hospital on Long Island and was present as the VA moved from paper records to computerized records. During this time, he was exposed to the stringent rules and regulations that government employees need to adhere to when protecting patient information. He co-founded TLD Systems with Warren Melnick to create a platform that doctors who wish to work in private practice have a cost-effective method of implementing HIPAA compliance in their practices in a manner that does not interfere with their ability to practice medicine. He has served on the Health Information Technology Standards Panel (HITSP), the Standards and Interoperability Framework (S&I), as a member of the Ambulatory Care Committee at the Certification Commission on Health Information Technology (CCHIT), and numerous other organizations. He is currently a member of the Physicians Committee at the Healthcare Information and Management Systems Society (HIMSS) and a co-Chair of the EHR workgroup at Health Level Seven International (HL7)


Other Resources Related to This Topic

No results found

“The money I have invested in AdvancedMD is miniscule compared to the return. I have never been more efficient – ever – in my professional life as I am now.”

Jed Shay, MD
The Pain Care Center

Read the story  ›

“[Our] patients are very well-educated and well-informed, and they want to see results quickly. The practice has to run extremely efficiently and be accessible to them. The nice thing about [AdvancedMD] is it has allowed me to be more efficient both in and out of the office. Now I don’t have to come back into the office, which is great for my family and everything else. It saves me a lot of time – probably an hour a day on the three days I work in the second office.”

Keith Berkowitz, MD
Center for Balanced Health

Read the story  ›

“The best thing I ever did in private practice was getting AdvancedMD—it has liberated me.”

Estaban Lavato, MD
La Loma Medical Center

“Having integrated practice management and EHR is absolutely wonderful, you don’t have to flip back and forth between systems—all of your information is at hand when needed.”

Raju Raval, MD

Read the story  ›