The Privacy Rule also sets standards for an individual’s privacy rights to understand and control how their health information is used.
The HIPAA Privacy Rule permits disclosure of health information if it is required by law or for “public health activities and purposes,” the CDC’s website states. The HIPAA Privacy Rule allows disclosure of someone’s health information for the purpose of “preventing or controlling disease, injury, or disability, including but not limited to, the reporting of disease, injury, vital events … and the conduct of public health surveillance … investigations, and … interventions,” the CDC’s website states.
HIPAA applies only to “covered entities,” such as health care providers such as doctors, clinics, pharmacies or nursing homes, a health plan, such as health insurance or a company health plan or a health care clearinghouse, the HHS website says. Therefore, it is not illegal for a business to ask an employee or customer for proof of vaccination. If a business were to contact an employee or customer’s doctor or healthcare provider about their vaccination status and the healthcare provider complied, that would be considered a HIPAA violation.
About the Author
