Fact check: Businesses can legally ask if patrons have been vaccinated. HIPAA does not apply.

Devon Link, USA TODAY
·4 min read

The claim: HIPAA prevents anyone from asking if you are vaccinated

As mask-wearing and social distancing guidelines relax for fully vaccinated people, businesses are navigating how to implement new policies in their stores. Many businesses are ending mask requirements only for fully vaccinated customers.

Vaccine opponents, including Rep. Marjorie Taylor Greene, R-Ga., are using the occasion to resurrect the false claim that the HIPAA federal privacy law protects individuals from being asked about their vaccination status.

On May 18, several GOP members refused to wear masks on the House floor in defiance of House rules on mask-wearing, including Greene. When asked whether she was vaccinated, Greene told reporters that asking about her vaccine status was a HIPAA violation.

Greene is not the only one spreading this claim, which has spread widely on social media in recent days.

“The rule is simple, HIPAA protects EVERY American from disclosing ANY of their health records to ANYONE,” claims an image posted on Instagram May 13.

The poster clarified she was referring to vaccine and mask requirements in her caption.

“If anyone asks for your vax status, tell them they have no right to know,” she wrote. “This is authoritarianism by the way. Literally communistic.”

Fact check: CDC's new guidance for fully vaccinated people is not 'out of the blue'

Other examples of social media posts with the claim can be seen on Instagram and Facebook.

The Health Insurance Portability and Accountability Act, or HIPAA, is a law that prevents health care professionals from sharing private health information without the patient's permission.

But experts agree the interpretation of HIPAA cited by Greene and others online is inaccurate. The law has no bearing on who can ask or answer questions about health status outside a health care setting, they say.

USA TODAY contacted several accounts that posted the claim.

Experts say HIPAA does not cover vaccination questions

USA TODAY debunked a similar version of this claim last summer, when mask opponents encouraged others to claim HIPAA allowed them to avoid mask mandates.

Alan Meisel, a professor of law and bioethics at the University of Pittsburgh, told USA TODAY at the time that HIPAA’s rules apply only to sharing information between "covered entities." The U.S. Department of Health and Human Services describes covered entities as “health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically.”

Meisel said the claim that HIPAA protected people from being asked about their vaccine status is “utter nonsense.”

Fact check: COVID-19 vaccines won't make the common cold or flu 'extremely lethal'

“It in no way prohibits business owners and other individuals from asking people if they have been vaccinated,” he wrote in an email to USA TODAY. “In fact, it doesn’t even prohibit healthcare entities mentioned above from asking people if they have been vaccinated.”

Georgetown University law professor Lawrence Gostin agreed, saying, "Non-health care businesses are not subject to HIPAA."

While businesses and individuals maintain the right to ask others for vaccination status, that does not mean anyone has to provide that information.

According to Gostin, when a business asks an employee or customer for their vaccination status, that "individual then has a choice whether to provide proof of vaccination. If the person does not, then he or she can be excluded from entering the premises."

Fact check: COVID-19 vaccines don't cause magnetic reactions or contain tracking devices

In short, HIPAA doesn't have any effect outside a health care setting.

Our rating: False

We rate the claim that HIPAA prohibits businesses and individuals from asking for others' vaccination status FALSE, because it is not supported by our research. Experts agree HIPAA applies only to health care entities sharing information. Health care entities can ask people for their vaccination status. Businesses can ask patrons and employees whether they have been vaccinated. And people can then choose whether they want to answer or forego that service.

Our fact-check sources:

Thank you for supporting our journalism. You can subscribe to our print edition, ad-free app or electronic newspaper replica here.

Our fact check work is supported in part by a grant from Facebook.

This article originally appeared on USA TODAY: Fact check: Asking about vaccinations doesn't violate HIPAA