December 2, 2021

Volume XI, Number 336

Advertisement
Advertisement

December 02, 2021

Subscribe to Latest Legal News and Analysis

December 01, 2021

Subscribe to Latest Legal News and Analysis

November 30, 2021

Subscribe to Latest Legal News and Analysis

November 29, 2021

Subscribe to Latest Legal News and Analysis

New HIPAA Guidance from OCR on COVID-19 Vaccines and the Workplace

The U.S. Department of Health and Human Services Office for Civil Rights (“OCR”) issued guidance regarding the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) privacy rule (the “Privacy Rule”) in the form of Q&A to assist covered entities in determining when it is appropriate to release or request protected health information (“PHI”) related to an individual’s COVID-19 vaccination status.

Specifically, OCR provided certain examples of instances in which a covered entity may permissibly disclose PHI, including, without limitation, the following:

  • A physician or health plan disclosure related to an individual’s vaccination status when required to do so by law.

  • A pharmacy disclosure related to an individual’s vaccination status to a public health authority (state or local public health agency).

  • A hospital disclosure related to an individual’s vaccination status to the individual’s employer so that an evaluation may be conducted relating to medical surveillance in the workplace if certain conditions are met.

Unless an exception applies, the Privacy Rule otherwise prohibits a covered entity from disclosing PHI. Accordingly, in instances in which an exception does not apply, a covered entity disclosure of PHI, including, without limitation, the vaccination status of an individual to a third party (e.g., sports arena, hotel, resort, cruise ship or airline) would require a valid HIPAA authorization or court order.

The OCR also confirmed that the Privacy Rule generally does not apply to a covered entity or business associate in their capacity as employers, which is consistent with the regulations and prior pronouncements. Therefore, according to the OCR, a covered entity or business associate is permitted to require or request its workforce members to:

  • Provide documentation of vaccination status.

  • Sign a HIPAA authorization to disclose an individual’s vaccine record to their employer.

  • Wear a mask.

  • Disclose to patients or future patients an employee’s vaccination status.

© Steptoe & Johnson PLLC. All Rights Reserved.National Law Review, Volume XI, Number 281
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

Kristen Wilson Steptoe Johnson Law Firm Wheeling, WV Professional Liability Litigation Attorney
Member

Clients know that Kristen Andrews Wilson will help them understand and navigate the complex and complicated healthcare landscape.  Kristen’s clients include hospitals, nursing homes, and long-term care facilities, as well as independent healthcare providers.  Kristen’s practice is a unique combination of litigation avoidance via counseling and defense via litigation, when necessary.  In addition to her medical malpractice litigation practice, Kristen has experience with federal and state healthcare regulatory compliance, as well as business transactions involving...

304-231-0444
Charles A. Sinsel, Steptoe Johnson, Corporate Transactions Lawyer, Employment recruitment Attorney
Member

Charles "Chark" Sinsel concentrates his practice in the areas of health care, corporate law, business transactions, and contracting. Mr. Sinsel represents health care entities, including hospitals, nursing homes, behavioral health providers, medical and dental practices, in a variety of transactions, including acquisitions, corporate restructuring, leasing, employment, recruitment, income guarantees, independent contractor (services) arrangements and group purchasing arrangements. Mr. Sinsel serves as leader of the Firm's Health Care Team.

 

304-933-8148
Advertisement
Advertisement
Advertisement