While a hippo may prevent your employer or other businesses from asking you about your Covid-19 vaccination status, HIPAA won’t. After all, a hippo stampede can be really, really disruptive, but HIPAA, when it is short for the Health Insurance Portability and Accountability Act of 1996, doesn’t cover such things.
Nevertheless, this hasn’t prevented various people and perhaps bots from claiming that questions about whether you’ve received the Covid-19 vaccine are violations of HIPAA. For example, here’s what POLITICO reporter Nicholas Wu tweeted about Representative Marjorie Taylor Greene (R-Georgia):
Indeed, when Forbes asked Nick Dyer, Greene’s spokesperson, whether Greene has been vaccinated, Dyer responded, “She considers this a HIPAA violation, and quite frankly it’s none of the media’s business,” as Andrew Solender wrote.
Greene can consider it a HIPAA violation all she wants, but that won’t make it a HIPAA violation. It would not be a violation of HIPPA either, whatever HIPAA may be:
Nor would it be a violation of HIPSTERS, HIP-HIP-HOORAY, or HIP2BSQUARE.
Throughout a good part of the pandemic, people have been name-dropping HIPAA, HIPPA, and similar terms. For example, there’s been the citing of HIPAA when trying to get around face mask mandates, as the following tweet from last year showed:
It is not a HIPAA violation to be asked to wear a face mask. It isn’t a HIPAA violation either when you are asked specify what medical conditions are preventing you from wearing a face mask when you refuse to wear one.
The question is how many people who are using HIPAA to not comply with Covid-19 precautions actually understand what HIPAA is and what it covers:
HIPAA isn’t like cheese. You can’t just throw it on any situation and expect it to be better for you:
HIPAA is not a get out of answering a question free card. For example, the following probably wouldn’t fly with your significant other: “I didn’t say ‘I love you’ back because of HIPAA.” And don’t try the following on a date: “I didn’t tell you that I was married because of, you know, HIPAA.” Similarly, don’t expect HIPAA to rescue you after a job interview in such a manner: “when I said that I went to college, I didn’t clarify that it meant ‘went to a college one day to use the bathroom’ due to HIPAA.”
No, HIPAA is a very specific federal law that went into effect in 1996. As a Centers for Disease Control and Prevention (CDC) describes, the law “required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge.” What’s considered sensitive patient health information or protected health information (PHI)? Well, whether you have been vaccinated against Covid-19 would indeed fall under the category of PHI when it is combined with info that helps identify who you are like your name and social security number.
But (and this is a big but and I cannot lie), HIPAA does not protect such PHI everywhere and under every circumstance. According to the U.S. Department of Health and Human Services (HHS), the HIPAA Privacy Rule “applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically.” Note that this did not say “applies to everyone.” Notice the words “health care” before each of the entities listed. These so-called covered entities, the people and organizations covered by this HIPAA Privacy Rule, are all within health care settings. They include anyone who is taking care of your medical needs, paying for your medical care, or handling your medical information for the purposes of medical care, billing, or some other health care related purpose. Therefore, your doctor, nurse, or insurance company cannot tell others whether you have been vaccinated without your consent.
Once you get out of the health care setting, HIPAA might as well be Kelly Ripa. It doesn’t really apply. A HHS web site says that “many organizations that have health information about you do not have to follow these laws” and gives examples like life insurers, employers, workers compensation carriers, most schools and school districts, many state agencies like child protective service agencies, most law enforcement agencies, and many municipal offices. So, the HIPAA Privacy Rule would not apply to your employer, your school, or your local bar, for that matter, unless the bartender happens to be removing your gallbladder. Therefore, someone outside of healthcare settings like your employer or your school can ask you or your doctor for proof of vaccination without worrying about violating HIPAA.
Ultimately, you can say HIPAA or even HIPPA all you want, but it’s not going to keep people from asking you whether you got the Covid-19 vaccine. You might as well as mention space lasers, cicadas, or the Jolly Green Giant because such things have about the same applicability. If you don’t want to answer questions about your vaccination status, you are going to have to say that you refuse to answer. Or alternatively, you could actually answer the question.