Fixing some common misconceptions about HIPAA

Ever since the CDC amended its COVID-19 guidance to say that the fully vaccinated no longer need to wear masks indoors, I’ve read myriad variations of this tweet:

Friendly reminder that under HIPPA, your vaccination status is private.

Or this tweet:

The rule is simple, HIPAA protects EVERY American from disclosing ANY of their health records to ANYONE.

Their point? That medical privacy laws protect their vaccination status, and it’s illegal for any business to ask as a condition of anything.

They are very, very wrong. So, I thought today I’d clear up some common misconceptions about HIPAA specifically and medical privacy more generally.

1. HIPAA stands for the Health Insurance Portability and Accountability Act. It’s HIPAA. Not HIPPA, HIPPO, or anything else.
2. Broadly speaking, HIPAA does protect the privacy of individuals’ medical information. But not all medical information and only in certain circumstances.

• Prohibit an employer from asking for a doctor’s note related to an absence (or, in the case of COVID-19, an employee’s vaccination status).
• Impact the ability to request information necessary to administer programs, such as health care benefits, workers’ comp, or sick leave.
• Protect all health data maintained in employment records, only those employees’ medical and health plan records that relate to their participation as a member of the employer’s healthcare plan.