On September 30, 2021, the Department of Health and Human Services (HHS) issued FAQs addressing how the HIPAA Privacy Rule applies to individuals’ disclosures of their COVID-19 vaccination status in the workplace and health care contexts. Generally, HIPAA does not prohibit individuals from disclosing their vaccination status or employers from requesting an employee’s vaccination status. HIPAA Privacy Rule protections only apply in the context of covered entities (e.g., health care providers, health plans and health care clearinghouses) and their business associates. The HIPAA Privacy Rule would prevent a doctor’s office from disclosing a patient’s vaccination status without an authorization unless a specific HIPAA disclosure exemption applied.

On October 4, 2021, the federal departments of Health and Human Services, Labor and Treasury released FAQs providing guidance on whether group health plans may offer premium discounts (or surcharges) as incentives to encourage individuals to get COVID-19 vaccines and whether plans and issuers may condition eligibility for benefits or coverage on an individual’s vaccination status. The FAQs largely confirmed the detailed discussion of a prior Fast Laner that any vaccine incentive tied to the group health plan will be considered a health contingent activity-only wellness program under HIPAA and require a reasonable alternative standard if receiving the vaccine is medically inadvisable or unreasonably difficult. This also means that any incentive must be within the 30% incentive limit for health contingent programs. The FAQs also confirmed that a group health plan cannot condition eligibility for coverage or limit covered services based on vaccination status as it is considered a “health factor” under HIPAA. Lastly, the FAQs confirmed that any ACA affordability calculations cannot consider or include vaccine incentives.