Former NFL quarterback Peyton Manning once dodged a reporter’s question about his neck injury with a HIPAA quip.

“I don’t know what HIPAA stands for, but I believe in it and I practice it,” Manning said in 2011.

Privacy rules associated with the Health Insurance Portability and Accountability Act are at the top of mind 10 years later in the workplace. Employers are in a state of flux in the COVID-19 pandemic, trying to enforce vaccine mandates in the workplace and wondering whether it’s legal to ask employees if they’re vaccinated.

“Peyton’s HIPAA quote is one of my favorites, and it’s tangentially useful for the time we are in, because by the looks of social media and things you hear from people, no one really understands what HIPAA does,” said Greg Frost, health care and HIPAA attorney for Breazeale, Sachse & Wilson. “As it applies to the frequently asked question around COVID, HIPAA does not apply in most instances when employees are asked by their employers if they received the vaccine, and employers can also ask for evidence of vaccination. HIPAA does not prevent employers and businesses from asking employees, visitors and customers about their vaccine status.”

On Sept. 30, the U.S. Department of Health and Human Services’ Office of Civil Rights issued guidance and clarity for HIPAA. The OCR reminded organizations that if HIPAA does apply, it regulates the use and disclosure of protected health information and not the ability to request information from employees, said Kathy Conklin, McGlinchey Stafford attorney on employment law compliance and employee benefits matters.

“The guidance reminds everyone that the HIPAA Privacy Rule only regulates the usage of protected health information by covered entities and their business associates, and only health care providers, health care clearing houses, and health plans are covered entities,” Conklin said. “Those entities cannot provide vaccination information to third parties who are not covered entities without an appropriate HIPAA authorization or as otherwise permitted under HIPAA. However, employers or businesses interacting with their customers or visitors are not covered entities and are not restricted by the HIPAA Privacy Rule.”

The guidance posed a number of common questions, all of which are answered in the negative:

  • “Does the HIPAA Privacy Rule prohibit businesses or individuals from asking whether their customers or clients have received a COVID-19 vaccine?” No.
  • “Does the HIPAA Privacy Rule prevent customers or clients of a business from disclosing whether they have received a COVID-19 vaccine?” No.
  • “Does the HIPAA Privacy Rule prohibit an employer from requiring a workforce member to disclose whether they have received a COVID-19 vaccine to the employer, clients, or other parties?” No.

Conklin added that the OCR guidance clarifies that even covered entities can request COVID-19 information from their workforce members when the covered entities, such as hospitals, are acting in their capacities as employers. Covered entities can require their workforce members to provide proof of vaccination, sign a HIPAA authorization about vaccination status, wear a mask or reply to inquiries from patients about vaccination status.

OSHA Suspends Enforcement of Mandate Order Amid Litigation

On Nov. 17, the U.S. Department of Labor’s Occupational Safety and Health Administration suspended enforcement of the Biden administration’s vaccine mandate for private employers of 100 or more employees. The decision came after 27 states, including Louisiana, sued to block the order, and the U.S. Fifth Circuit Court of Appeals issued a stay. The cases have been consolidated into the Sixth Circuit Court of Appeals in Cincinnati. While these judicial procedures play out, employers are left in limbo.

If the ETS were to go into effect, employers would choose from two options: mandating vaccination for all workers (with limited exceptions); or requiring workers either to vaccinate or if unvaccinated or partially vaccinated, to test weekly and wear a mask in the workplace (with limited exceptions). Before the OSHA suspension, employers were given two deadlines: distribution of a written policy on or before Dec. 6, and employees must comply with the vaccination requirement by Jan. 4, 2022.

Given that short time frame, if employers have not done so already, it’s time to start preparing, says Sarah Voorhies Myers, Chaffe McCall attorney in labor and employment law.

“We are always trying to read the tea leaves of when and where things will land amidst the OSHA order and federal lawsuits challenging the order, and it’s impossible to know. But in the meantime, employers need to start getting prepared in case the OSHA mandate gets implemented,” Myers said. “You have a right to ask your employees their vaccination status, and employers should have a secure process in place where survey results are confidential. If the OSHA order goes into effect, employers will be required to maintain proof of their employees’ vaccination status.”

Employers must keep vaccination records private, as with all other medical documentation of employees. Myers advises employers to designate a member of management whom employees can provide proof of vaccination, as well as forms employees can sign to attest to that the information is accurate. This proof can be shown in person or through a secure online portal that requires electronic certification and submission of vaccine records, a recommendation for larger companies that may not have in-person capability.

Employers also should decide now which of the two OSHA options they will elect and have a draft policy ready to go if the ETS is implemented. Where the rubber meets the road, Myers says, is the testing cost responsibility if businesses choose the testing option under the OSHA order.

“The first impression is in Louisiana, under our state specific law, employers would have to pay the costs of testing their employees, and that factor may influence their decision on the two options,” Myers said.

Misconceptions Around Medically or Religiously Exempt

The phrases “medically exempt” and “religiously exempt” have been frequently echoed by employees, and businesses need the proper forms and processes ready when employees ask for medical or religious exemptions from being vaccinated.

“One of the biggest misconceptions is the misunderstandings around religious and medical exemptions. You can’t just raise your hand and say, ‘I’m not taking the vaccine because I’m medically or religiously exempt’; your health concern has to be tied to the concern about getting vaccinated, and then you need to get proof from your medical provider,” said Casey Denson, employment attorney with Casey Denson Law. “Employees need to be careful in their understanding of just how specific their rights are, or they may act in ways that set them up for failure or possible termination.”

Under the ETS, vaccination policies must allow for exceptions for employees for whom a vaccine is medically contraindicated and in which medical necessity requires a delay in vaccination. Employees are also entitled to a reasonable accommodation under federal civil rights laws because they have a disability or sincerely-held religious beliefs, practices or observances that conflict with the vaccination requirement.

“The religious belief exemption can get tricky, because you should normally assume that an employee’s request for religious accommodation is based on a sincerely-held religious belief and it’s hard to object to that belief. You can request additional supporting information from that employee in case of an objection,” Denson said. “In many cases, employers take the belief at face value and provide reasonable accommodations such as working remotely, mask enforcement or testing weekly, if he/she is required to work onsite.”

The EEOC advises that employees’ sincerely-held religious beliefs should generally be taken at face value, although limited inquiry is allowed in order to allow the employer to better understand the specific request, and employers do not have to accommodate secular beliefs, such as social, political, economic or personal preferences. Denson points out that if an employer does not have at least 15 employees, or accept federal funds, then neither Louisiana state law or federal law (Title VII, Section 504 of the Rehabilitation Act or ADA) would require an accommodation for religion or disability.

“It’s an oft overlooked issue that employees of very small businesses fall through the cracks here in Louisiana,” Denson said.

In the last two years, Denson has been flooded with calls and e-mails from people from various industries, mostly education, hospitality, and health care, asking whether companies can require employees to get the vaccine. Louisiana is an at-will state, so employers can, in fact, mandate and lay off employees who do not comply, unless they are protected by federal or state law.

“At the end of the day, for employers, they need to take the proper steps to create a safe workplace and environment; and for employees, they need to consider, given those requirements, can they still do their jobs under those applied rules and regulations, or is it necessary to look elsewhere for employment under conditions they would find acceptable?”