Can Employers Use Health Records to Verify COVID-19 Vaccination?

• Find out if HIPPA considers vaccination information PHI (protected health information).
• Learn the best way to verify COVID-19 vaccinations.
• Discover which government entity to turn to for laws concerning other COVID-19 matters arising in the workplace.

Many employers have asked employees to submit proof of a COVID-19 vaccination before returning to work in an office or other facility. According to the U.S. Equal Employment Opportunity Commission (EEOC), you may do so if you allow exceptions for people with disabilities and those with sincerely held religious beliefs. The requirement also must comply with other applicable laws.

As an additional layer of protection, some employers may consider asking their HR departments to confirm employees’ eligibility to return to work by checking COVID-19 vaccination claims submitted to their group health plans. Is such a step allowable? Fiducial has the answer and other information you need to know below!

PHI and COVID-19 vaccination verification

An employer’s group health plan is considered a “covered entity” under the Health Insurance Portability and Accountability Act (HIPAA). This means it’s a separate legal entity from the employer.

HIPAA applies to protected health information (PHI) created, maintained, received or transmitted by a group health plan. Because most plans must cover COVID-19 vaccinations as preventive services, they’re likely to have information about each employee’s receipt of a COVID-19 vaccination. HIPPA classifies this information as PHI.

PHI cannot be disclosed to a group health plan’s sponsor unless the privacy rule’s prerequisites for such disclosures have been met. Generally, employers may disclose PHI only to employees performing administration functions for the plan. Employer’s must establish a firewall between employees performing plan administration functions and other employees. This prevents the use or disclosure of PHI for employment-related purposes without the plan participant’s authorization.

Confirming an employee’s eligibility to return to work at a physical location is an employment-related function. It is not a plan administration function. So, a group health plan may not disclose COVID-19 (or any) vaccination-related PHI to an HR department unless the employees themselves authorize the disclosure. And employees (or other plan participants) are not required to sign authorizations allowing the employer to receive PHI from the group health plan as a condition of receiving group health plan benefits.

Interacting directly

Rather than obtaining and retaining each employee’s authorization, take a better approach to verifying employees’ vaccination statuses. Instead, have them provide proof of vaccination directly to the HR department. They do so using the COVID-19 vaccination record card approved by the Centers for Disease Control and Prevention. This direct interaction between the employee and HR doesn’t involve the group health plan, so employers can avoid violating the HIPAA privacy rule.

Other laws may apply when requiring employees to submit proof of vaccination. You may also need to address other COVID-19 matters arising in the workplace. The EEOC has provided extensive guidance on COVID-19 issues under the Americans With Disabilities Act and other employment laws. We must consider these laws separately from HIPAA as they may impose requirements — even in situations where HIPAA doesn’t apply.

Grappling with the pandemic

In conclusion, employers generally shouldn’t use their group health plan’s records to verify employees’ COVID-19 vaccination statuses for any employment-related purpose. As your organization continues to grapple with the questions and challenges raised by the pandemic, work closely with a qualified employment attorney to determine the best course of action.

Need further information? Call Fiducial at 1-866-FIDUCIAL or make an appointment at one of our office locations to discuss your situation.

Ready to book an appointment now? Click here. Know someone who might need our services? We love referrals!

For more small business COVID-19 resources, visit Fiducial’s Coronavirus Update Center to find information on SBA loans, tax updates, the Paycheck Protection Program, paid sick and family leave, and more.