Are businesses violating HIPAA if they ask their patrons if they’ve been vaccinated? No.

As business rework their mask requirements such as lifting face mask requirements for customers who are vaccinated against COVID-19, questions about medical privacy are back in the spotlight. The question of whether it’s okay to ask a maskless patron if they’ve been vaccinated has come into focus. Vaccine opponents, including members of the U.S. Congress, are once again claiming that the HIPAA federal privacy law protects individuals from being asked about their vaccination status. We find this claim to be false.

Who Has a Right to Ask if You’re Vaccinated?

COVID-19 vaccination has become a lightning rod for controversy over “vaccine passports” and claims of violations of medical privacy or individual rights. But as two experts explain, there’s a long history of efforts to protect the health of others by requiring individuals to provide proof of vaccination or of a past infection, or seek a medical or religious exception.