Do Vaccine Passports Violate HIPAA? Let's Discuss.

Learn more about The Health Insurance Portability and Accountability Act of 1996 (HIPAA)  and how it protects sensitive health information from being disclosed without the patient’s consent or knowledge. Plus, we go through a complete break down on Vaccine Passports in the US, the good and the bad, all while trying to answer the question that is on everybody's mind: Do vaccine passports violate HIPAA? Or do they not?  

Understanding Vaccine Passports & HIPAA

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. The US Department of Health and Human Services (HHS) issued the HIPAA Privacy Rule to implement the requirements of HIPAA. The HIPAA Security Rule protects a subset of information covered by the Privacy Rule.

The Privacy Rule standards address the use and disclosure of patients health information (protected health information) by covered entities subject to the Privacy Rule. Furthermore, it also contains standards for patients rights to understand and control how their health information is used. There are four kinds of covered entities:

  • Healthcare Providers
  • Health Plans
  • Health Clearinghouses
  • Business Associates

Covered entities are allowed to use and disclose protected health information, without the patient's authorisation, exclusively for one of the following reasons:

  • Disclosure to the individual.
  • Treatment, payment, and healthcare operations.
  • Opportunity to agree or object to the disclosure of PHI.
  • Incident to an otherwise permitted use and disclosure.
  • Public interest and benefit activities.

That being said, do vaccine passports violate HIPAA? Or do they not?

According to several reports recently published gathering expert opinions from sources dedicted to compliance within the healthcare sector, including one by The Washington Post, although HIPAA is used to protect sensitive medical information, it only applies to how physicians, hospitals and health insurers share a patient's information with third-party entities. Meaning, vaccine passports qualify as protected health information, but an airline, for example, is not a healthcare provider. Of course, an airline is obliged to follow state privacy and identity theft policies but it isn't affected by HIPAA. Therefore, it can be concluded that vaccine passports, although they can be considered as a violation of privacy, do not precisely violate HIPAA regulations.

A couple weeks ago, Anthony Fauci, MD, director of the National Institute of Allergy and Infectious Diseases, went on Politico's 'Dispatch' Podcast and said that the federal government will not mandate COVID-19 vaccine passports for businesses or events. Dr. Fauci said COVID-19 passports are being developed by private companies and businesses will decide whether they adopt them with little involvement from the federal government.

It is only logical that, just like public opinion, state policies are equally polarised. New York became the first state to launch a COVID-19 vaccine passport on March 26, and the state now uses IBM's passport for events and other large gatherings. A week later, on April 2, Florida Gov. Ron DeSantis signed an executive order prohibiting the use of COVID-19 vaccine passports in the state, banning any government entity from issuing vaccine passports and preventing businesses from requiring any such documentation of consumers.

Either in agreement or disagreement with this analysis, in favor or against the passports in question, it seems like they are here to stay, bringing with them positive aspects and raising valid concerns.

Some positive aspects of vaccine passports include:

  • They allow holders to return to normality or at least a new normality.
  • This return to normality, for those holding the passport in question, potentially encourages hesitant people to take the shot, increasing the number of inoculated people.

Some concerns regarding vaccine passports include:

  • Privacy: Allowing businesses to access people’s healthcare information can be considered a violation of privacy.
  • Fakes: Many counterfeit COVID-19 passports are being sold online by anonymous traders.
  • Discrimination: Communities or individuals who haven’t had the chance to get a shot, or are simply more skeptical about taking the vaccine at all, would be treated unequally.
  • False Safety: It can create a false sense of safety as the number of mutations rapidly increases and it is unclear if all vaccines will be effective against all future mutations of the virus. Furthermore, research still needs to be made as it is unknown whether vaccinated people can contract an asymptomatic case of COVID-19.

Learn more about Alyne's Content Library and the comprehensive mapping of The Health Insurance and Accountability Management Act (HIPAA), covering not only section 164.3xx (Security Standards), but also the rules outlined in section 164.4xx (Breach Notification) and section 164.5xx (Privacy Aspects).

Learn more about Alyne’s RegTech capabilities in the healthcare industry in this episode of our podcast: The RegTech Report.

Javier Gutierrez

Related Posts

The Path to Building Better Business Practice in Compliance with UK SOX

Press archives over the past decade have demonstrated that many Public Limited Companies in the United Kingdom have either collapsed or made the headlines due to accounting irregularities or some other form of lack of internal control to ensure financial statements are reliable. This article explores the need for UK businesses to anticipate wide-scale adoption of SOX, as they progress down the path to building better businesses.

The Importance of Diversity & Inclusivity in the Workplace

At Alyne we strongly believe in diversity and inclusivity, as they foster creativity and highlight new perspectives in the workplace; translating into innovative ideas that ultimately benefit the organisation. In the last couple of weeks, many countries and companies across the globe have been celebrating and supporting LGBTQ+ Pride bringing awareness to all that has been accomplished in terms of equality, identity and inclusion, and all that is yet to be done. In this article, we analyse the importance of representation in the workplace and we take you through our rebranding decision for the months of June and July.

Automating Risk Assessments with Alyne

At Alyne, we are focused on providing cyber, compliance and risk professionals, as well as their clients, with next generation technology, expert knowledge and actionable risk insights, powered by Artificial Intelligence, to seamlessly identify, qualify and quantify their risks. Learn how Alyne’s solution will transform your risk assessment process and generate operational efficiencies, while providing your clients with an optimised, personalised and positive digital experience.