Is it a HIPAA violation if businesses request proof of COVID vaccine? What experts say

In light of the CDC's guidance saying fully vaccinated people can stop wearing masks outdoors in crowds and in most indoor settings, some businesses are lifting face mask requirements for customers who are vaccinated against COVID-19, raising questions about medical privacy.

Since 1996, part of the Health Insurance Portability and Accountability Act (HIPAA) has required that some patients' health information be protected.

But many legal experts say non-health-care businesses don't violate HIPAA if they ask for proof of a COVID-19 vaccine, multiple news outlets reported. Here's what to know about the law and what to expect at stores.

What does HIPAA say?

For starters, HIPAA's privacy rule is designed "to assure that individuals' health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public's health and well being," the U.S. Department of Health and Human Services said on its website. The rule applies to people in medical-related fields, including insurance and medical providers.

Kayte Spector-Bagdady, a medical ethics researcher at the University of Michigan, said HIPAA is often misunderstood because it doesn't protect personal health information in every situation.

"HIPAA only governs certain kinds of entities — your clinician, hospital, or others in the health care sphere," Spector-Bagdady said on the university's website in April. "It does not apply to the average person or to a business outside health care. It doesn't give someone personal protection against ever having to disclose their health information."

While vaccine cards would normally be protected information, many businesses don't operate under HIPAA laws, KHQ-TV reported. So that means stores, schools and travel providers may have the legal right to ask if you've been vaccinated before helping you, according to experts.

"Because the average business is not a covered entity or a business associate of a covered entity within the meaning of HIPAA, the statute does not prohibit them asking them about vaccination status," Glenn Cohen, a Harvard Law School professor, told TEGNA.

Dr. Dean Sidelinger, health officer and epidemiologist for the Oregon Public Health Division, also weighed in when he said people in his state would be required to wear masks inside stores unless they share whether they've been vaccinated, The Oregonian reported Friday.

"That is not a violation of HIPAA or privacy since they're voluntarily disclosing that information," he said, according to the newspaper.

But not everyone sees such a clear-cut situation. Carmen Roe, a legal analyst for KHOU, said she thinks it will be up to the courts to determine whether businesses can ask for vaccine cards before allowing people to take off their masks.

"I think it runs a very serious risk of interfering with federal privacy laws that are on the books, that are there that have never been tested in the way these vaccinations are testing them," Roe told the TV station. "Once we get a test case, I think things are not going to go well for any business who tries to force someone to produce that information before they enter."

What are businesses doing?

Recently, some major retailers have announced they are relaxing coronavirus-related restrictions for vaccinated shoppers.

As of Monday, the growing list of places no longer requiring face coverings for people who have gotten their shots included Costco, Target, Trader Joe's and Walmart, McClatchy News reported. Other companies haven't lifted mask rules but said they are reviewing guidance from the Centers for Disease Control and Prevention.

The announcements come after federal health officials on Thursday shared recommendations that said people who are fully vaccinated against the coronavirus "can participate in indoor and outdoor activities, large or small, without wearing a mask or physical distancing." Experts say you are fully vaccinated two weeks after you've gotten your single-shot dose or the second shot of the Pfizer or Moderna vaccines.