Does HIPAA's Privacy Rule Apply to Vaccine Questions?

You may have heard public figures respond to questions about COVID-19 vaccines by citing the HIPAA privacy rule.

The Health Insurance Portability and Accountability Act, or HIPAA, was established in 1996 - making it illegal for health care providers, plans and clearinghouses to disclose patient information to an unauthorized person.

“I think it's kind of become a shorthand for medical privacy,” said Loren Jacobson, who teaches health care law at the UNT Dallas College of Law.

Jacobson explains HIPAA also gives patients the right to access their records and request corrections, but HIPAA doesn’t apply to employers, businesses or curious people asking about your COVID-19 vaccine status. The U.S. Department of Health and Human Services recently published this guidance about the HIPAA privacy rule and COVID-19 vaccine questions.

“It’s fine to say, I don't want to share my personal health information with the public or that's none of your business, but it's not HIPAA,” explains Jacobson.

“I don't think you have to stand behind the statute to be able to say, I don't feel comfortable sharing my health information with the public. I think that's a valid position, but it's not because of HIPAA,” added Jacobson.

The state’s vaccine registry: what it does and doesn’t do

When it comes to your COVID-19 vaccination records, the state maintains a registry called ImmTrac2.

It was established as an opt-in system to track childhood immunizations.

“It's so you don't have to keep up with the paper shot record that we had when I was a kid,” said Chris Van Deusen with the Texas Department of State Health Services.

Van Deusen explains during this public health emergency, vaccine providers enter COVID-19 vaccine information for adults into the registry – where the information is stored for five years.

“Just so we can keep tabs on the numbers, look at how many Texans are vaccinated, how many doses are administered,” said Van Deusen.

However, Van Deusen said the registry can’t be used as a vaccine passport to confirm someone’s vaccine status.

“It's not a situation where an employer could go in or a restaurant or a concert venue could verify,” explained Van Deusen. “It is for your health care provider to be able to get in and use.”

Your provider, if they’re registered with ImmTrac2, could access that information for the patient. If, for example, you lost your paper vaccination card, your doctor may be able to get your COVID-19 vaccination record for you.

It’s also possible to request your record directly from the immunization registry by emailing ImmTrac2@dshs.texas.gov or sending your request by fax to 512-776-7790.

NBC 5 Responds is committed to researching your concerns and recovering your money. Our goal is to get you answers and, if possible, solutions and a resolution. Call us at 844-5RESPND (844-573-7763) or fill out our customer complaint form.