Do Vaccine Passports Violate HIPAA? Let's Discuss.

Learn more about The Health Insurance Portability and Accountability Act of 1996 (HIPAA)  and how it protects sensitive health information from being disclosed without the patient’s consent or knowledge. Plus, we go through a complete break down on Vaccine Passports in the US, the good and the bad, all while trying to answer the question that is on everybody's mind: Do vaccine passports violate HIPAA? Or do they not?  

Understanding Vaccine Passports & HIPAA

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. The US Department of Health and Human Services (HHS) issued the HIPAA Privacy Rule to implement the requirements of HIPAA. The HIPAA Security Rule protects a subset of information covered by the Privacy Rule.

The Privacy Rule standards address the use and disclosure of patients health information (protected health information) by covered entities subject to the Privacy Rule. Furthermore, it also contains standards for patients rights to understand and control how their health information is used. There are four kinds of covered entities:

  • Healthcare Providers
  • Health Plans
  • Health Clearinghouses
  • Business Associates

Covered entities are allowed to use and disclose protected health information, without the patient's authorisation, exclusively for one of the following reasons:

  • Disclosure to the individual.
  • Treatment, payment, and healthcare operations.
  • Opportunity to agree or object to the disclosure of PHI.
  • Incident to an otherwise permitted use and disclosure.
  • Public interest and benefit activities.

That being said, do vaccine passports violate HIPAA? Or do they not?

According to several reports recently published gathering expert opinions from sources dedicted to compliance within the healthcare sector, including one by The Washington Post, although HIPAA is used to protect sensitive medical information, it only applies to how physicians, hospitals and health insurers share a patient's information with third-party entities. Meaning, vaccine passports qualify as protected health information, but an airline, for example, is not a healthcare provider. Of course, an airline is obliged to follow state privacy and identity theft policies but it isn't affected by HIPAA. Therefore, it can be concluded that vaccine passports, although they can be considered as a violation of privacy, do not precisely violate HIPAA regulations.

A couple weeks ago, Anthony Fauci, MD, director of the National Institute of Allergy and Infectious Diseases, went on Politico's 'Dispatch' Podcast and said that the federal government will not mandate COVID-19 vaccine passports for businesses or events. Dr. Fauci said COVID-19 passports are being developed by private companies and businesses will decide whether they adopt them with little involvement from the federal government.

It is only logical that, just like public opinion, state policies are equally polarised. New York became the first state to launch a COVID-19 vaccine passport on March 26, and the state now uses IBM's passport for events and other large gatherings. A week later, on April 2, Florida Gov. Ron DeSantis signed an executive order prohibiting the use of COVID-19 vaccine passports in the state, banning any government entity from issuing vaccine passports and preventing businesses from requiring any such documentation of consumers.

Either in agreement or disagreement with this analysis, in favor or against the passports in question, it seems like they are here to stay, bringing with them positive aspects and raising valid concerns.

Some positive aspects of vaccine passports include:

  • They allow holders to return to normality or at least a new normality.
  • This return to normality, for those holding the passport in question, potentially encourages hesitant people to take the shot, increasing the number of inoculated people.

Some concerns regarding vaccine passports include:

  • Privacy: Allowing businesses to access people’s healthcare information can be considered a violation of privacy.
  • Fakes: Many counterfeit COVID-19 passports are being sold online by anonymous traders.
  • Discrimination: Communities or individuals who haven’t had the chance to get a shot, or are simply more skeptical about taking the vaccine at all, would be treated unequally.
  • False Safety: It can create a false sense of safety as the number of mutations rapidly increases and it is unclear if all vaccines will be effective against all future mutations of the virus. Furthermore, research still needs to be made as it is unknown whether vaccinated people can contract an asymptomatic case of COVID-19.

Learn more about Alyne's Content Library and the comprehensive mapping of The Health Insurance and Accountability Management Act (HIPAA), covering not only section 164.3xx (Security Standards), but also the rules outlined in section 164.4xx (Breach Notification) and section 164.5xx (Privacy Aspects).

Learn more about Alyne’s RegTech capabilities in the healthcare industry in this episode of our podcast: The RegTech Report.

Javier Gutierrez

Related Posts

The Importance of Diversity & Inclusivity in the Workplace

At Alyne we strongly believe in diversity and inclusivity, as they foster creativity and highlight new perspectives in the workplace; translating into innovative ideas that ultimately benefit the organisation. In the last couple of weeks, many countries and companies across the globe have been celebrating and supporting LGBTQ+ Pride bringing awareness to all that has been accomplished in terms of equality, identity and inclusion, and all that is yet to be done. In this article, we analyse the importance of representation in the workplace and we take you through our rebranding decision for the months of June and July.
Read more

Automating Risk Assessments with Alyne

At Alyne, we are focused on providing cyber, compliance and risk professionals, as well as their clients, with next generation technology, expert knowledge and actionable risk insights, powered by Artificial Intelligence, to seamlessly identify, qualify and quantify their risks. Learn how Alyne’s solution will transform your risk assessment process and generate operational efficiencies, while providing your clients with an optimised, personalised and positive digital experience.
Read more

Facebook Data Privacy, Protection and Security Concerns

Data privacy is a global issue. As the world gets more connected, data privacy, protection and security concerns are gathering greater attention. It is concerning to observe that organisations are falling behind in their efforts to protect the privacy of users’ personally identifiable information (PII). In this article, we will provide a summary into the recent Facebook data breach and how Alyne can help global companies respond to increasing privacy, protection and security threats.
Read more