Do Vaccine Passports Violate HIPAA? Let's Discuss.

Learn more about The Health Insurance Portability and Accountability Act of 1996 (HIPAA)  and how it protects sensitive health information from being disclosed without the patient’s consent or knowledge. Plus, we go through a complete break down on Vaccine Passports in the US, the good and the bad, all while trying to answer the question that is on everybody's mind: Do vaccine passports violate HIPAA? Or do they not?  

Understanding Vaccine Passports & HIPAA

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. The US Department of Health and Human Services (HHS) issued the HIPAA Privacy Rule to implement the requirements of HIPAA. The HIPAA Security Rule protects a subset of information covered by the Privacy Rule.

The Privacy Rule standards address the use and disclosure of patients health information (protected health information) by covered entities subject to the Privacy Rule. Furthermore, it also contains standards for patients rights to understand and control how their health information is used. There are four kinds of covered entities:

  • Healthcare Providers
  • Health Plans
  • Health Clearinghouses
  • Business Associates

Covered entities are allowed to use and disclose protected health information, without the patient's authorisation, exclusively for one of the following reasons:

  • Disclosure to the individual.
  • Treatment, payment, and healthcare operations.
  • Opportunity to agree or object to the disclosure of PHI.
  • Incident to an otherwise permitted use and disclosure.
  • Public interest and benefit activities.

That being said, do vaccine passports violate HIPAA? Or do they not?

According to several reports recently published gathering expert opinions from sources dedicted to compliance within the healthcare sector, including one by The Washington Post, although HIPAA is used to protect sensitive medical information, it only applies to how physicians, hospitals and health insurers share a patient's information with third-party entities. Meaning, vaccine passports qualify as protected health information, but an airline, for example, is not a healthcare provider. Of course, an airline is obliged to follow state privacy and identity theft policies but it isn't affected by HIPAA. Therefore, it can be concluded that vaccine passports, although they can be considered as a violation of privacy, do not precisely violate HIPAA regulations.

A couple weeks ago, Anthony Fauci, MD, director of the National Institute of Allergy and Infectious Diseases, went on Politico's 'Dispatch' Podcast and said that the federal government will not mandate COVID-19 vaccine passports for businesses or events. Dr. Fauci said COVID-19 passports are being developed by private companies and businesses will decide whether they adopt them with little involvement from the federal government.

It is only logical that, just like public opinion, state policies are equally polarised. New York became the first state to launch a COVID-19 vaccine passport on March 26, and the state now uses IBM's passport for events and other large gatherings. A week later, on April 2, Florida Gov. Ron DeSantis signed an executive order prohibiting the use of COVID-19 vaccine passports in the state, banning any government entity from issuing vaccine passports and preventing businesses from requiring any such documentation of consumers.

Either in agreement or disagreement with this analysis, in favor or against the passports in question, it seems like they are here to stay, bringing with them positive aspects and raising valid concerns.

Some positive aspects of vaccine passports include:

  • They allow holders to return to normality or at least a new normality.
  • This return to normality, for those holding the passport in question, potentially encourages hesitant people to take the shot, increasing the number of inoculated people.

Some concerns regarding vaccine passports include:

  • Privacy: Allowing businesses to access people’s healthcare information can be considered a violation of privacy.
  • Fakes: Many counterfeit COVID-19 passports are being sold online by anonymous traders.
  • Discrimination: Communities or individuals who haven’t had the chance to get a shot, or are simply more skeptical about taking the vaccine at all, would be treated unequally.
  • False Safety: It can create a false sense of safety as the number of mutations rapidly increases and it is unclear if all vaccines will be effective against all future mutations of the virus. Furthermore, research still needs to be made as it is unknown whether vaccinated people can contract an asymptomatic case of COVID-19.

Learn more about Alyne's Content Library and the comprehensive mapping of The Health Insurance and Accountability Management Act (HIPAA), covering not only section 164.3xx (Security Standards), but also the rules outlined in section 164.4xx (Breach Notification) and section 164.5xx (Privacy Aspects).

Learn more about Alyne’s RegTech capabilities in the healthcare industry in this episode of our podcast: The RegTech Report.

Javier Gutierrez

Related Posts

Tightened Cyber Security Awareness Training To Combat Heightened Attempts

October is Cybersecurity Awareness Month. This 2021, Co-founder of Alyne, Stefan Sulistyo shares how Alyne goes beyond the notion of being in compliance with various security awareness requirements to strengthen our collective digital ecosystem – especially during remote working, and the recent acquisition of Alyne by Mitratech – two events which have heightened cyber and phishing attempts across the business.
Read more

A 360 Degree Risk View of Your Vendors with Alyne and SecurityScorecard

Recently, Alyne’s third party risk management capabilities became a whole lot more powerful with the introduction of the SecurityScorecard integration which offers users a comprehensive 360 degree risk view of their third party dependancies. Read more about how you can power-up your vendor governance process with the help of Alyne and SecurityScorecard.
Read more

Integrating Cyber Security, IT and Vendor Strategy for Improved Enterprise Risk Management

This year, United State's President Joe Biden signed a cyber security executive order to increase scrutiny and raise the bars for software security standards. In this article, Christina Casino from Alyne’s Customer Success Team unpacks and explains Alyne’s approach that can help your organisation streamline and integrate IT, cyber security and vendor strategy all within a single SaaS platform.
Read more