No, HIPAA doesn’t prohibit businesses from asking about your vaccination status

Misinformation is spreading on social media claiming that businesses aren’t allowed to ask customers if they’ve received a COVID-19 vaccine because it would violate health privacy laws. 

But that’s wrong, and some posts making these claims have been flagged as part of Facebook’s efforts to combat false news and misinformation on its News Feed. (Read more about our partnership with Facebook.)

Consumer privacy protections under the Health Insurance Portability and Accountability Act of 1996 — better known as HIPAA — are implemented with what’s called the Privacy Rule. 

According to the Centers for Disease Control and Prevention, the rule established a set of national standards to address how health care providers, insurers and other entities use and share people’s health information. The law is designed to prevent them from disclosing a patient’s private health information without that person’s permission. 

Featured Fact-check

Social Media

stated on October 28, 2024 in in social media posts

"Nicki Minaj just endorsed Donald Trump for President.”

The law doesn’t prohibit businesses from asking customers about their vaccination status. 

Kayte Spector-Bagdady, a lawyer and associate director at the University of Michigan’s Center for Bioethics and Social Sciences in Medicine, told WKYC, an NBC News affiliate in Cleveland, that people often think HIPAA protects them from having to answer questions about their medical information, or prohibits others from asking.

"Neither is true," Spector-Bagdady said. "HIPAA prohibits health professionals, such as your doctor, from sharing your identified health information without your permission in most circumstances. People can always ask about your health information, and you can almost always decline to answer. But not answering health questions might come at a cost — such as not being able to enter your workplace or board a plane."

We rate this post as False.