Health Information Compliance Alert

With some states requiring COVID-19 vaccinations for healthcare workers, you may be wondering how HIPAA compliance fits into the scenario. Read on for the details.

Consider These Vaccination Mandate Logistics

Rollback: In May, the Equal Employment Opportunity Commission (EEOC) expanded its guidance on COVID vaccination mandates in the workplace. “The federal EEO laws do not prevent an employer from requiring all employees physically entering the workplace to be vaccinated for COVID-19,” but organizations must offer accommodations to staff that align with provisions outlined in Title VII of the Civil Rights Act and the Americans with Disabilities Act (ADA), according to May 28 EEOC guidance. Accommodations mentioned by the EEOC include face masks, social distancing, remote work, split shifts, COVID-19 testing, or if need be, reassignment to another position.

At press time, 22 states had some sort of vaccination mandate for specific healthcare workers in their states, according to the National Academy for State Health Policy (NASHP) online resources. But, the stringency of the requirement depends on the state, and policies vary significantly, carrying legal implications on both sides of the debate.

For instance, Washington state has one of the strictest mandates in the country. On Aug. 9, Gov. Jay Inslee issued an emergency proclamation that all state workers, volunteers, on-site contractors, public and private healthcare workers, and long-term care workers be vaccinated by Oct. 18. Though the Washington mandate offers no weekly testing option for those refusing vaccination, the state does provide “exemptions from the vaccine requirement … for those individuals who are entitled to a disability-related reasonable accommodation or a sincerely held religious belief accommodation,” a release maintains.

Bans: Some states have opted to remain neutral on vaccination requirements for healthcare workers, leaving it up to the individual organizations, while others have banned such mandates. “Several states have proposed legislation prohibiting mandatory vaccination policies,” point out attorneys with international law firm Perkins Coie LLP. “Montana currently prohibits employers from discriminating against a person based on the person’s vaccination status. Other states have proposed similar legislation,” the Perkins Coie lawyers say in online legal analysis.

Here’s the HIPAA Tie-In

“If an employer asks an employee to provide proof that they have been vaccinated, that is not a HIPAA violation, and employees may decide whether to provide that information to their employer,” the Department of Health and Human Services (HHS) says in a frequently asked question on Coronavirus. However, it gets a little more complicated after that data is collected.

Once that COVID-19 vaccination info is “obtained ... the vaccination status data is considered confidential medical information and must be handled accordingly,” say attorneys Anna-Liisa Mullis and Christine A. Samsel with law firm Brownstein Hyatt Farber Schreck, LLP in online legal analysis.

As a covered entity (CE) or business associate (BA), you are privy to HIPAA — and your employees’ COVID-19 vaccination information is considered protected health information (PHI). That means the PHI falls under the HIPAA Rules’ governance.

“Employers would be well advised to provide advanced written disclosures to employees regarding the vaccination process, the legitimate business reason for same, and how the employer (or the group health plan) will use, store, and share (if at all) vaccination data of individual employees,” the Perkins Coie lawyers note.

Your organization should review state privacy laws as those can be much more stringent than HIPAA and could carry penalties for noncompliance. Remember, that the Centers for Disease Control and Prevention (CDC) and Occupational Safety and Health Administration (OSHA) offer advice on the best way to compile and store staff medical records, including COVID-19 vaccination files (see Health Information Compliance Alert, Vol. 21, No. 4).

HHS, VA Require Healthcare Workers to Get the Vax

Since some staff are on the front lines caring for patients, it shouldn’t be a surprise that HHS is now requiring a COVID vaccination for its 25,000+ workforce.

“Staff at the Indian Health Service (IHS) and National Institutes of Health (NIH) who serve in federally-operated health care and clinical research facilities and interact with, or have the potential to come into contact with, patients will be required to receive the COVID-19 vaccine,” the agency noted in an Aug. 12 release. “This includes employees, contractors, trainees, and volunteers whose duties put them in contact or potential contact with patients at an HHS medical or clinical research facility.”

Additionally, members of the U.S. Public Health Service Commissioned Corps, who often assist in disaster and crisis situations and are referred to as “emergency responders,” will be required to get vaccinated as well as healthcare workers at the Department of Veterans Affairs (VA), the release said.

“Vaccines are the best tool we have to protect people from COVID-19, prevent the spread of the Delta variant, and save lives,” said HHS Secretary Xavier Becerra in a release. “Instructing our HHS health care workforce to get vaccinated will protect our federal workers and the patients and people they serve.”

Nursing homes: On Aug. 18, the Centers for Medicare & Medicaid Services (CMS) announced that it, “in collaboration with the Centers for Disease Control and Prevention (CDC), is developing an emergency regulation requiring staff vaccinations within the nation’s more than 15,000 Medicare and Medicaid-participating nursing homes,” according to a CMS release.

“The data are clear that higher levels of staff vaccination are linked to fewer outbreaks among residents, many of whom are at an increased risk of infection, hospitalization, or death,” CMS Administrator Chiquita Brooks-LaSure said in the release.

About 62 percent of nursing home staff are currently vaccinated, CMS said. (CMS requires nursing homes to report that data.) “Vaccination among staff at the state level ranges from a high of 88 percent to a low of 44 percent,” the agency reported. Many recent COVID outbreaks have been “occurring in facilities located in areas of the United States with the lowest staff vaccination rates,” CMS added in the release.

The agency plans to issue the vaccination requirement sometime in September.

Disclaimer: Information related to COVID-19 is changing rapidly. This information was accurate at the time of writing. Be sure to stay tuned to future issues of Health Information Compliance Alert for more information.

Resource: See the EEOC guidance at www.eeoc.gov/wysk/what-you-should-know-about-covid-19-and-ada-rehabilitation-act-and-other-eeo-laws#K.