WASHINGTON — Many U.S. states, including Washington, D.C., have ended mask mandates or issued plans to do so soon. This comes after the CDC updated its guidelines to say it is safe for vaccinated individuals to gather in most indoor situations without masks.
When mask mandates are rescinded, though, that puts the burden of mask requirements onto individual businesses who must decide if they want to require masks, and for whom. The next question that businesses may need to face: how do we know a customer is vaccinated?
The Verify team reached out to a pair of health privacy law experts to find out, based on current laws, how businesses can legally ask clients and customers about their vaccination status.
THE QUESTION
Can private businesses like restaurants and grocery stores ask you whether you've been vaccinated?
OUR SOURCES
- Iliana Peters, a health privacy specialist and HIPAA expert with the Washington, DC law office Polsinelli
- Scott Loughlin, Partner and Co-Leader of the Privacy and Cybersecurity group at the law firm Hogan Lovells
- Florida State Senate Bill 20006
- Texas Executive Order GA 35
THE ANSWER
Yes, most businesses in most states can ask you whether you've been vaccinated. But, the legal waters get murkier the more follow-up questions you ask.
WHAT WE FOUND
The United States does not have any blanket health privacy laws, according to attorney Iliana Peters. The federal government has periodically passed specific privacy laws, like the Health Insurance Portability and Accountability Act (HIPAA), but none that would protect everyone's health information from everyone else.
"The protections for the privacy of our information vary industry to industry and state to state," Peters said. "It is very unlikely that you would have a situation where one federal law would control all information related to health, because that's just not the way we do data privacy and security in this country."
HIPAA mandates that health care providers and health insurance companies cannot disclose certain medical information without your consent. The rule extends to some related medical fields, but it does not protect non-medical businesses from asking for your vaccination status.
"Anyone really can ask you for your information under HIPAA," Peters said. "It's you, the patient, who has to make the decision 'Yes, I'm going to give that information,' or 'No, I'm not, because that's my decision.' But that isn't regulated by HIPAA.”
RELATED: VERIFY: No, most businesses won’t violate HIPAA by asking customers if they’ve been vaccinated
Scott Loughlin said generally at the federal level, there's nothing keeping a business or organization from asking for your vaccination status. Where it could become an issue, though, is if more follow-up questions are asked. He said where this could go wrong is, if someone says they're not vaccinated, following up with a "Why not?"
"That can raise a number of more sensitive issues," Loughlin said. "Is there an underlying health condition which makes you unable to get a vaccine? Do you follow a religious practice that makes getting a vaccine something that you're not able to do?"
Once the possibility of disability or religious discrimination comes into play, federal protections like the Americans with Disabilities Act (ADA) and the First Amendment's guarantee of freedom of religion would step in. Loughlin believes as long as just the yes/no question of vaccination is asked, there is little risk of discrimination accusations.
But, just because a business or organization can ask you for your vaccination status, that doesn't mean you are obligated to answer the question. The trade-off is that in most states you can be turned away, asked to wear a mask or afforded some other kind of accommodation.
Loughlin stresses that where the law lacks in privacy protection, you can make up for it yourself.
"I think people need to understand that there are limitations on what the law is going to do in terms of protecting your information," he said. "As a result, you, the individual, the consumer, are really in charge of making sure that you protect whatever information you find sensitive."
As with most laws and policies in the United States, this is all going to vary depending on where you live.
At the federal level, the White House said in March 2021 that they were ruling out the creation of a national “vaccine passport” for Americans to verify their immunization status. They said it's up to the private sector to develop a system for people to show they've been vaccinated.
In many cases, local laws will dictate what businesses can and can't do. Some states have signed bills or executive orders which prevent government entities from requiring vaccine certification. Only Florida and Texas so far have broadened the bans to private businesses.
Florida Gov. Ron DeSantis signed a bill into law on May 3, which prohibits businesses, government entities or schools from requiring COVID-19 vaccination certification from any persons. Florida schools require other vaccines, like MMR and Hepatitis B.
Texas Gov. Greg Abbott signed an executive order in early April prohibiting government facilities and some businesses from requiring COVID-19 vaccine certification for consumers. The order mandates "any public or private entity that is receiving or will receive public funds...shall not require a consumer to provide, as a condition of receiving any service or entering any place, documentation regarding the consumer's vaccination status for any COVID-19 vaccine administered under emergency use authorization."
So we can verify that federally, there are no laws keeping businesses from simply asking if you have been vaccinated for COVID-19. But, some states have stricter rules about who can ask for vaccine certification.