HIPAA can become an issue if healthcare employers require proof that employees have received a COVID-19 vaccine, says Abbye Alexander, JD, partner with Kaufman Dolowich Voluck in Orlando.

Under HIPAA, immunization records are protected health information, Alexander notes. Therefore, whether an employee has received a COVID-19 vaccine may be disclosed only by a healthcare provider if the employee has furnished the provider with their written authorization.

“Employers may ask their employees whether they have received the vaccine, but they may only seek information from the employee’s medical provider with written authorization from the employee,” Alexander explains. “Once this information is obtained, it may not be disclosed by the employer without the employee’s consent.”

Alexander notes that Equal Employment Opportunity Commission (EEOC) guidance states employers may require employees to provide proof that he or she received a COVID-19 vaccine. However, disclosure of information reflecting a disability could implicate the Americans with Disabilities Act, she says.

The EEOC seeks to prevent this by recommending employers’ requests for proof of a COVID-19 vaccine also include a request that no medical information be disclosed along with proof of the vaccination, she says.

“HIPAA concerns are particularly noteworthy in healthcare employment settings where employees may be more likely to be offered vaccinations at their place of employment,” Alexander says. “Healthcare employers should be mindful to ensure proper, HIPAA-compliant employee authorizations are obtained and retained in the same manner as patient authorizations.”


  • Abbye Alexander, JD, Partner, Kaufman Dolowich & Voluck, Orlando. Phone: (407) 789-1230. Email: aalexander@kdvlaw.com.