DALLAS — THE QUESTION:
Does a vaccine passport violate the Health Insurance Portability and Accountability Act (HIPAA)?
THE ANSWER: No, requiring a COVID-19 vaccine card to fly on an airplane does not violate the HIPAA.
OUR SOURCES: The sources for this include two experts in medical law and HIPAA.
Jeff Drummond is a health care regulatory lawyer who has been doing HIPAA work for nearly 20 years. He is a partner with the Jackson Walker LLP law firm in Dallas.
Erin Fuse Brown is the Catherine C. Henson Professor of Law at Georgia State University. She is an Associate Professor of Law and the Director of Center for Law, Health & Society.
WHAT WE FOUND:
The purpose of the HIPAA is to protect your sensitive medical information.
HIPAA applies when a health care provider or insurer receives your protected health information.
While your vaccine card is considered protected health information, an airline is not a health care provider.
"Just because you carry around some health information with you in the form of your vaccine card, that information doesn't bring all the HIPAA protections with it," Brown said.
An airline still has to follow state privacy and identity theft policies.
The Texas medical record privacy act means the airline could not use the obtained information for any other reason than what they have told you.
The Texas identity theft statute means the airline must tell the public if there has been a breach of their data.
"Once they get the data, they have to protect it," Drummond said. "They have to notify you if there's a breach but other than that, that's the end of their obligation under either HIPAA or Texas state law."
SO, WE CAN VERIFY: While there are protections in place both at the federal and state level, we can verify that a vaccine passport does not violate the HIPAA.
Brown said providing an airline with a vaccine card should not reveal any other information about that person.
"Vaccine status doesn't reveal other information about you, so it doesn't say anything sensitive about your pregnancy or your mental health status or whether you have HIV/AIDS," Brown said.
If an airline attempts to call a customer's doctor or medical provider to get information about his or her vaccine status, that does become a HIPAA issue. However, if someone tells his or her medical provider it can give that information to a certain entity, then it can be given out.
"You have the control with the data," Drummond said. "You have the right to disclose any and all information."