Using Claims Data to Verify COVID-19 Vaccination Status is Risky

Does your organization require that employees prove they are fully vaccinated against COVID-19 before returning to work in your office?  If so, may you check their vaccination status by reviewing claims submitted to your group health plan?

The short answer is no.  Your group health plan is a covered entity under HIPAA, and information about employees’ COVID-19 vaccination status is considered protected health information (PHI).  PHI may not be used or disclosed for employment-related purposes without the plan participant’s authorization.  Checking vaccination status by reviewing claims and subsequently making employment-based decisions with this information would violate the HIPAA Privacy Rule.

A better option, one that avoids a violation of the HIPAA Privacy Rule and possible fines, is to request that employees submit a copy of their vaccination record card that is approved by the Centers for Disease Control and Prevention.  This method bypasses the PHI created, maintained, or received by your group health plan and is much more efficient than collecting authorizations from all employees.

If you have questions regarding the HIPAA Privacy Rule and COVID-19 vaccinations, call ASR Health Benefits at (616) 957-1751 or (800) 968-2449.