47° and Clear
Image
What does HIPAA cover?
Most people encounter HIPAA [the Healthcare Insurance Portability and Accountability Act] when signing consent forms at their doctor’s office. Typically, that is the extent of their exposure to this law or any other that governs health care and their privacy.
So “there’s a lot of misapplication and misunderstanding in terms of what HIPAA does,” said Matthew Fisher, who serves as general counsel for Carium, a telehealth platform company, and has practiced health care law for more than a decade.
Here’s who HIPAA regulates:
- Health insurance companies, Medicare, Medicaid or employers who run self-funded health plans
- Business associates, such as health care providers, hospitals, nursing homes or anyone actually delivering a health care service
- Subcontractors of business associates, such as health care clearinghouses or billing companies that may transfer patient data
HIPAA does not apply to conversations you might have on the street, said Margaret Riley, a professor of law at the University of Virginia who also serves as legal advisor for the school’s Health Sciences Institutional Review Board.
“I can ask you on the street what your vaccine status is. I can ask you in my business what your vaccine status is. If I’m not your supervisor, that’s not a violation because I have no impact on you,” Riley said.
“On the other hand, you have no obligation to answer me.”
Confusion beyond HIPAA
If HIPAA does not prevent you from asking most other people if they are vaccinated, new laws going into effect around the country may contribute to stifling conversation, if indirectly.
State lawmakers have submitted more than 150 bills tied to vaccine passports and mandates for employers and schools, according to the National Academy for State Health Policy.
These orders come as the delta variant pushes the number of new infections to more than 100,000 each day — levels last seen in February before vaccines were widely available — and largely affecting unvaccinated swaths of the country.
