Let’s Talk About HIPAA

Photo by Laura James on Pexels.com

By Kathleen J. Jennings (kjj@wimlaw.com)

A lot of people talk about HIPAA, but how many of them have actually read the law? Not very many, from what I have seen and heard people say about HIPAA. Let’s set the record straight.

HIPAA rules do not apply to all communications that may involve health information. As we pointed out in an earlier blog post, that means that an inquiry about your vaccination status will probably not violate HIPAA.

Entities that must follow the HIPAA regulations are called “covered entities.”

Covered entities include:

  • Health Plans, including health insurance companies, HMOs, company health plans, and certain government programs that pay for health care, such as Medicare and Medicaid.
  • Most Health Care Providers—those that conduct certain business electronically, such as electronically billing your health insurance—including most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists.
  • Health Care Clearinghouses—entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa.

In addition, “business associates” of covered entities must follow parts of the HIPAA regulations.

Often, contractors, subcontractors, and other outside persons and companies that are not employees of a covered entity will need to have access to your health information when providing services to the covered entity. These entities are called “business associates.” Examples of business associates include:

  • Companies that help your doctors get paid for providing health care, including billing companies and companies that process your health care claims
  • Companies that help administer health plans
  • People like outside lawyers, accountants, and IT specialists
  • Companies that store or destroy medical records

Covered entities must have contracts in place with their business associates, ensuring that they use and disclose your health information properly and safeguard it appropriately. Business associates must also have similar contracts with subcontractors. Business associates (including subcontractors) must follow the use and disclosure provisions of their contracts and the Privacy Rule, and the safeguard requirements of the Security Rule.

If you do business with a covered entity and are presented with a Business Associate Agreement–read it! Some of them can be quite broad and contain language that goes beyond the requirements of HIPAA.

Who Is Not Required to Follow These Laws

Many organizations that have health information about indivuduals do not have to follow these laws.

Examples of organizations that do not have to follow the Privacy and Security Rules include:

  • Life insurers
  • Employers
  • Workers compensation carriers
  • Most schools and school districts
  • Many state agencies like child protective service agencies
  • Most law enforcement agencies
  • Many municipal offices

What Information Is Protected 

  • Information your doctors, nurses, and other health care providers put in your medical record
  • Conversations your doctor has about your care or treatment with nurses and others
  • Information about you in your health insurer’s computer system
  • Billing information about you at your clinic
  • Most other health information about you held by those who must follow these laws

How This Information Is Protected

  • Covered entities must put in place safeguards to protect your health information and ensure they do not use or disclose your health information improperly.
  • Covered entities must reasonably limit uses and disclosures to the minimum necessary to accomplish their intended purpose.
  • Covered entities must have procedures in place to limit who can view and access your health information as well as implement training programs for employees about how to protect your health information.
  • Business associates also must put in place safeguards to protect your health information and ensure they do not use or disclose your health information improperly.

This may be more than you wanted to know about HIPAA. But if you want to dig even deeper into HIPAA, you can visit www.hhs.gov.

Kathleen J. Jennings is an attorney licensed to practice law in Georgia and New York. She graduated from Cornell University, College of Arts & Sciences, with distinction and New York University School of Law. She is a principal in the Atlanta office of Wimberly, Lawson, Steckel, Schneider, & Stine, P.C. and defends employers in employment matters, such as sexual harassment, discrimination, Wage and Hour, OSHA, restrictive covenants, and other employment litigation and provides training and counseling to employers in employment matters. She can be contacted at kjj@wimlaw.com.

Copyright 2021 Kathleen Jennings

The materials available at this blog site are for informational purposes only and not for the purpose of providing legal advice. You should contact your attorney to obtain advice with respect to any particular issue or problem. Use of and access to this Web site or any of the e-mail links contained within the site do not create an attorney-client relationship between Kathleen J. Jennings and the user or browser. The opinions expressed at or through this site are the opinions of the individual author.

Can You Require Your Employees to Be Vaccinated for COVID-19? Should You?

Photo by RF._.studio on Pexels.com

By Kathleen Jennings (kjj@wimlaw.com)

An FDA approved vaccine for COVID-19 has arrived, so employers may be wondering whether they can require employees to be vaccinated. The answer is generally yes, but should an employer make vaccines mandatory? Here are some important considerations and exemptions.

Considerations:

  • Vaccines are medical examinations under the ADA and, if they are to be required, must be job-related and consistent with business necessity or justified by a direct threat. It is a non-brainer that healthcare employers should make vaccines mandatory due to the potential exposure of employees to COVID-19. For other businesses, they will need to balance the possibility of exposure, consequences of exposure (how many employee absences at one time can the business tolerate?), and utility of the vaccine. Will a full complement of vaccinated employees allow you to resume business as usual?
  • Know your employees. How will they react to a mandatory vaccine rule? Will they comply? Are they likely to have a political objection to a mandatory vaccine rule? Will they rebel? Will they seek out a union organizer to help them rebel?
  • If vaccines are mandatory, will your workers’ compensation policy cover the side effects of a vaccine if an employee experiences a reaction? Check with your carrier. This will vary state to state.
  • What will OSHA require? Keep an eye on OSHA. If OSHA requires mandatory vaccines as part of an employer’s general duty to provide a safe workplace, then employers don’t have much choice; they’ll need to have a mandatory vaccine rule.
  • What will company leadership do? If the company’s leaders roll up their sleeves and get vaccinated as soon as possible, this will send a message to other employees.
  • Does state law require vaccines?
  • Do you have a collective bargaining agreement? If yes, it must be reviewed before implementing a mandatory vaccine rule. Even if the CBA does not require that the union agree to such a rule, it is generally a good idea to give advance notice to the union before implementing such a rule.

Exemptions:

An employer that implements a rule that requires employees to be vaccinated must build in exemptions for religion and disability.

Religion: An employee may be exempt from taking a required vaccine if vaccination violates a sincerely held religious belief. When deciding whether an employee is seeking an exemption based upon a simple disbelief in vaccination versus a religious objection that is part of a larger belief system, the courts look to the U.S. Supreme Court’s United States v. Seeger decision, which framed the the question to be asked as: “[D]oes the claimed belief occupy the same place in the life of the objector as an orthodox belief in God holds in the life of one clearly qualified for exemption?” Deep stuff, but it basically boils down to the difference between someone who does not believe in vaccination based on statements of media figures or a general distrust of authority, and a Christian Scientist. The first will not be exempt from a vaccination requirement, while the second will be exempt. Note that courts do not look favorably on seeking documentation from a pastor as to the sincerity of a person’s religious beliefs, so do not ask for it.

If an employee is exempt from a vaccination requirement on the ground of a sincerely held religious belief, the employer may need to look at making reasonable accommodations for that employee. In the case of COVID-19, that could look like social distancing and mask requirements in the proximity of the unvaccinated employee, or the employee may work remotely, if the job can be performed remotely.

Disability: Similarly, there may be employees who may be exempt from a vaccination requirement on the basis of a disability. They may have a serious allergy to a component of a vaccine, or they may suffer from a medical condition that could be worsened by a vaccination.

An employer can ask an employee seeking an exemption from a vaccination requirement on the basis of disability for medical documentation to support the exemption. Of course, all medical information must be maintained as confidential in a file separate from the employee’s personnel file. Similar to the situation of the employee exempted by religion, discussed above, the employer may need to provide a reasonable accommodation to the exempted disabled employee.

Now is the time for employers to prepare a vaccine plan as part of a larger COVID-19 strategy.

  • What approach are you going to use: are you going require vaccines for all employees, some employees, or none at all?
  • If you require vaccination, are you prepared to take action, up to including discharge, against those who refuse to get vaccinated and do not qualify for an exemption?
  • Will you offer incentives to convince employees to voluntarily get vaccinated?
  • How will you identify those who are legally exempted from vaccination?
  • What accommodations can you offer to those who are legally exempted from vaccination?

You’ve heard it a million times, but I’ll say it: the current pandemic is an unprecedented situation. The best course is to seek advice from qualified counsel as you move forward.

Kathleen J. Jennings is an attorney licensed to practice law in Georgia and New York. She graduated from Cornell University, College of Arts & Sciences, with distinction and New York University School of Law. She is a principal in the Atlanta office of Wimberly, Lawson, Steckel, Schneider, & Stine, P.C. and defends employers in employment matters, such as sexual harassment, discrimination, Wage and Hour, OSHA, restrictive covenants, and other employment litigation and provides training and counseling to employers in employment matters. She can be contacted at kjj@wimlaw.com.

©2020 Kathleen J. Jennings

The materials available at this blog site are for informational purposes only and not for the purpose of providing legal advice. You should contact your attorney to obtain advice with respect to any particular issue or problem. Use of and access to this Web site or any of the e-mail links contained within the site do not create an attorney-client relationship between Kathleen J. Jennings and the user or browser. The opinions expressed at or through this site are the opinions of the individual author.