Health Information Compliance Alert

Published on Wed Oct 06, 2021 PDF

See the latest OCR guidance on HIPAA and COVID vaccinations.

In an effort to curtail the Delta variant and reduce COVID spread, the feds have introduced a new comprehensive vaccination plan — and healthcare workers are among those impacted by the mandates. Read on for the specifics.

Background: In August, the Centers for Medicare & Medicaid Services (CMS) issued a staff vaccination requirement for more than 15,000 Medicare and Medicaid-participating nursing homes, citing statistics that showed higher staff vaccination rates correlate to fewer residents contracting the virus. Then the Department of Health and Human Services (HHS) mandated vaccinations for all HHS healthcare workers and auxiliary agencies’ health workforce. In addition to the federal policies, several governors have also implemented COVID vaccination and weekly testing requirements for healthcare workers in their states (see Health Information Compliance Alert, Vol. 21, No. 9).

Now: On Sept. 9, the White House announced another round of COVID-19 vaccination mandates in its “Path Out of the Pandemic” action plan. “The Biden-Harris Administration will require COVID-19 vaccination of staff within all Medicare and Medicaid-certified facilities to protect both them and patients from the virus and its more contagious Delta variant,” CMS says in the release. “Facilities across the country should make efforts now to get health care staff vaccinated to make sure they are in compliance when the rule takes effect.”

Under this latest decree, CMS is expanding its emergency regulations to include “hospitals, dialysis facilities, ambulatory surgical settings, and home health agencies, among others,” and making the vaccination requirement “a condition for participating in the Medicare and Medicaid programs,” an agency release says.

“As the Delta variant continues to spread, we know the best defense against it lies with the COVID-19 vaccine,” says CMS Administrator Chiquita Brooks-LaSure in a release. “Data show that the higher the level of vaccination rates among providers and staff, the lower the infection rate is among patients who are dependent upon them for care.”

Important: Though only Medicare and Medicaid providers who receive federal funding must comply with the new healthcare provider mandates according to the latest guidance, there’s another prong to consider in the Biden plan. “The Department of Labor’s Occupational Safety and Health Administration (OSHA) is developing a rule that will require all employers with 100 or more employees to ensure their workforce is fully vaccinated or require any workers who remain unvaccinated to produce a negative test result on at least a weekly basis before coming to work,” Biden’s plan says. “OSHA will issue an Emergency Temporary Standard (ETS) to implement this requirement. This requirement will impact over 80 million workers in private sector businesses with 100+ employees.”

At press time, the feds hadn’t released an interim final rule on the implementation of the plan, timeline, costs, or the Medicare and Medicaid CoP tie-ins, nor had OSHA announced its part of the vaccination mandate rollout.

OCR Offers HIPAA Privacy Rule Guidance on COVID Vaccinations and the Workplace

With federal COVID-19 vaccination mandates for healthcare workers in the works, you might be confused about how that impacts HIPAA at your organization. The HHS Office for Civil Rights (OCR) appreciates the pressure on workers and employers to deal with these quandaries. To better help the public “navigate the COVID-19 pandemic,” the agency updated its online guidance on Sept. 30 with a fresh question-and-answer set on the who, what, when, and where of HIPAA and COVID-19 vaccines.

“We are issuing this guidance to help consumers, businesses, and healthcare entities understand when HIPAA applies to disclosures about COVID-19 vaccination status and to ensure that they have the information they need to make informed decisions about protecting themselves and others from COVID-19,” explains new OCR Director Lisa Pino in a release.

First, OCR reminds that the HIPAA Privacy Rule doesn’t affect all organizations or staff records, but rather “only applies to HIPAA covered entities (health plans, healthcare clearinghouses, and healthcare providers that conduct standard electronic transactions), and, in some cases, to their business associates,” the agency emphasizes.

Breakdown: Though there are only five HIPAA Q&As offered in the new COVID guidance, OCR provides covered entities (CEs) and their business partners (BAs) with a wealth of handy tips and examples for dealing with privacy concerns surrounding employee vaccinations.

The first question focuses on whether the Privacy Rule comes into play when CEs or BAs ask their staff if they’ve received the COVID-19 vaccination. According to OCR, it doesn’t. The Privacy Rule neither regulates nor prohibits CEs and BAs from “request[ing] information from patients or visitors,” including asking about COVID-19 vaccinations, OCR maintains in Answer No. 1. However, CEs and BAs should note that the Privacy Rule “does regulate how and when a covered entity or its business associate may use or disclose information about an individual’s vaccination status,” the agency cautions.

Tip: For an example, OCR refers to this common scenario: a home health agency asks its employees if they’ve gotten the COVID vaccination. In this case, the Privacy Rule does not apply because the HHA is merely asking, not using or disclosing the information, the guidance says.

The other Q&As touch on the these concerns and whether the Privacy Rule applies: individuals’ disclosure of their personal PHI to others; vaccination mandates and employment terms and conditions; workforce vaccination records and how to document, store, and keep them confidential; HIPAA authorizations; mask requirements; patient/public requests for healthcare workers’ vaccination status; and permitted disclosures of COVID-19 vaccination status for public health emergency (PHE) reasons.

Resources: Review the CMS release at www.cms.gov/newsroom/press-releases/biden-harris-administration-expand-vaccination-requirements-health-care-settings, see the White House plan at www.whitehouse.gov/covidplan, and find the OCR guidance at www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-covid-19-vaccination-workplace/index.html.