With the news that some places may require a COVID-19 vaccine for entrances, many people have concerns about the privacy of their health information.

Many are citing HIPAA laws as reasons for not disclosing if they have received the shot and want to know if it is legal for a business to ask a customer if they are vaccinated.

HIPAA stands for the Health Insurance Portability and Accountability Act. It was signed by then-President Bill Clinton in 1996 and set national standards to protect health information from being shared without one’s knowledge or consent.

“An employer typically is not a covered entity under HIPAA. And so HIPAA typically wouldn’t prevent an employer from asking its employees to disclose whether the employee has been vaccinated,” says attorney Lani Dornfeld at Brach Eichler.

But can an employer require an employee to get a vaccine dose? The answer to this is still being worked out.

“We are leaning towards saying – we believe that we can require people to do that. People who are returning to work. But not without some attached problems and potential lawsuits,” Dornfeld says.

Protecting one’s information in a workplace setting begins with being smart with that same information online.

“Don’t start posting things on social media. Because once you do, it’s out there and your claim to privacy becomes a bit diminished if you’re going to be posting pictures of yourself with your vaccinated card or getting vaccinated - then trying to claim that you have a privacy interest in that very same information in a different context,” Dornfeld said.

More information about what the HIPAA law entails can be found on the U.S. Department of Health & Human Services’ website.