united-states privacy covid-19
Mask mandate for unvaccinated employees and privacy
<p>Is it legal for an employer such as a public school (in the US) to impose a mask mandate on only unvaccinated employees, or would that be a violation of those employees ADA or HIPPA rights?  It seems like an employee could easily claim they are singled out be being required to wear a mask.</p>

<p>ADA is about &quot;disabilities&quot;, and not being vaccinated is not a disability under the law.</p>
<p>Applicability of HIPAA is very complex and unclear. <a href="https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html" rel="noreferrer">The Privacy Rule</a> refers to and restricts the actions of Covered Entities. Healthcare providers and insurance companies are Covered Entities. The regulation <a href="https://www.ecfr.gov/cgi-bin/text-idx?SID=2bfa687d7ff15861c37082ad0a37948b&amp;mc=true&amp;node=se45.2.160_1103&amp;rgn=div8" rel="noreferrer">45 CFR 160.103</a> defines &quot;covered entity&quot; as</p>
<blockquote>
<p>(1) A health plan.</p>
<p>(2) A health care clearinghouse.</p>
<p>(3) A health care provider who transmits any health information in
electronic form in connection with a transaction covered by this
subchapter</p>
</blockquote>
<p><a href="https://www.ecfr.gov/cgi-bin/text-idx?SID=2bfa687d7ff15861c37082ad0a37948b&amp;mc=true&amp;node=pt45.2.164&amp;rgn=div5#se45.2.164_1512" rel="noreferrer">45 CFR 164.512</a> lists instances where authorization to disclose is not required, saying that &quot;A covered entity may use or disclose protected health information without the written authorization of the individual&quot;. The employer is not likely to be a &quot;covered entity&quot;, so these permissions are irrelevant. Furthermore, included in this section is a provision where disclosure is allowed in the case of</p>
<blockquote>
<p>(v) An employer, about an individual who is a member of the workforce
of the employer</p>
</blockquote>
<p>with various conditions following such as</p>
<blockquote>
<p>(A) The covered entity is a covered health care provider who provides
health care to the individual at the request of the employer:</p>
<p>(1) To conduct an evaluation relating to medical surveillance of the
workplace; or</p>
<p>(2) To evaluate whether the individual has a work-related illness or
injury</p>
</blockquote>
<p>However, these permissions apply to covered entities, not employers. (&quot;Work-related&quot; is not defined, but having a dangerous contagious disease does clearly relate to the workplace, thus it would be reasonable but not guaranteed to consider such a disclosure to be connectable to this section).</p>
<p><a href="https://www.ecfr.gov/cgi-bin/text-idx?SID=2bfa687d7ff15861c37082ad0a37948b&amp;mc=true&amp;node=pt45.2.164&amp;rgn=div5#se45.2.164_1510" rel="noreferrer">45 CFR 164.510</a> says that</p>
<blockquote>
<p>A covered entity may use or disclose protected health information,
provided that the individual is informed in advance of the use or
disclosure and has the opportunity to agree to or prohibit or restrict
the use or disclosure, in accordance with the applicable requirements
of this section</p>
</blockquote>
<p><a href="https://www.ecfr.gov/cgi-bin/text-idx?SID=2bfa687d7ff15861c37082ad0a37948b&amp;mc=true&amp;node=pt45.2.164&amp;rgn=div5#se45.2.164_1508" rel="noreferrer">§508</a>, covering required authorization (&quot;explicit yes&quot;) says</p>
<blockquote>
<p>Except as otherwise permitted or required by this subchapter, a
covered entity may not use or disclose protected health information
without an authorization that is valid under this section.</p>
</blockquote>
<p>There is no applicable provision whereby the proposed employer policy would clearly expose the employer to legal sanctions, since HIPAA does not purport to regulate everybody, only those entities where Congress authorized it to do so, via the concept of a &quot;covered entity&quot;.</p>
<p>Furthermore, the employer is not directly revealing any personal medical information: the employee (the <em>other</em> employee) is. A vaccinated employee is allowed to wear a sticker that says &quot;I was vaccinated&quot;. An imaginable application of HIPAA to vaccinated employees would be a policy of <em>requiring</em> a vaccinated employee to advertise that they were vaccinated.</p>
<p>One can reasonably guess that a person who does not wear a mask, given such a policy, has been vaccinated, but it is not a reasonable inference that a person who wears a mask has not been vaccinated (many vaccinated people continue to wear masks out of an abundance of caution). There is no legal basis for penalizing an employer who allows vaccinated employees to do things that weakly suggest that <em>other</em> employees have not been vaccinated.</p>
