Congresswoman Marjorie Taylor Greene, R-Georgia, a well-known vaccine critic and skeptic, was recently asked whether she’d been vaccinated against COVID-19.

She responded by saying that the question itself was “in violation of my HIPAA rights.”

By HIPAA, she was referring to the Health Insurance Portability and Accountability Act, the 1996 federal law that prevents people’s private health information from being shared by health care providers without patient consent.

“(W)ith HIPAA rights, we don’t have to reveal our medical records,” Greene continued, “and that also involves our vaccine records.”

Her first claim, that asking questions about vaccination status is itself a violation of federal law, has been roundly dismissed as an absurdity. But the second part, about one’s obligations to reveal vaccination status, raises questions that are worth exploring.

What Does HIPAA Say?

More and more employers are requiring employees to be vaccinated against the coronavirus. Because HIPAA protects medical confidentiality, if an employer requires proof of vaccination, does that violate an employee’s HIPAA rights?

According to the Department of Health and Human Services (HHS), the answer is no. “HIPAA only applies to HIPAA-covered entities – health care providers, health plans, and health care clearinghouses – and, to some extent, to their business associates,” HHS says.

These “covered entities” can’t share your health records without your permission – and if they do, they’ll face stiff penalties. But an employer is not a covered entity.

“If an employer asks an employee to provide proof that they have been vaccinated, that is not a HIPAA violation,” HHS says, “and employees may decide whether to provide that information to their employer.”

Vaccination Disclosure Confusion

Apparently, some people believe that HIPAA provides greater protection from disclosure requirements than it does. Besides Greene, other notable persons who have made the erroneous claim are two NFL quarterbacks: the Dallas Cowboys’ Dak Prescott and the New England Patriots’ Cam Newton.

People of the “it’s my business” persuasion should also be aware that there are situations where other people will want to know whether the people around them have been vaccinated. Claire Talltree, a 64-year-old retiree from Snohomish, Washington, serves on the board of a nonprofit organization that held a meeting when the state lifted restrictions and told the PBS News Hour that some of the members cited HIPAA in not revealing whether they were vaccinated.

“They want me to quit being fearful,” she said. “I’m not fearful. I just don’t want to catch this disease.”

In fairness, however, it does seem clear that people can become confused about vaccine requirements and disclosures at the state and local levels. Ballotpedia has been monitoring this activity and counts 20 states that prohibit proof-of-vaccination requirements in a variety of ways.

Although private employers have the right to require vaccinations or proof of negative tests by their employees, some states say that state agencies can’t require it of anyone, including employees. And some states say that private businesses can’t ask about the vaccination status of visitors or customers.

The rules can be bewildering. Depending on where you live, you might have the right to refuse disclosing your vaccination status in some situations thanks to recently enacted laws and executive orders at the state or local level.

Just don’t say HIPAA protects you. It doesn’t.