On September 30, 2021, and October 4, 2021, respectively, the Department of Health and Human Services (HHS) and the Department of Labor (DOL) issued updated guidance regarding COVID-19 vaccinations.

The HHS guidance specifically relates to recent questions regarding the HIPAA Privacy Rule. The new FAQs provide that HIPAA does not prohibit businesses or individuals from asking their customers or clients whether they have been vaccinated. This is the case both because HIPAA only applies to covered entities and because HIPAA does not apply if a covered entity (such as a hospital) asks patients or visitors for their vaccine status. The new HHS FAQs also specify that HIPAA doesn’t apply when an employer asks an employee their vaccination status. This is because the Privacy Rule doesn’t apply to employment records. While it is permissible to ask for this information, employers must keep vaccination status confidential and store that information separately from other employment-related information under the Americans with Disabilities Act.

The DOL FAQs address the requirement that health plans pay for COVID-19 vaccinations in full. Specifically, the FAQs clarify that non-grandfathered health plans must pay for COVID-19 vaccination without any participant cost-sharing requirements. This includes any COVID-19 vaccination provided in accordance with an Emergency Use Authorization (EUA) or a Biologics License Application (BLA). This “free” coverage applies to any COVID-19 vaccination permitted under an EUA or BLA, including: the administration of a third dose to certain individuals, the administration of booster doses, and the expansion of the age demographic for which the vaccine is approved.

The DOL FAQs also address the issue of whether health plans can incentivize employees to get vaccinated (or charge more to those who are not). The FAQs provide that any such program would be considered an activity-based health-contingent wellness program and would be subject to the HIPAA nondiscrimination rules applicable to such programs. These rules cap the total reward/penalty for all wellness-related activities (other than those for tobacco cessation) at 30% of the total cost of coverage. Additionally, if such a program is offered, the plan must provide a “reasonable alternative” method to qualify for the reward/avoid the penalty if getting the vaccine would be “unreasonably difficult due to a medical condition or medically inadvisable.” The example in the guidance of a reasonable alternative is requiring an employee to follow the CDC masking recommendations for unvaccinated people. All plan participants must be notified of the reasonable alternative method. Finally, the FAQs emphasize that any employer with different rates for vaccinated vs. non-vaccinated employees must use the rates for unvaccinated employees when determining if an offer of coverage is affordable for purposes of the ACA’s employer mandate.

Generally, this recent guidance affirms our team’s preexisting interpretation regarding these issues. It is nevertheless helpful to hear directly from the agencies on these pressing and timely issues.