Regis College is among a growing number of organizations – from other higher education institutions to the Mass General Brigham health care system – to require the COVID-19 vaccine of employees and students.

As similar requirements continue to be announced across the country, critics have pointed to the Health Insurance Portability and Accountability Act, more commonly known as HIPAA, as a reason why such a requirement shouldn’t be allowed.

Vaccine clinic signBut as faculty in Regis College’s Young School of Nursing and School of Health Sciences point out, nothing in HIPAA restricts a school or employer from asking a person if they are vaccinated or making it a requirement to learn and work.

“(HIPAA) protects health care entities from sharing your information without your consent or knowledge,” explained Helene Bowen Brady, ’17, associate professor and director of the clinical nurse leader program. “What we know is that individuals who are vaccinated are protected from severe illness and death related to COVID. Over the past month, the data has shown that the people across the US who died from COVID-19 or were seriously ill requiring a ventilator were unvaccinated.”

Passed in 1996, the HIPAA Privacy Rule makes sure personal health information is protected, while also allowing it to be easily accessed for health care purposes, such as for a health insurance company to pay for treatments or a specialist to review as part of a care plan. As Elizabeth Turner, an attorney and nurse who teaches Health Ethics and Law at Regis, explains, HIPAA only applies to HIPAA-covered entities to maintain health information about individuals; and employers, colleges, and universities are not HIPAA-covered entities. She noted however that employers and schools do collect health information about their employees and students, and that information should be maintained with privacy considerations similar to those of HIPAA.

“Organizations can require individuals to have the COVID-19 vaccine, particularly in health care facilities, group homes, and other similar congregate patient settings,” Turner said. “Students living on a college campus create a similar congregate residential environment where a lot of people, who are not related, are in close quarters that could easily facilitate the spread of the virus.”

Regis College is allowing for medical and religious exemptions to the COVID-19 vaccine, which Turner explained is usually common practice for vaccine mandates in general, and the school is legally permitted to do so. But those who are exempt may still be asked to meet certain conditions intended to protect the Regis community and the public from the health risks, she added.

Both Brady and Turner explained that privacy laws do prohibit divulging extensive information about one’s vaccination status. Organizations and employers are allowed to ask if a person is vaccinated and to show proof is so, but they are not allowed to probe beyond that. For example, they may ask for proof of a medical or religious exemption, but they may not ask why a person simply refuses to be vaccinated.

“Employment laws do not prohibit a company from asking you to meet certain requirements to work,” Brady said. “We all have requirements for our jobs, whether it is working specific hours or lifting heavy objects. This is just another new job requirement to protect people from a deadly illness.”