Fact check: Businesses can legally ask if patrons have been vaccinated. HIPAA does not apply.

As mask-wearing and social distancing guidelines relax for fully vaccinated individuals, businesses are navigating how to implement new policies in their stores. Many businesses are ending mask requirements only for fully vaccinated customers.

Vaccine opponents, including Rep. Marjorie Taylor Greene, R-Ga., are using the occasion to resurrect the false claim that the HIPAA federal privacy law protects individuals from being asked about their vaccination status.

On May 18 several GOP members refused to wear masks on the House floor in defiance of House rules on mask-wearing, including Greene. When asked if she was vaccinated, Greene told reporters that asking about her vaccine status was a HIPAA violation.

Greene is not the only one spreading this false claim, which has spread widely on social media in recent days.

Alan Meisel, a professor of law and bioethics at the University of Pittsburgh, told USA TODAY at the time that HIPAA’s rules only apply to sharing information between “covered entities.” The U.S. Department of Health and Human Services describes covered entities as “health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically.”

“It in no way prohibits business owners and other individuals from asking people if they have been vaccinated,” he wrote in an email to USA TODAY. “In fact, it doesn’t even prohibit healthcare entities mentioned above from asking people if they have been vaccinated.”

More