Executive Summary: You don’t have any.
Let’s begin with to whom does HIPAA apply?
We call the entities that must follow the HIPAA regulations “covered entities.”
Covered entities include:
- Health Plans, including health insurance companies, HMOs, company health plans, and certain government programs that pay for health care, such as Medicare and Medicaid.
- Most Health Care Providers—those that conduct certain business electronically, such as electronically billing your health insurance—including most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists.
- Health Care Clearinghouses—entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa.
Also, companies that support healthcare services are covered under HIPAA:
Often, contractors, subcontractors, and other outside persons and companies that are not employees of a covered entity will need to have access to your health information when providing services to the covered entity. We call these entities “business associates.” Examples of business associates include:
- Companies that help your doctors get paid for providing health care, including billing companies and companies that process your health care claims
- Companies that help administer health plans
- People like outside lawyers, accountants, and IT specialists
- Companies that store or destroy medical records
Who is not covered under HIPAA? The answer is: EVERYONE ELSE.
Examples of organizations that do not have to follow the Privacy and Security Rules include:
- Life insurers
- Workers compensation carriers
- Most schools and school districts
- Many state agencies like child protective service agencies
- Most law enforcement agencies
- Many municipal offices
Can American Airlines ask if you are sick with Covid-19? Yes, they can. Can they require that you wear a mask as a requirement for flying on their plane? Yes, they can. Can they ask what medical condition you have that would prevent you from wearing a mask? Yes, they can. Why? Because they aren’t medical professionals so they’re not covered by HIPAA requirements.
One last word on HIPAA — can people employed as contact tracers legally give your medical information to people that may have been exposed to you if you tested positive for Covid-19? Yes, they can. Why? Because what the government giveth, the government taketh away. The government has implemented “enforcement flexibilities” to cover situations like this.
The other related law is the Americans with Disabilities Act. Can an airline, for example, ask what the disability is? Yes because they have to know that to make a “reasonable accommodation.” But you thought people with disabilities didn’t have to disclose their disability? That’s correct but it pertains to hiring employees. Does the person have to tell the airline their disability? No, because we all have freedom of speech — more or less — but it would be dumb not to give them some information if you expected the airline to provide additional services for you to make your travel easier.
Could you declare you have a disability and can’t wear a mask? Sure. Would it work? Well, maybe. In the case of an airline, they could take the position that this would create an unsafe condition on the flight and refuse to board you. I’m not a lawyer nor do I play one on the Internet but I’m pretty sure they’re well within their rights to maintain a healthy work environment for their employees and as well as doing everything they can to not jeopardize the health of passengers.
For those now ready to say “boy I can’t wait for the lawsuits!,” Airlines have a lot of money and individuals do not so there won’t be any lawsuits. If this was ever to happen, the Airlines, who also pay a lot of money to lobbyists for just this sort of thing, will simply have an “enforcement flexibility” memo issued and that will be that. “Rights” which are just lines in an agency guideline can be nullified at a moment’s notice particularly during Covid-19.
Well, I suppose we have to talk about the Styx video. I watched this at the behest of certain moderators who will remain nameless and I want my seven minutes and twenty seconds back! But here we go:
The first problem is that just because you say you have a disability doesn’t mean you have a disability under the ADA. There’s all sorts of litigation on this with one of the latest being obesity where the Fifth Circuit ruled that obesity does not qualify under the ADA. If you don’t really have a condition that keeps you from wearing a mask, you have no hope of winning any sort of court case.
Now to the issue of “they can’t ask about your disability.” Again, this only applies to employment. A business can most certainly ask and the disabled person can choose to tell the business as much or as little as they feel is necessary for an accommodation to occur. [Note] A business cannot ask for “proof of disability” and they have to take your word for it.
The real key here is that a business does not have to give a disabled person special rights but only to attempt to give them equal rights. An accommodation that Walmart could make is to say “we need to keep our employees safe and our customers safe but would you be willing to phone in an order and we’ll deliver it curbside?”
I suspect that most truly disabled persons have enough problems in the pandemic to be happy with finding a way to get what they need without worrying about suing Walmart. However, if Walmart offers several different accommodations and the customer declines all of them, Walmart is well within its rights to say “we can’t accommodate you in the way you’d like because that would create imminent harm to our employees and customers.” The customer could sue, I suppose, but I give them a one in a gazillion chance of winning this one!
So here’s my advice to the Walmarts of the world — if you believe masks are vital to keeping your employees and customers safe, then unapologetically mandate them. Should people claim to have a disability that prevents them from wearing one, use the same procedure you should use whenever anyone claims to require an accommodation. This isn’t because I believe masks do much good but I’m a “law and order” guy and if that’s the law, then so be it. Let’s use the ADA consistently and be done with it!
[Note: There is a special case where businesses cannot ask why you have a service animal.]