On Friday, May 14th, 2021, the Michigan Department of Health and Human Services (MDHHS) modified its existing regulations regarding mandatory efforts to reduce the spread of the COVID-19 virus to exempt from its requirements “fully vaccinated” individuals. This change took effect on May 15, 2021 at 9:00 a.m. This relaxing of the Michigan mask rule was expected following updated guidance from the Centers for Disease Control and Prevention (CDC) recommending this change. However, this new change has raised many questions about its implementation.
What does “fully vaccinated” mean?
The CDC says that an individual is to be considered “fully vaccinated” against COVID-19 two weeks after they received their single-dose vaccine (e.g. Johnson & Johnson’s Janssen vaccine) or the second of two-dose series (e.g. Pfizer or Moderna vaccines).
What is a business’s obligation to confirm vaccination status for unmasked individuals?
The revised rule does not contain detailed guidance regarding a business’s obligation to confirm vaccination status prior to allowing unmasked visitors or employees on its premises. Rather, the rule indicates that the businesses must make a “good faith effort” to confirm that an unmasked person meets an exemption from the mask requirement under the rule. This language is not new; previously businesses were required to make a “good faith effort” that an unmasked person met an exemption. The difference now is that, while the exemptions contained in the rule prior to this recent relaxation were conditions that businesses could typically determine from observation (i.e. the individual was eating, swimming, obtaining medical treatment for which removal of a mask is necessary, etc.), vaccination status cannot be as easily determined. However, under the current rule, the examples of a “good faith effort” include, but are not limited to, posting a sign on the business premises indicating that those who do not meet an exemption, including the exemption with regard to vaccination status, must wear a mask, or it could mean asking individuals to confirm their vaccination status – verbally or in writing.
If I want someone to prove their vaccination status with a copy of their vaccination record prior to entering my business mask free, can I?
Yes, you can, and that includes for employees as well, not just members of the public. This is certainly within the range of “good faith effort” required by the MDHHS rule change, though it is not required.
Certainly complicating this the question of how a business should proceed in light of the new exemption is that vaccination status, being medical information, is Protected Health Information (“PHI”) under the Heath Insurance Portability and Accountability Act (HIPAA). The definition of PHI is very broad: PHI is any information in the medical record or designated record set that can be used to identify an individual and that was created, used, or disclosed in the course of providing a health care service such as diagnosis or treatment. This would include evidence of vaccination status.
Under HIPAA, PHI must not be used or disclosed except as permitted by the HIPAA privacy rule or as authorized by the patient in writing. There are several grounds on which HIPAA-protected PHI can be utilized by a business that do not require consent patient consent though. If businesses wish to collect vaccination status, they would likely meet either the “Required by Law” exemption and/or the “Public Health Activities” exemption, which allows covered entities to use or disclose PHI to comply with state or federal law or court order (with regard to the former exemption) or to comply with public health needs, generally (with regard to the latter exemption. However, if a business anticipates storing or maintain PHI for the purpose of repeated mask-free access by fully vaccinated members of the public (or employees), the best course would to simply require the person sign an authorization for such use, which obviates the need to meet an exemption under HIPAA.
Even if a business is comfortable with the safety of the vaccine information status in their process, they may not practically be able to check status in real time, or such checks could impose an onerous burden on them. For example, in a large department store or grocery store, it would be difficult for businesses to check the vaccination status of individuals entering their stores in real time. Accordingly, and understandably, many of these business have simply opted to continue their current requirements that all individuals entering their premises wear masks and this would be the recommended stance for larger entities or those where checking individual status is not feasible. Stores such as Meijer, Kroger, and Target have indicated that they are maintaining their current policy, at least for now.
The updated the MDHHS epidemic rule can be accessed here.
If you have any questions about your or your businesses rights or obligations under the revised MDHHS rule, contact business and employment attorney Jennifer Gross at jennifer@crlaw.biz or at (810) 227-3103 ext. 114.
