The Do's And Don'ts Of Vaccination Documentation At Work

What HR professionals need to know

As the pandemic winds down and businesses are urging employees to return to in-person workplaces, there are many that are requiring their employees to be vaccinated. It’s not uncommon that some employers require specific health information under certain circumstances, and it’s not a violation of labor rights or HIPAA that employers require proof of vaccination.

According to the Equal Employment Opportunity Commission, an employer may ask, or even require that employees be vaccinated. There are a few exceptions such as disability and religious reasons. Employers can also ask for Covid-19 test results and bar employees from physically entering the workplace.

About 40 percent of companies currently require or plan to require all employees to be vaccinated, according to a survey by the World Economic Forum. Another 32 percent won’t require it, but will actively encourage their employees to get vaccinated, even providing incentives to do so.

In certain scenarios, vaccination documentation and test results are considered protected health information (PHI). Therefore, it needs to be filed with the same protections as any other sensitive employee health documentations.

It can be confusing for HR to understand what role they play in maintaining compliance with regulations as important and specific as HIPAA requires. For a basic understanding, HR is permitted to ask employees for documentation from their healthcare providers, but not go to the healthcare provider directly.

HR professionals should keep in mind that HIPAA’s rules require employers to take appropriate precautions to ensure that employee health records are kept confidential in every case. That means when working with PHI, HR must maintain strict confidentiality.

Knowing what practices to follow for sharing and storing PHI can be challenging. In the increasingly digital world, HIPAA provides some direction:

“As business practices and technology change, situations may arise where ePHI being transmitted from a covered entity would be at significant risk of being accessed by unauthorized entities. Where risk analysis shows such risk to be significant, a covered entity must encrypt those transmissions.”

Many of the traditional methods of sharing electronic information, like email or a hard drive, are likely not encrypted and will not be protected from unauthorized users. In a digital environment, this can be done in a compliant manner with encryption-protected document management.

A document management system (DMS) can be the solution to the complex file sharing challenges.

Any file containing PHI can be protected through encryption when stored on a DMS. Even when sharing the file among users, it can stay protected when shared through a secure file sharing portal. Email sends information through multiple unsecure networks. A DMS can invite a user to view a document on a single secure network.

A DMS can also provide an audit trail that shows every user that has accessed a document. If the integrity of the security measures are in question, it’s simple to view the audit trail to know each action that each user has taken with the document.

A DMS is the simplest way for HR to maintain compliance with HIPAA. HR can manage all their employees’ vaccine records on one simple, secure, and trustworthy system. They will never have to wonder if their system is maintaining compliance again.