Fact-check: Is it legal for businesses to ask patrons their vaccination status?

Restrictions depend on whether it’s a red or blue state, but some businesses suffer when they ask customers personal questions.

When Georgia Republican Rep. Marjorie Taylor Greene refused to answer a journalist’s question on Tuesday about whether she had been vaccinated against COVID-19, the incident triggered a storm of questions about whether and when it is legal to ask others to reveal personal medical information. Is it legal for businesses to ask vendors about their vaccination status?Greene said the question from the journalist was a “violation of my HIPAA rights” – referring to the 1995 Health Insurance Portability and Accountability Act implemented to protect individuals’ personal health information while allowing it to flow when necessary.

“You see with HIPAA rights we don’t have to reveal our medical records and that also includes our vaccine records,” said Greene.

However, HIPAA applies only to healthcare-related businesses (including insurance and medical providers) and not to journalists asking questions, though Greene was well within her rights to refuse to answer the question.

‘Fact checkers’

The response triggered a media firestorm from Twitter, Snopes, USA Today, and CNN, all pointing out Greene’s legal error. Twitter did not just refute the HIPAA statement but made its own claim that “Businesses can ask customers if they are vaccinated against COVID-19 without fearing legal repercussions, according to legal experts and fact-checkers.”

There is a legal difference between a journalist asking a question to a politician and a business asking a question to a prospective customer to determine if he or she will be served, however.

Red state, blue state

On this point, Twitter gets the law wrong. In at least 19 states, where proof-of-vaccination requirements ­­­­­­­­­­– c­­­­ommonly known as “vaccine passports” – are prohibited, businesses are not allowed to discriminate on the basis of whether someone has received an experimental shot or not.

In April, Florida Governor Ron DeSantis (R) issued an executive order banning businesses from refusing unvaccinated people service or entry to an event. The order highlights that “individual COVID-19 vaccination records are private health information which should not be shared by mandate” and that “so-called COVID-19 vaccine passports reduce individual freedom and will harm patient privacy.” It prohibits Florida businesses from “requiring patrons or customers to provide any documentation certifying COVID-19 vaccination or post-transmission recovery, to gain access to, entry upon, or service from the business.”

A week later, Texas Republican Governor Greg Abbott issued a similar executive order and declared later in June 2021 that he was “signing a law today that prohibits any business operating in Texas from requiring vaccine passports or any vaccine information.”

Nine more governors followed suit and in eight states, legislators passed laws banning proof-of-vaccination requirements bringing the total to 19 states, all with Republican governors, where businesses don’t have the right to discriminate against customers based on their vaccination status. This would mean business don’t have a right to ask about vaccination status, or at least patrons are by law not required to answer.

Alaska Governor Mike Dunleavy (R) issued an executive order prohibiting state government offices from requiring “any person to produce their personal vaccine history…in order to travel to, or around, Alaska” but stopped short of preventing “private businesses” from doing the same, however.

Medical privacy is not so protected in Democrat-run states, however. Four –California, New York, Hawaii, and Oregon – smoothed the way for the use of digital vaccine passports, like New York’s Excelsior Pass, which impose restrictions on unvaccinated individuals while exempting others from COVID restrictions if they provide vaccine documentation.

Businesses can’t just refuse service

Even in these situations in blue states, businesses cannot deny service to people based on vaccination status. “Subject to state laws, businesses can ask for customers to demonstrate proof of vaccination, but – due to laws such as the Americans with Disabilities Act (ADA) – they cannot flatly refuse to provide a service to the customer if they cannot prove their vaccination status,” said LifeSite Vice President Gualberto Garcia Jones, a legal expert on human rights issues.

Businesses must try to accommodate a customer who has not been vaccinated or refused to disclose vaccination status, Garcia Jones added. For example, they can “require the customer to wear a mask or can organize an outside delivery of their purchase.” This would apply to services in venues such as concerts as well.

“If the customer refuses to agree to the compromise, businesses can then refuse to provide a service on health and safety grounds,” Garcia Jones said.

“Due to civil rights laws, smart businesses will not inquire with their customers about medical information unless it is necessary to providing their product or service in question,” Greg Glaser, General Counsel for Physicians for Informed Consent, told LifeSiteNews.

“For example, in California, the Unruh Act prevents businesses from unlawfully discriminating against individuals based upon ‘medical condition.’ So any medical condition information that the business unnecessarily gathers from its customers can be used against the business in a discrimination case, where plaintiffs can recover damages, [statutory] fines, and attorney fees. Similarly, customers can assert violation of privacy claims as well that allow plaintiffs’ lawyers to probe the operating systems and data storage practices of the business in question.”

Vaccine-checking businesses lose

In Florida, however, businesses face fines up to $5,000 for each customer whose legal rights are breached. The ban has made it illegal for cruise ships harboring in the state’s ports to recognize vaccine passports for the unvaccinated.

Some cruise lines including Carnival and Royal Caribbean have been skirting the law – requiring unvaccinated passengers to undergo testing, to pay higher insurance fees, and restricting where they can go. It is difficult to see how this can be done without illegally demanding vaccination documentation. Norwegian Cruise Lines is suing the state of Florida to have the ban lifted altogether.

It is not clear that inquiring of customers’ vaccination status is at all profitable, however. In Canada, a Toronto lawyer set up a website a week ago featuring restaurants and venues that required vaccination of all their staff and customers. Restaurant Chantecler, featured on the website, reportedly lost business for its policy that questioned customers’ vaccine status: reservations were cancelled and people posted negative reviews for its “segregation” policy and “support [of] a totalitarian regime.” The website featuring the restaurant was taken down just days after it launched as other businesses it advertised suffered losses.