Mask mandate for unvaccinated employees and privacy

Question

Is it legal for an employer such as a public school (in the US) to impose a mask mandate on only unvaccinated employees, or would that be a violation of those employees ADA or HIPPA rights? It seems like an employee could easily claim they are singled out be being required to wear a mask.

Answer 1

ADA is about "disabilities", and not being vaccinated is not a disability under the law.

Applicability of HIPAA is very complex and unclear. The Privacy Rule refers to and restricts the actions of Covered Entities. Healthcare providers and insurance companies are Covered Entities. The regulation 45 CFR 160.103 defines "covered entity" as

(1) A health plan.

(2) A health care clearinghouse.

(3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter

45 CFR 164.512 lists instances where authorization to disclose is not required, saying that "A covered entity may use or disclose protected health information without the written authorization of the individual". The employer is not likely to be a "covered entity", so these permissions are irrelevant. Furthermore, included in this section is a provision where disclosure is allowed in the case of

(v) An employer, about an individual who is a member of the workforce of the employer

with various conditions following such as

(A) The covered entity is a covered health care provider who provides health care to the individual at the request of the employer:

(1) To conduct an evaluation relating to medical surveillance of the workplace; or

(2) To evaluate whether the individual has a work-related illness or injury

However, these permissions apply to covered entities, not employers. ("Work-related" is not defined, but having a dangerous contagious disease does clearly relate to the workplace, thus it would be reasonable but not guaranteed to consider such a disclosure to be connectable to this section).

45 CFR 164.510 says that

A covered entity may use or disclose protected health information, provided that the individual is informed in advance of the use or disclosure and has the opportunity to agree to or prohibit or restrict the use or disclosure, in accordance with the applicable requirements of this section

§508, covering required authorization ("explicit yes") says

Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section.

There is no applicable provision whereby the proposed employer policy would clearly expose the employer to legal sanctions, since HIPAA does not purport to regulate everybody, only those entities where Congress authorized it to do so, via the concept of a "covered entity".

Furthermore, the employer is not directly revealing any personal medical information: the employee (the other employee) is. A vaccinated employee is allowed to wear a sticker that says "I was vaccinated". An imaginable application of HIPAA to vaccinated employees would be a policy of requiring a vaccinated employee to advertise that they were vaccinated.

One can reasonably guess that a person who does not wear a mask, given such a policy, has been vaccinated, but it is not a reasonable inference that a person who wears a mask has not been vaccinated (many vaccinated people continue to wear masks out of an abundance of caution). There is no legal basis for penalizing an employer who allows vaccinated employees to do things that weakly suggest that other employees have not been vaccinated.