Federal regulators have issued clarifications on how certain federal laws apply in the context of COVID vaccines and protections at work.  Here are some specific updates published recently:

• FAQ Part 50 clarifies some important points
  • First, it clarifies that when formal recommendations were adopted December 12, 2020, to grant emergency use authorization of COVID-19 vaccines, that required non-grandfathered plans to cover all such vaccines in full without cost sharing since at least January 5, 2021 (15 business days following December 12, 2020).  All new or updated COVID-19 vaccine emergency use authorizations (EUAs), full approvals (such as with Pfizer for ages 16+), and booster shots since then must be covered immediately upon formal federal recommendation, not within 15 business days of each iterative update.
    • Regulators recognize this was not clearly expressed until now, so they will not enforce no-cost coverage which may not have been immediately available but may have taken some or all of the 15 business days following each successive recommendation.  They do expect immediately compliance on a go-forward basis, though.
  • Health plans cannot restrict or deny health plan eligibility or covered services based on vaccination status, but can impose wellness incentives aligned with HIPAA’s wellness plan rules.  These incentives can only be used toward premiums and/or cost-sharing.
    • The rules clarify this is treated as an “activity-only health-contingent wellness program.”
    • They also provide an example of how such a program can meet the five HIPAA wellness criteria in Q&A #3.
      • “The reward the plan provides in connection with the vaccine incentive program does not exceed 30 percent of the total cost of employee-only coverage and the opportunity to qualify is offered annually. The plan provides a reasonable alternative standard to qualify for the reward, in this case the opportunity to attest to complying with the CDC’s mask guidelines, to individuals for whom it is unreasonably difficult due to a medical condition or medically inadvisable to obtain a COVID-19 vaccination, and the plan provides notice of the availability of the reasonable alternative standard. This program is also reasonably designed to promote health and prevent disease (and is not a subterfuge for discriminating based on a health factor), as the program rewards individuals who obtain a COVID-19 vaccination, while the reasonable alternative standard is not overly burdensome, and is also designed to prevent infection with SARS-CoV-2, the virus that causes COVID-19. Further, the plan’s maintenance of a toll-free hotline to provide information about the COVID-19 vaccine and assistance with meeting the underlying standard (in this case, receiving a COVID-19 vaccination or fulfilling the reasonable alternative) are additional facts and circumstances demonstrating that the program is reasonably designed to promote health or prevent disease because they help ensure that the program is not overly burdensome.”
  • They conclude with a reminder that applicable large employers (ALEs) must determine affordability under the single rate charged when the employee  does not qualify to earn the incentive.  Only incentives tied solely to tobacco status may be used in favor of affordability calculations.
    • “Premium incentives other than incentives relating exclusively to tobacco use, including wellness programs encouraging vaccinations for COVID-19, are treated as not earned when determining the employee’s required contribution for an offer of health coverage under 26 CFR 1.36B2(c)(3)(v)(A)(4).”
• An additional set of FAQs addresses misconceptions about HIPAA and vaccination status in a business environment
  • HIPAA only dictates how a health care provider or health plan (and their “business associates”) may use or disclose protected health information (PHI).  There are specific situations in which they are authorized to disclose PHI, but they are very restrictive and are reiterated in these FAQs.
  • In light of that foundation, HIPAA has no bearing on whether a business can ask its employees, customers, clients, patients, vendors, or other individuals about their vaccination status.  It would not allow the business to request this information from the person’s health plan or health care provider without that person’s express authorization, but the business can ask anyone directly about their vaccination status and HIPAA has no part in such a request.
  • Businesses can also require their employees “to provide documentation of their vaccination against COVID-19 or to disclose whether they have been vaccinated to their employer, other workforce members, patients, or members of the public.”
  • As always, anyone in receipt of medical information must keep it strictly confidential and ensure it’s maintained separate from employment records.  HIPAA is not the only law governing privacy, security, and confidentiality.

IMA will continue to monitor regulator guidance and offer meaningful, practical, timely information.

This material should not be considered as a substitute for legal, tax and/or actuarial advice. Contact the appropriate professional counsel for such matters. These materials are not exhaustive and are subject to possible changes in applicable laws, rules, and regulations and their interpretations.