On Oct. 4, 2021, the Department of Labor (DOL), Health and Human Services (HHS) and the Treasury issued FAQs addressing rules regarding premium incentives for COVID-19 vaccines and rapid coverage of preventive services for COVID-19.
Premium Discounts for COVID-19 Vaccines
The FAQs clarify that a group health plan (or health insurance issuer offering coverage in connection with a group health plan) may offer participants a premium discount for receiving a COVID-19 vaccine. However, plans generally may not condition eligibility for benefits or coverage on vaccination status, and any discount must comply with final wellness program rules.
Under these rules, a premium discount that requires an individual to obtain a COVID-19 vaccine would be considered an activity-only wellness program, which is a type of health-contingent wellness program. These programs must comply with the rules’ five nondiscrimination criteria, including an incentive limit and requirement to offer an alternative standard in some cases.
The maximum permissible reward (or penalty) under a health-contingent wellness program that is part of a group health plan (and is not related to tobacco use) is 30% of the cost of coverage.
Preventive Services Coverage for COVID-19
Effective Jan. 5, 2021, plans and issuers must cover, without cost-sharing, any COVID-19 vaccines and their administration immediately once the particular vaccine becomes authorized under an emergency use authorization (EUA) or approved under a biologics license application (BLA). This coverage must be provided consistent with the scope of the EUA or BLA, including any amendment, to allow for an additional dose to certain individuals, booster doses or the expansion of the age for whom the vaccine is authorized or approved.
HIPAA Privacy Rule and COVID-19 Vaccine Inquiries
On Sept. 30, 2021, HHS issued FAQs on the application of the HIPAA Privacy Rule on COVID-19 vaccination and the workplace.
Overview of the FAQ Guidance
The HIPAA Privacy Rule does not prohibit any person—including HIPAA-covered entities and business associates—from asking whether an individual has received a COVID-19 vaccine. Rather, the Privacy Rule regulates how and when a covered entity or its business associate may use or disclose protected health information (PHI), including an individual’s vaccination status.
The Privacy Rule does not prevent any individual from disclosing whether he or she has been vaccinated against COVID-19 or any other disease. The Privacy Rule does not apply to individuals’ disclosures about their own health information.
Additionally, the Privacy Rule does not prohibit an employer from requiring an employee to disclose whether they have received a COVID-19 vaccine. The Privacy Rule does not apply to employment records and does not regulate what information can be requested from employees. However, documentation or other confirmation of vaccination must be kept confidential and stored separately from the employee’s personnel files under Title I of the ADA. Note that other federal or state laws do address these requests and disclosures. (pdf)
