The Washington Post weighs in in the limited scope of HIPAA as it relates to vaccination status:

"Citing HIPAA as a reason to not disclose vaccination status is often a 'knee-jerk reaction' that 'quickly gets turned into a statement that sounds like law.' People sometimes say, 'But I have a right not to be asked that question, and it's just not the case.'

"Here's what experts say you need to know about the law.

"HIPAA, also known as the Health Insurance Portability and Accountability Act of 1996, and its subsequently added Privacy Rule include provisions to protect a person's identifying health information from being shared without their knowledge or consent. The law, though, only applies to specific health-related entities, such as insurance providers, health-care clearinghouses, health-care providers and their business associates.

"That means that even if your friend, favorite restaurant or grocery store were to publicly share private details about your health, they would not be in violation of HIPAA because they aren't one of the 'covered entities.' There are other federal and state confidentiality laws that may require employers and schools to protect your privacy. And, experts emphasized, there is nothing in HIPAA that bars asking people about their health — including vaccination status — or requiring proof that the information is accurate.

"HIPPA has become one of the 'most misunderstood statutes in existence,' said Glenn Cohen, a Harvard Law School professor who is an expert on health law and bioethics. 'People think it does a lot more than it's actually doing.'"

HIPAA is not shorthand for privacy.