Is it legal for a massage therapist to ask a client if they have been vaccinated against COVID-19? There is more to this situation than checking off yes or no on an intake form.
We spoke with legal experts to bring you the full story and help you protect your health—while protecting your practice from a lawsuit.
The COVID-19 pandemic has created some concern about guidelines the massage therapy industry should follow —in particular, whether or not it is legal to ask clients about their vaccination status and to show proof of that status, and whether a massage therapist can deny service to an unvaccinated person.
“Anyone can ask,” says Abner E. Weintraub, a HIPAA consultant to businesses who works through Expert HIPAA in Spokane, Washington. “There is nothing against the rules, regulations or laws prohibiting a massage therapist or anyone from asking.”
HIPAA rules come into play when a health care provider decides to share clients’ or patients’ information or disclose it to another party, Weintraub said.
What HIPAA Rules Say
The Health Insurance Portability and Accountability Act, or HIPAA, was enacted into law in 1996. Essentially, the purpose behind the law was to develop a set of standards for the release, transmission and communication of protected health information, or PHI, explained Steven Boyne Esq., an attorney with Florida Healthcare Law Firm in Delray Beach, Florida.
PHI is patient records, which can include the patient’s or client’s name, Social Security number, and the billing information associated with their visits. HIPAA rules apply to those considered to be a “covered entity.”
Covered entities are divided into three groups: a health care provider, such as a doctor, clinician, psychologist, dentist or chiropractor; a health plan, such as an insurance company, HMO or government health plan; or a health care clearinghouse, such as a company that transmits data like electronic billing.
Are you, as a massage therapist, a covered entity? In general, massage therapists are required to comply with HIPAA rules only when they work for someone who is considered a health care provider, such as a physician or chiropractor. However, said Boyne, massage therapists in some states might be considered health care providers. So, to get an answer to this question, contact your state board of massage or an attorney.
You can also download HIPAA’s covered entity decision tool to help make this determination. Whether or not you are beholden to HIPAA rules, you do have to maintain client confidentiality as part of the massage profession’s ethical standards; additionally, having straightforward policies in place that you apply in a consistent manner will help protect you from legal action.
HIPAA applies to covered entities by means of its privacy rule, which prohibits sharing a client’s or patient’s protected health information with a third party, said Boyne. This includes both social media outlets and someone asking about the medical records of a client or patient who is over 18 years of age, including health care providers with no legitimate interest in or working relationship with the patient or client.
What HIPAA doesn’t do is prohibit a covered entity from asking questions of their clients or patients.
You Can Ask for Proof of Vaccination
“Hypothetically, if you’re an LMT and you’re defined as a covered entity, there is nothing illegal or wrong under HIPAA to ask the question, ‘Have you been vaccinated?’ and there is absolutely nothing wrong or illegal about asking them, ‘Can I see your card to prove that you are vaccinated?’, Boyne said. “And if they don’t want to provide it, then you’re well within your rights as an LMT to say, “I am not going to provide this massage.”
(Additionally, the client has the right to refuse to answer, noted Weintraub. “You want to remind people that federal law permits them to answer and permits them to refuse to answer if they so choose.”)
Situations involving people who are not covered entities—such as a camp counselor asking a parent if their child has allergies or about vaccination status—are not subject to the privacy rule of HIPAA.
“What we see in the press with reporters asking politicians if they are vaccinated and the response being, ‘You can’t ask me that because it is a HIPAA violation,’ is incorrect,” explained Boyne, “because the reporter asking that is not a covered entity and as such HIPAA doesn’t apply to them, period.” Likewise, if a massage therapist is not considered by HIPAA to be a covered entity, HIPAA rules do not apply to them either.
An exception is Florida, where an executive order issued by Gov. Ron DeSantis in April 2021 prohibits any business from requiring customers to provide any documentation certifying COVID-19 vaccination or post-transmission recovery to gain access to, entry upon or service from the business. And Montana’s Governor, Greg Gianforte, signed HB 702 into law in May, under which businesses cannot withhold goods from or refuse to serve any person based on their vaccination status. As of press time, 10 other U.S. states had passed laws regarding proof of vaccination, although not the same as Florida’s, according to the National Academy for State Health Policy, with some of those laws applying only to government entities, some addressing the employer-employee relationship, and some exempting health care organizations.
How to Approach a No-Vaccination, No-Service Policy
There are some things to consider before deciding you are not going to be open for business to people without vaccinations. Rolf Lowe, an attorney at Wachler & Associates PC, in Royal Oak, Michigan, suggests that if you create a vaccination policy, keep your questions to yes or no responses within your intake form when asking about vaccination status, as asking more can be problematic.
“I would advise against asking someone why they are not vaccinated, because then you’re opening up Pandora’s box,” said Lowe. “Someone may not be vaccinated due to a related health care condition or for religious reasons, and [asking about this] may possibly be considered at a later date to be a form of discrimination.”
Consideration should be given to allowing unvaccinated clients to alternatively provide a negative COVID test result,” Lowe added. Otherwise, he said, you’re opening up the door to possible litigation or to a possible complaint to an enforcement agency.
3 Risk-Management Steps You Must Take
Lowe said there are three risk-management components to apply when taking a no-vaccination, no-service stance.
First, he said, “You may be able to decline offering services, but you should seek out an attorney or look to your respective state board for guidance [when creating a policy]. While certain industries may have a stringent no-vaccination, no-service policy, as a [health care] practitioner, your obligation to provide services may come with a heightened scrutiny.”
Next, said Lowe, ask your state board what their guidance is on requiring proof of vaccination or COVID-19 test results before seeing a client.
Lastly, if you or your company become subject to negative comments on social media or online reviews, try not to react, said Lowe. “You just need to be prepared for the backlash that could happen when you take a stance such as not providing services to unvaccinated individuals—and you need to be careful with how you respond.”
For example, if the client refuses service, goes on social media and makes a statement against you for not treating them, you should not respond directly to that, Lowe said, because doing so could be a violation of disclosing confidential health information. (Again, though, you might not, as a massage therapist, be governed by HIPAA rules.) By eliciting a response from you, it is possible you may be laying the groundwork to having a complaint filed against you with your board, he explained. A better approach is to have a planned response like, ‘We appreciate your comments, and we take our clients’ concerns into consideration.’
The Delta variant is gaining ground, and nonvaccinated people make up the vast majority of people who are becoming infected with COVID-19. Creating a no-vaccination, no-service policy and enacting it in an ethical, consistent way can make all the difference for your massage practice during this contentious time, said Lowe, adding, “You don’t want to put your profession, and your ability to make a living off of it, in jeopardy.”
Disclaimer: This article does not substitute for legal advice.
Download a free massage intake form to help screen out COVID-19.
About the Author:
Aiyana Fraley, LMT, is a freelance writer and health care professional with more than 18 years of experience in the massage field. She teaches yoga and offers sessions in massage, Reiki, sound healing and essential oils. Her articles for MASSAGE Magazine include “Will I Get High?” Clear Up Client Misconceptions about CBD Massage” and “The NOPAIN Act Could Open the Door to Massage Therapy as an Alternative to Opioids.”