SYRACUSE, N.Y. (WSYR-TV) — A healthcare attorney tells NEWS10’s sister station in Syracuse that it does not violate HIPAA for a business to ask its customers or employees for their vaccination status.

HIPAA, which stands for Health Insurance Portability and Accountability Act, strictly applies to healthcare providers and related industries. Examples include hospitals, doctors, nursing homes, insurance companies and billing agencies.

“Other types of entities, like restaurants, like this law firm, like the grocery store, are not HIPAA-covered entities under the HIPAA law and their actions are generally not governed by HIPAA,” explains healthcare attorney Maureen McGlynn with CCB Law in Syracuse.

McGlynn says she routinely gets calls from people who think their HIPAA rights were violated but weren’t. “I think it is misunderstood,” she says.

McGlynn’s legal explanation corrects inaccurate accusations people on social media made against a cafe and candy shop in Auburn, accusing the owners of a HIPAA violation when requiring proof of vaccinations to eat or drink inside their business.

The owners made clear people who are not vaccinated are welcome to take their order to tables outside or take the food to-go.

Employment lawyer Laura Spring with CCB Law adds that employers are bound by additional privacy restrictions, but vaccines are not covered.

“Under anti-discrimination laws, you cannot ask employees about their medical conditions and asking whether they’ve been vaccinated is not a medical-related inquiry,” says Spring.

When it comes to asking for vaccine status or requiring vaccines, employers do have to follow federal and state-ordered exemptions.

Spring adds, “If someone has a medical disability or they have a religious preference, then the employer is under an obligation to see if they can accommodate that issue.”