Q: Is it against HIPPA law for a company to circulate names on a list for getting Covid-19 vaccines?

A: Poor practice on the company's part, maybe, but I don't see this rising to a HIPPA violation. What personal health information is being disclosed other than someone having signed up for a timeslot, and an inference that those persons will now be vaccinated? Your point is well taken that steps should have and could have been taken by the company so that employees could still sign up without knowing when and if others have.

A: This may be helpful.

HIPAA generally does not apply to a company unless they are a 'covered entity', 'affiliated business', or information acquired through a group health plan. And it is possible there is some overlap between the company and clinic, where the company conceivably could be an 'affiliated business' or where the vaccine is being administered through the group health plan. And some persons at the employer would still need to know otherwise protected health information, even through the group health plan. But that doesn't mean a HIPAA violation has occurred in this situation.

According to the HHS.

“Individually identifiable health information” is information, including demographic data, that relates to, the individual’s past, present or future physical or mental health or condition, the provision of health care to the individual, or the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual.