On September 30, 2021, OCR announced the issuance of guidance explaining how the HIPAA Privacy Rule applies to requests for information on COVID-19 vaccination status in the workplace. The guidance reiterated that the HIPAA Privacy Rule applies to covered entities and business associates and regulates their use and disclosure of protected health information, but not their ability to ask patients or visitors about vaccination status. HIPAA likewise does not apply to employers or employment records or regulate employers’ ability to request information about vaccination status. The guidance provides scenarios and answers.