Attachment 5 - Privacy ASL(002).pdf

Attachment 5

Privacy Requirements

Under this guidance memorandum, the DoD may collect and maintain sensitive and private information about individuals, including medical information.

Consistent with the Religious Freedom Restoration Act of 1993, 42 U.S.C. § 2000bb et seq., and Title VII of the Civil Rights Act, 42 U.S.C. § 2000e et seq., individuals seeking a religious exemption from the vaccination requirement will submit to DoD supporting information about their religious beliefs and practices in order for DoD to evaluate the exemption request. Information collected from individuals under this guidance, including vaccination information, test results, and medical or religious information supporting vaccine exemption requests, will be treated in accordance with applicable laws and policies on privacy, including the Privacy Act of 1974, 5 U.S.C. § 552a, and Department of Defense Instruction (DoDI) 5400.11, "DoD Privacy and Civil Liberties Programs," January 29, 2019 (reference (n)), the Rehabilitation Act of 1973, as amended ("Rehabilitation Act"), 29 U.S.C. § 791 et seq., and 5 CFR part 293, subpart E. While such information may be sensitive and is to be safeguarded, it is not covered by the Health Insurance Portability and Accountability Act (HIPAA) regulations found at 45 CFR parts 160, 162, and 164, and as implemented in DoDI 6025.18, "Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs," and DoD Manual 6025.18, "Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule in DOD Health Care Programs."

Information gathered under this guidance may be shared with immediate supervisors, authorized human resources officials, designated decision makers, and, in appropriate cases, subject matter experts, who must access the information to implement the guidance. DoD Components are advised to consult their Component Privacy Officer and servicing legal office if there is a need to share medical or religious information collected under this guidance with DoD personnel beyond what this guidance permits or with individuals outside of DoD. Religious information will be accessible only to those persons who have a role in carrying out the procedures outlined in this memorandum. Medical information obtained from DoD civilian employees, including vaccination status, will be accessible only to immediate supervisors, authorized human resources officials, and, for exemption requests, designated decision makers and subject matter experts, who must access the information to implement the guidance in this memorandum. The Rehabilitation Act's requirements on confidentiality of medical information apply whether or not a DoD civilian employee has a disability.

DoD personnel will use appropriate safeguards in handling and storing DoD civilian employee medical information, including a DoD civilian employee's proof of vaccination, the DD Form 3175, COVID-19 test results, and exemption requests.

Appropriate safeguards may include encrypting emails and electronic files, and role-based access to electronic storage environments where this information is maintained. In the event the information is maintained in paper form, supervisors and other authorized DoD personnel must ensure DoD civilian employee medical information remains confidential and is maintained separately from other personnel files (e.g., stored in a separate, sealed envelope marked as confidential DoD civilian employee medical information and maintained in locked file cabinets or a secured room). DoD Components are advised to refer to applicable internal guidance on the handling, storage, and disposition of DoD civilian employee medical records, and to consult their Component Privacy Officer as needed for further guidance.