Could a Texas school district give extra COVID paid leave only to vaccinated employees?

Plain-English summary

Senator Paul Bettencourt asked the AG about a Houston Independent School District (HISD) policy that made up to 10 days of extra, COVID-19-specific paid leave (beyond regular sick leave) available only to employees who were vaccinated for COVID-19 or who were medically exempt. To qualify, an employee had to submit proof of vaccination or medical exemption; unvaccinated employees had to use their personal leave to isolate. The Senator asked four questions: whether the policy violated Executive Order GA-39, whether it amounted to a "vaccine passport" under state law, and whether it violated employee medical-privacy rights under HIPAA or the Texas Medical Records Privacy Act.

On GA-39, the AG concluded the policy violates the order. The Governor's COVID-19 disaster declaration authorized him to issue executive orders with the force of law (Government Code section 418.012). Executive Order GA-39 (August 2021) prohibits state agencies and political subdivisions from adopting any policy that requires an individual to provide, "as a condition of receiving any service or entering any place, documentation regarding the individual's vaccination status for any COVID-19 vaccine." The AG read "individual" to include an employee and "service" broadly enough to cover an employer-provided benefit, so conditioning extra paid leave on proof of vaccination or exemption violates the order. The AG assumed without deciding that GA-39 is valid, because the office does not opine on matters known to be in pending litigation, and several suits over the COVID executive orders were pending (citing In re Abbott).

On the "vaccine passport" question, the AG turned to Health and Safety Code section 161.0085, added by Senate Bill 968. Using the noscitur a sociis canon (a word is known by its associates), the AG concluded that "vaccine passport" includes any standardized documentation certifying COVID-19 vaccination status, including the proof HISD required. Section 161.0085(b) prohibits a government entity from issuing such documentation to certify a person's status to a third party, or otherwise sharing it, for a purpose other than health care. Because using the documentation for a paid-leave policy is an employment matter, not health care, HISD may not issue or share it for that policy, and another government entity may not issue an employee's immunization record to HISD for that purpose. The AG noted that subsection 161.0085(b) does not address whether a government entity may require a person to submit a vaccine passport to the entity itself; by contrast, subsection 161.0085(c) clearly bars a business from requiring such documentation from a customer.

On privacy, the AG separated the two laws. HIPAA's Privacy Rule applies only to "covered entities," defined as health plans, health care providers, health care clearinghouses, and their business associates (45 C.F.R. sections 160.102, 160.103). Because HISD is not its employees' health care provider, health plan, or clearinghouse, it is not a covered entity, so its leave policy would not violate employees' HIPAA rights as to HISD, although vaccination status a school receives likely qualifies as "protected health information." The Texas Medical Records Privacy Act (TMRPA) is different: it defines "covered entity" more broadly to include "any person" who handles protected health information, expressly including a "school" (section 181.001(b)(2)). So HISD would likely be a TMRPA covered entity and must comply with that Act's limits on using, disclosing, selling, or reidentifying protected health information. But the AG concluded the leave policy does not on its face violate TMRPA, because the facts provided did not show a violation, and the AG flagged two fact-bound exceptions (the employee-benefit-plan carve-out in section 181.055(2) and the employer exemption in section 181.051) without deciding whether they apply.

What this means for you

If you run a Texas school district or other political subdivision

Based on this opinion, conditioning a benefit like extra COVID-19 paid leave on an employee's proof of vaccination or medical exemption violated Executive Order GA-39 as the AG read it. The AG also concluded that a government entity may not issue or share standardized vaccination documentation for a non-health-care purpose such as an employment policy under Health and Safety Code section 161.0085(b). The opinion is specific to GA-39 (which the AG assumed valid amid pending litigation) and to the facts of HISD's policy.

If you are a public employee affected by such a policy

The opinion concluded the HISD policy ran afoul of GA-39 and that the vaccination documentation it required is a "vaccine passport" a government entity may not share for an employment purpose. On medical privacy, the AG found HISD is not a HIPAA covered entity but is likely a covered entity under the Texas Medical Records Privacy Act, which limits how it may use and disclose protected health information.

If you advise public employers on privacy compliance

The AG treats HIPAA and TMRPA differently: a school district is generally not a HIPAA covered entity, but TMRPA's broader definition expressly includes schools. The opinion did not find a facial TMRPA violation and left the employee-benefit-plan (section 181.055(2)) and employer (section 181.051) exceptions as fact questions.

Common questions

Q: Could HISD give extra COVID paid leave only to vaccinated or exempt employees?
A: The AG concluded that policy violated Executive Order GA-39, which bars political subdivisions from requiring documentation of vaccination status as a condition of any service, read to include an employment benefit.

Q: Is requiring proof of vaccination a "vaccine passport"?
A: Yes. The AG concluded any standardized documentation certifying COVID-19 vaccination status is a vaccine passport under Health and Safety Code section 161.0085, including the proof HISD required.

Q: Can a government entity share vaccination documentation for an employment policy?
A: No. Section 161.0085(b) bars a government entity from issuing or sharing such documentation to a third party for a purpose other than health care, and the AG treated an employment matter as a non-health-care purpose.

Q: Did the policy violate HIPAA?
A: The AG said HIPAA's Privacy Rule applies only to covered entities (health plans, providers, clearinghouses). HISD is not one, so the policy would not violate employees' HIPAA rights as to HISD, though the vaccination status is likely protected health information.

Q: What about the Texas Medical Records Privacy Act?
A: HISD is likely a covered entity under TMRPA, which expressly includes schools, and must comply with it. But the AG did not find a facial violation on the facts presented.

Background and statutory framework

The Governor's March 2020 COVID-19 disaster declaration (Proclamation 41-3720) triggered his authority to issue executive orders with the force of law (Government Code section 418.012). Executive Order GA-39 (August 25, 2021) prohibits state agencies and political subdivisions from requiring an individual to provide documentation of COVID-19 vaccination status as a condition of receiving any service or entering any place. Reading "individual" to include employees and "service" to include an employer-provided benefit, the AG concluded HISD's leave policy violated GA-39, while assuming the order's validity without deciding it because of pending litigation (In re Abbott; KP-0382; GA-0502).

Senate Bill 968 added Health and Safety Code section 161.0085. Applying noscitur a sociis (Greater Houston P'ship v. Paxton; TGS-NOPEC Geophysical Co. v. Combs), the AG read "vaccine passport" to include any standardized documentation certifying vaccination status. Subsection 161.0085(b) bars a government entity from issuing or sharing such documentation to a third party for a non-health-care purpose; subsection 161.0085(c) bars a business from requiring it from a customer (with "business" given its ordinary meaning per Jaster v. Comet II Constr., Inc.). The AG noted subsection (b) does not address a government entity requiring submission to itself.

On privacy, the HIPAA Privacy Rule applies only to covered entities (45 C.F.R. sections 160.102, 160.103), which HISD is not, so the policy would not violate HIPAA as to HISD, though vaccination status received by a school is likely protected health information. The Texas Medical Records Privacy Act defines covered entity broadly to include "any person" handling protected health information, expressly including a school (section 181.001(b)(2)), so HISD would likely be covered and must comply with the Act's limits (sections 181.151-.154, .101-.102). The AG found no facial TMRPA violation and left the employee-benefit-plan (section 181.055(2)) and employer (section 181.051) exceptions as fact questions (KP-0231).

Citations and references

Executive order and statutes:

• Executive Order GA-39 (2021) (no political subdivision may require documentation of COVID-19 vaccination status for service or entry)
• Tex. Health & Safety Code § 161.0085 (vaccine passport prohibition)
• Tex. Health & Safety Code §§ 181.001-.207 (Texas Medical Records Privacy Act; "covered entity" includes a school)
• HIPAA, Pub. L. No. 104-191; 45 C.F.R. pts. 160 & 164 (Privacy Rule applies only to covered entities)

Key cases:

• Greater Houston P'ship v. Paxton, 468 S.W.3d 51 (Tex. 2015) (noscitur a sociis)
• Jaster v. Comet II Constr., Inc., 438 S.W.3d 556 (Tex. 2014) (undefined words get their common, ordinary meaning)
• In re Abbott, No. 21-0720 (Tex. filed Aug. 23, 2021) (pending litigation over COVID executive orders)

Source

• Landing page: https://www.texasattorneygeneral.gov/opinions/ken-paxton/kp-0403
• Original PDF: https://www.texasattorneygeneral.gov/sites/default/files/opinion-files/opinion/2022/kp-0403.pdf

Original opinion text

April 14, 2022

The Honorable Paul Bettencourt
Chair, Senate Committee on Local Government
Texas State Senate
Post Office Box 12068
Austin, Texas 78711-2068

Opinion No. KP-0403

Re: Whether a school district may implement a policy making additional leave available to employees who are vaccinated for COVID-19 or medically exempt from the vaccination (RQ-0427-KP)

Dear Senator Bettencourt:

You ask whether a school district's leave policy constitutes a "vaccine passport" and whether it violates certain provisions of state and federal law or Executive Order GA-39.¹

You tell us the governing body of the Houston Independent School District ("HISD") recently adopted a policy that would make available only to vaccinated employees, and those medically unable to be vaccinated, "additional, COVID-19-specific paid leave—above and beyond the regular sick leave included as an employee benefit." Request Letter at 1. You refer us to HISD's statement on the leave policy, which explains that the leave would consist of up to 10 days of paid leave for the 2021-2022 school year. Id.² To qualify, an employee would be required to submit proof of vaccination or medical exemption. HISD Plan at 14. Unvaccinated employees would be required to use their personal leave to isolate due to COVID-19. Id. You ask four questions related to this policy. Because your fourth question is dispositive as to your remaining inquiries, we address it first.

¹ See Letter from Honorable Paul Bettencourt, Chair, Sen. Comm. on Loc. Gov't, to Honorable Ken Paxton, Tex. Att'y Gen. at 1-2 (Aug. 26, 2021), https://www2.texasattorneygeneral.gov/opinions/opinions/51paxton/rq/2021/pdf/RQ0427KP.pdf ("Request Letter").

² HISD 2021-2022 Back to School Plan, Ready Set Go, https://www.houstonisd.org/readysetgo ("HISD Plan"), see also HISD Board of Education Meeting Agenda Packet (Aug. 19, 2021) at 8 (noting that eligibility "is contingent upon demonstration that the absences are due to COVID-19 exposure, symptoms, infection, and related factors").

I. By offering additional paid leave only to those employees showing proof of COVID-19 vaccination or a medical exemption, the HISD COVID-19 paid leave policy violates Executive Order GA-39.

You ask whether HISD's COVID-19 paid leave policy would violate Executive Order GA-39. Request Letter at 1-2. The Governor declared a state of disaster in Texas due to COVID-19 on March 13, 2020, and that declaration is ongoing.³ Office of the Governor, Proclamation 41-3720, 45 Tex. Reg. 2094 (2020). The Legislature authorized the Governor, upon declaring a disaster, to "issue executive orders, proclamations, and regulations and amend or rescind them." TEX. GOV'T CODE § 418.012. The Governor's executive orders issued pursuant to his emergency powers under chapter 418 of the Government Code "have the force and effect of law."⁴ Id.

Relevant to your question, the Governor issued Executive Order GA-39 on August 25, 2021.⁵ That order expressly prohibits state agencies and political subdivisions from requiring any documentation regarding a person's COVID-19 vaccination status for entry or services:

State agencies and political subdivisions shall not adopt or enforce any order, ordinance, policy, regulation, rule, or similar measure that requires an individual to provide, as a condition of receiving any service or entering any place, documentation regarding the individual's vaccination status for any COVID-19 vaccine.

Office of the Governor, Executive Order GA-39 (2021) at 2.⁶ Thus, under the order, a state agency or political subdivision may not adopt a policy conditioning the receipt of "any service" on an individual's submission of COVID-19 vaccination information. The order does not exclude an employee from the term "individual," nor does it limit "services" to those that would typically be provided to the public exclusively. See MERRIAM-WEBSTER'S COLLEGIATE DICTIONARY 114 (11th ed. 2004) (defining "benefit" to include a service provided by an employer in addition to wages or salary). Thus, a court could conclude that by offering a benefit of COVID-19 paid leave only to those employees showing proof of a vaccine or a medical exemption, the HISD paid leave policy violates Executive Order GA-39.

³ See GOVERNOR OF THE STATE OF TEXAS, DISASTER PROCLAMATION (Mar. 13, 2020). The Governor renewed the disaster declaration most recently on March 23, 2022.

⁴ Multiple lawsuits are currently pending in Texas state and federal courts that address the validity of certain gubernatorial executive orders related to the COVID-19 pandemic. See, e.g., In re Abbott, No. 21-0720 (Tex. filed Aug. 23, 2021). It is the policy of this office to refrain from issuing an Attorney General opinion on a question that we know to be the subject of pending litigation. See Tex. Att'y Gen. Op. Nos. KP-0382 (2021) at 2, GA-0502 (2007) at 3-4. We therefore assume without deciding the validity of Executive Order GA-39.

⁵ See GOVERNOR OF THE STATE OF TEXAS, EXECUTIVE ORDER 39 (Aug. 25, 2021).

⁶ Executive Order GA-39 supersedes paragraph No. 2 of Executive Order GA-38, which similarly prohibited vaccine passports documenting COVID-19 vaccines administered under emergency use authorization. See id at 3.

II. Any standard documentation that certifies an individual's COVID-19 vaccination status constitutes a "vaccine passport" under section 161.0085 of the Health and Safety Code, but that provision currently prohibits a government entity from providing such document to a third party for a purpose other than health care.

You also ask whether such a policy constitutes a "vaccine passport" under Senate Bill 968, recently passed by the Eighty-seventh Legislature. Request Letter at 1-2. Senate Bill 968, among other things, added section 161.0085 to the Health and Safety Code to prohibit vaccine passports. That section provides in relevant part:

(b) A government entity in this state may not issue a vaccine passport, vaccine pass, or other standardized documentation to certify an individual's COVID-19 vaccination status to a third party for a purpose other than health care or otherwise publish or share any individual's COVID-19 immunization record or similar health information for a purpose other than health care.

(c) A business in this state may not require a customer to provide any documentation certifying the customer's COVID-19 vaccination or post-transmission recovery on entry to, to gain access to, or to receive service from the business. . . . .

TEX. HEALTH & SAFETY CODE § 161.0085(b), (c). The provision does not define "vaccine passport." But the canon of statutory construction known as noscitur a sociis—"it is known by its associates"—instructs that "the meaning of a word or phrase, especially one in a list, should be known by the words immediately surrounding it." Greater Houston P'ship v. Paxton, 468 S.W.3d 51, 61 (Tex. 2015) (citing TGS-NOPEC Geophysical Co. v. Combs, 340 S.W.3d 432, 441 (Tex. 2011)). The statute prohibits "a vaccine passport, vaccine pass, or other standardized documentation to certify an individual's COVID-19 vaccination status." TEX. HEALTH & SAFETY CODE § 161.0085(b) (emphasis added). Accordingly, a vaccine passport as contemplated by section 161.0085(b) includes any standard documentation to certify an individual's COVID-19 vaccination status, including the documentation required under the HISD paid leave policy.

Subsection 161.0085(b) prohibits a governmental entity from issuing a vaccine passport in order to certify the individual's vaccination status to a third party and prohibits a governmental entity from otherwise publishing or sharing that documentation for a purpose other than health care. Id. Subsection 161.0085(b) does not address whether a governmental entity may require another party to submit a vaccine passport to itself. See id. To the extent that such documentation is provided by or from another governmental entity (in other words, not from HISD), then such governmental entity is also prohibited from providing the individual's COVID-19 immunization record to a third party, including HISD, for a purpose other than health care. Implementation of the HISD paid leave policy would be an employment matter, and documentation of an individual's COVID-19 vaccination status in this instance would therefore not be for the purpose of health care of any individual.

In contrast, subsection 161.0085(c), concerning vaccine passports in the context of businesses, clearly prohibits requiring the submission of vaccine passports:

A business in this state may not require a customer to provide any documentation certifying the customer's COVID-19 vaccination or post-transmission recovery on entry to, to gain access to, or to receive service from the business. . . . .

Id. § 161.0085(c). Chapter 161 does not define "business" for purposes of subsection 161.0085(c). Courts construing an undefined word generally apply the word's common, ordinary meaning, looking to "a wide variety of sources, including dictionary definitions." Jaster v. Comet II Constr., Inc., 438 S.W.3d 556, 563 (Tex. 2014). The term "business" is commonly understood to refer to a "commercial and mercantile activity customarily engaged in as a means of livelihood." WEBSTER'S THIRD NEW INT'L DICTIONARY 302 (2002).

Thus, a court would likely conclude that subsection 161.0085(b) does not allow HISD to issue or share a vaccine passport, vaccine pass or other standardized documentation for purposes of its COVID-19 paid leave policy, nor does it allow another government entity to issue any such documentation to HISD for purposes of such paid leave policy. Subject to the foregoing, subsection 161.0085(b) does not speak to whether a government entity may require submission of any documentation certifying COVID-19 vaccination or post-transmission recovery (as opposed to the clear restriction under subsection 161.0085(c) on a business from requiring such documentation).

III. HISD is not a "covered entity" under HIPAA, and thus the restrictions under HIPAA on disclosure of protected health information do not apply.

Next you ask whether HISD's policy would violate employees' medical privacy rights under other law, such as the federal Health Insurance Portability and Accountability Act ("HIPAA") or the Texas Medical Records Privacy Act. Request Letter at 1-2.

Congress enacted HIPAA to increase the portability of health insurance and to reduce health care costs by simplifying administrative procedures. See generally Health Ins. Portability & Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended at 42 U.S.C. §§ 1320d to 1320d-9 (2006)). Congress also authorized the secretary of the U.S. Department of Health and Human Services to promulgate rules governing the disclosure of confidential medical records. See generally 45 C.F.R. pts. 160 & 164. The resulting HIPAA Privacy Rule addresses "'the use and disclosure of individuals' health information . . . as well as standards for individuals' privacy rights to understand and control how their health information is used.'"⁷ See generally id. pts. 160 & 164.⁸

Relevant to your question, the HIPAA Privacy Rule applies only to "covered entities," which HIPAA regulations define as a health plan, health care provider, or health care clearinghouse, and their business associates. See id. §§ 160.103 (defining "covered entity" and "business associates"), .102(a)-(b) (specifying HIPAA's applicability only to those entities).⁹ You tell us that "HISD is not its employees' health care provider," and we presume that HISD is likewise not a health plan or a health care clearinghouse. Request Letter at 2. Thus, a court would likely conclude that because HISD is not a "covered entity" under HIPAA, the school district's COVID-19 leave policy would not violate an employee's HIPAA privacy rights with respect to HISD.

That said, the term "health information" under the Privacy Rule includes "any information . . . that: (1) [i]s created or received by a . . . school . . .; and (2) [r]elates to the past, present, or future physical or mental health or condition of an individual [or] the provision of health care to an individual . . . ." Id. § 160.103. Any such health information that is individually identifiable and that is transmitted or maintained in any form constitutes "protected health information" under HIPAA. Id. Thus, to the extent a school receives an individual's COVID-19 vaccination status, that information would likely be characterized as protected health information under HIPAA.

⁷ U.S. DEP'T OF HEALTH & HUMAN SERVS., OFFICE FOR CIVIL RIGHTS, SUMMARY OF THE HIPAA PRIVACY RULE, at 1.

⁸ The term "health information" under the Privacy Rule includes "any information . . . that: (1) [i]s created or received by a . . . school . . .; and (2) [r]elates to the past, present, or future physical or mental health or condition of an individual [or] the provision of health care to an individual . . . ." 45 C.F.R. § 160.103. Any such health information that is individually identifiable and that is transmitted or maintained in any form constitutes "protected health information" under HIPAA. Id.

⁹ The law specifies that a "government agency, with respect to determining eligibility for . . . a government health plan that provides public benefits and is administered by another government agency, or [is] collecting protected health information for such purposes" is not a "business associate." 45 C.F.R. § 160.103.

IV. While HISD must comply with the Texas Medical Records Privacy Act ("TMRPA"), HISD's COVID-19 paid-leave policy does not, on its face, violate an employee's medical privacy rights under TMRPA.

The Texas Medical Records Privacy Act ("TMRPA") is the state counterpart to HIPAA, governing the use and disclosure of protected health information and working in tandem with HIPAA to protect the privacy of medical records. See generally TEX. HEALTH & SAFETY CODE §§ 181.001-.207; see also id. §§ 181.001 (adopting HIPAA definitions for terms TMRPA does not otherwise define, which includes "protected health information"), 181.004 (requiring covered entities to comply with both laws, to the extent applicable). The TMRPA defines "covered entities" more broadly than HIPAA, encompassing "any person" who assembles, collects, analyzes, uses, evaluates, stores, or transmits protected health information or who comes into possession of it, and expressly including a "school." Id. § 181.001(b)(2). Under this expanded definition, HISD would likely be a "covered entity" under TMRPA if it received COVID-19 vaccination status information from an employee.¹⁰ As such, HISD would be obligated to comply with TMRPA.

TMRPA generally prohibits covered entities from using protected health information for marketing purposes or from disclosing it electronically to any person without the person's authorization. Id. §§ 181.152(a), .154(b). Under TMRPA, a covered entity may not reidentify or attempt to reidentify an individual without obtaining the necessary authorization. Id. § 181.151. TMRPA also prohibits covered entities from selling protected health information. Id. § 181.153(a). Covered entities must notify any "individual for whom the covered entity creates or receives protected health information" if the information is subject to electronic disclosure. Id. § 181.154(a). Other requirements TMRPA imposes on covered entities include (1) training employees regarding state and federal law on protected health information; and (2) providing electronic access when a person requests his or her own health records.¹¹ See id. §§ 181.101, .102. The facts you provide do not indicate whether HISD's use or handling of protected health information from an employee under the COVID-19 leave policy would violate TMRPA.

¹⁰ But see TEX. HEALTH & SAFETY CODE § 181.055(2) (providing that TMRPA "does not apply to . . . any covered entity or other person, insofar as the entity or person is acting in connection with an employee benefit plan"). Whether the COVID-19 paid leave at issue is part of an "employee benefit plan" is a fact question we do not determine. See Tex. Att'y Gen. Op. No. KP-0231 (2019) at 1 (refraining from opining on fact questions).

¹¹ But see TEX. HEALTH & SAFETY CODE § 181.051 (exempting certain entities, including "an employer," from the TMRPA except as to subchapter D); id. §§ 181.151-.154 (comprising subchapter D).

S U M M A R Y

A court would likely conclude that, by offering additional paid leave only to those employees showing proof of COVID-19 vaccination or a medical exemption, the Houston Independent School District's COVID-19 paid leave policy violates Executive Order GA-39.

Any standard documentation that certifies an individual's COVID-19 vaccination status constitutes a "vaccine passport" under subsection 161.0085(b) of the Health and Safety Code. Subsection 161.0085(b) does not permit a government entity to issue nor share standard documentation that certifies an individual's COVID-19 vaccination status for any purpose other than for health care. Sharing information for an employment matter (or any other non-health care related purpose) would not be permitted under this statute. As written, subsection 161.0085(c) clearly prohibits a business from requiring submission of such documentation from a customer. The statute is silent as to whether a governmental entity may, or may not, require submission of such information.

HISD is not a covered entity under the federal Health Insurance Portability and Accountability Act; however, a person's vaccination status likely falls within the definition of "protected health information" under this federal statute.

HISD is a covered entity under the Texas Medical Records and Privacy Act and must comply with its provisions. Any information related to the vaccination status of an employee would be covered as "protected health information" under the TMRPA (as the statute adopts the federal definition) and treated accordingly.

Very truly yours,

KEN PAXTON
Attorney General of Texas

BRENT E. WEBSTER
First Assistant Attorney General

LESLEY FRENCH
Chief of Staff

MURTAZA F. SUTARWALLA
Deputy Attorney General for Legal Counsel

VIRGINIA K. HOELSCHER
Chair, Opinion Committee

BECKY P. CASARES
Assistant Attorney General, Opinion Committee