Something they are hoping you don't consider is the fact that HIPPA does in fact extend to individual persons attempting to access your medical privacy. A violation does not have to just pin the company. You can and should file suit against anyone prying into your personal, private information. And more than likely, the company will try to distance themselves from the employee you are suing. This will flip the script on them when companies start struggling to employ fall guys.
EDIT: I really need to wake up more. The thought came to me so I shared it. You cannot discuss people's medical history or status unless they volunteer it, but even then you can still get in trouble if it turns out said someone didn't want that information volunteered. It does not only apply to medical professionals.
My understanding is the person doing the asking (about vax status or anything else medically related) can only be sued if they circumvent the person (the employee)and go directly to the medical institution from which the employee obtains medical attention. Here's a scenario to illustrate my experience with HIPAA: A female employee looks as though she is putting on extra weight around the midsection of her body. They employer wants to know if she is pregnant so they can begin planning for the maternity leave absence. The employee in question refuses to disclose her pregnancy status. As a result the employer bypasses the employee and goes directly to her insurance carrier to see if any claims have been paid to an OBGYN as well as any subsequent medical information.
In this scenario, the employee can sue the doctor and/or the insurance carrier if they provide the protected information without authorization.
The simple act of the employer asking the employee if they are pregnant, does not provide the employee with a basis for a law suit.
An employer asking an employee about their vax status is not a violation of HIPAA. If the employer goes around the employee to obtain information about the vax status from a medical provider, and the medical provider gives out the information, then a violation has occurred.
Sadly, unless the patient has read all the documents and waivers they are given when they go to the doctor, they may have inadvertently authorized the release of their medical information to certain people without even realizing it.
"Even if HIPAA is implicated by the employer's disclosure of the OSHA Log, the statue and implementing regulation expressly permits the disclosure of protected health information to the extent required by law. See 45 CFR 164.512(a)."