UNDATED -- When Minnesota’s mask mandate to stem the spread of COVID-19 took effect July 25, it stirred up controversy and raised questions.

As per Governor Tim Walz’s Executive Order 20-81, residents of Minnesota are required to wear face coverings in all indoor businesses and public indoor spaces. Certain exemptions are made based on age, and whether or not a person suffers from medical or other health conditions, disabilities or mental health conditions that make it difficult to tolerate wearing a mask.

It’s a mandate that leaves businesses bearing the burden of enforcing government order, says David Schultz, political science professor at Hamline University and visiting professor of law at the University of Minnesota. It also raises a few questions: can businesses or customers legally ask others why they aren’t wearing masks? In doing so, are they violating medical privacy laws, governed under HIPAA?

HIPAA, which stands for Health Insurance Portability and Accountability Act, is a medical privacy law that covers health insurance practices and protects citizens against the unlawful release of their medical information. Hospitals and clinics are mandated to keep certain medical information private, as are employers when it comes to their employees.

But, does HIPAA make it illegal for a store employee to ask a customer why they aren’t wearing a mask?  No, says Schultz.

“No, this isn't a violation of HIPAA, but it’s certainly an interesting issue, and there’s a lot of confusion,” he said. “Let’s say I walk into a grocery store. I don’t have a mask on, and the manager of the store says to me, ‘you’re supposed to be wearing a mask. Why aren’t you wearing a mask?’ He can ask you why you’re not wearing a mask. And, you can say, ‘I have a medical reason,’ and leave it at that.”

“The point is – nothing in HIPAA prevents a business from asking you why you’re not wearing a mask when you come into a place,” Schultz added.

But while businesses can ask customers why they are not wearing masks, customers can decline to provide answers.

“You can, of course refuse to give an explanation, but none of this involves a violation of the Medical Privacy Act,” Schultz says. “Businesses can still ask you about the medical condition, you can still refuse, and they may ask you to leave. Would that be a violation of any of your rights? It’s hard to tell at this point, but certainly it’s not a violation of HIPAA. This has nothing to do with HIPAA.”

Schultz says issues related to HIPAA and masks are more likely to come into play between employers and employees.

“Now, let’s say you’re an employee of a business,” Schultz says. “Let’s also assume we have to wear masks under the governor’s order. You walk into work without a mask on, and the manager asks, ‘why aren’t you wearing a mask?’ And you say you have asthma. Now, if the employer releases that information, or shares that information with other employees, boom – that would be the violation of HIPAA, because that employer is releasing medical information they have about you to other people without authorization.”

“But private business is permitted to ask customers why they’re not wearing masks. There’s no violation there whatsoever,” he added.

When it comes to available resources for helping people tackle misinformation related to mask-wearing, Schultz says there isn’t much to be found.

“There isn’t a lot of stuff out there right now that is really very good in terms of talking about the legal issues,” he said. “For the most part, people haven’t even thought about the legal issues of public health questions.”

To learn more about HIPAA, visit the US Department of Health and Human Services website.