Is asking for vaccination status a HIPAA violation?