is asking for vaccination info a hipaa violation