Experts say it’s not a HIPAA violation for businesses, schools to ask for vaccination status