Collecting vaccination cards and or test results

Hello,

How are organizations dealing with the vaccination records or results to prove status? The way I understand it is, any voluntary information provided by a patron is not a HIPPA concern. Furthermore, arts organization does not operate under HIPPA laws so the idea that collecting a image of a card or result is not still not a concern. The only concern is assuring we have a high level of security in place to ensure privacy laws are met. Would you agree? Anyone had legal council on the matter? 

Thanks,

Travis