Is the data collected by the U-M COVID-19 vaccination and exemption self-report forms regulated by HIPAA?