All HIPAA ensures is that the information in their VRS system is not made public. This is likely exactly why they have a "system" in the first place, rather than just having HR keep copies on a database, to comply with HIPAA. It is also why many companies who cannot afford this type of system choose to not keep copies of your proof of vaccination, which would make them liable under HIPAA for how they store that information.