I think a state could order vaccine passports as part of its police powers. They were able impose lockdowns under their police powers, so I dont see why they couldnt order vaccine passports under their inherent police power.
But you asked whether the WH could do so. Generally, states have been.held to retain police powers to deal with epidemics/plagues in their own state. See the key US Supreme court case on this: COMPAGNIE FRANCAISE DE NAVIGATION A VAPEUR, Plff. in Err., v. STATE BOARD OF HEALTH, LOUISIANA, et al.https://www.law.cornell.edu/supremecourt/text/186/380
But an argument could be made--particularly in this day and age where transportation between states and other countries is more common and far quicker than it used to be-that federal power is needed to deal effectively with a pandemic, that individual states cant deal with it effectively by themselves. And so the federal government should be able to use its power under the Commerce Clause, even though that would intrude on the traditional state police powers. As to whether a challenge to the federal government issuing vaccine passports would work, I think that depends on the necessity presented to the court as to why issuing those vaccine passports to deal with the pandemic by the federal government are needed to deal with the pandemic. There just isnt case law saying that the federal government could that, so ultimately it will depend on the Supreme Court's view of things. It would be an incredibly important case.
Also, if they went under the Commerce Clause, thats part of the power of Congress, so the White House would have to obtain authority first from the Congress
As to a HIPAA violation--thats a federal medical privacy statute--If the Congress passed a law authorizing the president to issue these vaccine passports, then they have pretty much overriden HIPAA anyway. But what about the constitutional right of privacy in your medical information? The Supreme Court has not recogized that as a right but lower federal.courts have. (See, e.g., Hancock v. County of Rennsselear https://law.justia.com/cases/federal/ap ... 02-09.html
Assuming there is a constitutional right to privacy in your medical information a court would have to balance the government's need to issue the vaccine passports vs the intrusion on privacy. The level of scrutiny is intermediate if it's legislative in nature--inbetween strict scrutiny where governments actions are almost never upheld (e.g. based on race) and rational basis, where governmental action is almost always upheld. (For example, laws that distinguish based on gender are subject to intermediate scrutiny). If it's executive action then it's objectionable only if it "shocks the conscience". So it looks like executive action is given more discretion and since it appears the action would be from Congress through the Commerce Clause, it might be more likely to be not upheld. I suspect though the federalism argument that states' police powers should not be intruded upon by the federal government is a far stronger argument. I may be wrong but I think the federalism argument would have more sway given the stakes involved here.