Who Is Entitled to Know An Employee’s Vaccination Status?

As Americans get back to the worksite, business leaders are debating whether they should require employees to vaccinate and provide proof of their status before returning. In some cities and states, there is no option: some require vaccinations in specific industries, others prohibit businesses from vaccination demands.

At the federal level, there is no vaccination mandate to date for workers in the private sector. In many areas, however, the situation is in flux: it will be important to keep current with what local and state governments mandate. Wherever you do business, it is critically important to maintain the privacy of worker’s confidential medical information, including their vaccination status.

Can I require workplace vaccinations?

Unless mandatory vaccinations are prohibited in your state, city or county, the Equal Employment Opportunity Commission issued guidance that outlines there are no federal non-discrimination laws that prohibit an employer from requiring on-site employees from being vaccinated against COVID-19. The EEOC added employers must comply with the Americans with Disabilities Act (ADA), Title VII, and other workplace discrimination laws to protect the rights of workers. Under the ADA, for example, a worker may be exempt from the vaccine if it poses the threat of an allergic reaction. Under Title VII, workers may request a religious exemption.

Many SMBs are looking to large companies, their customer base, and local legislators before they decide what requirements, if any, they will impose. If there are no mandates in your area, however, the EEOC has outlined in the past that employers may require staff be vaccinated for the flu: the assumption is the COVID-19 vaccination falls under that umbrella of allowable workplace practices.

How do we collect employee vaccination information? 

The California Occupational Safety and Health Standards Board (CalOSHA) recently provided guidance to employers for collecting COVID-19 vaccination information. These include 2 good options that business might want to employ to verify if a worker has gotten the vaccine.

1. Employees provide documented proof of vaccination, or an image of their vaccine card. Employers note the documentation was verified, but do not keep a copy for their records.
2. Employees provide documented proof of vaccination, or an image of their vaccine card. Employers keep a copy of the vaccination document for their records.

Only designated employees should review and/or copy vaccination documents. Make sure these are HR professionals or company owners. You will want to assure whomever is reviewing the documentation understands what it should include and has some ability to verify its authenticity. State and local websites, as well as pharmacies and vaccine providers often show sample cards on their websites. Remember to check for full vaccination status. For the Pfizer and Moderna vaccines, 2 shots are necessary to for full vaccination. Check that the card shows 2 dates.

Decide in advance the manner in which you keep the documentation (either photocopies or notes to the employee’s file) and be consistent. If you are keeping copies, make sure to keep copies for all employees, not just workers in some areas or locations. If you’re making a note to the file, use a standard template or form to document who viewed the vaccine information and the date it was received.

How do we protect employee vaccination information?

If your organization is requiring vaccines, you’ll want to protect this data as you would any other personal medical information.

Vaccine Documents

Typically only Human Resource professionals (and business owners if there is no HR Department) should have access to private medical information.

Copies of documents or notes verifying vaccinations should be held in the employee’s medical file. Employee personnel files should not include medical information — you should create a medical file for each staff member that is separate from their general personnel data. The reason: only select employees should have access to private medical data. While a supervisor may have the right to review personnel files for information like past evaluations, for example, they may not have the right to private medical data.

Typically only Human Resource professionals (and business owners if there is no HR Department) should have access to private medical information. They should segregate these files from other information. Vaccine status, including copies of documents, should be with these separate medical files.

Vaccination Information

Supervisors may have a need to know who in their group is or isn’t vaccinated in some instances. If your business promotes that all front-facing employees are fully vaccinated, then managers of these staff members will need to know so they can assign workers who aren’t vaccinated to back-of-the-house duties.

Supervisors wouldn’t have the right to know if a worker has requested an accommodation to not take the vaccine. They also don’t have the right to question or encourage the employee to be vaccinated. The supervisor would can only know the worker did not receive a vaccine. Providing or requesting any additional information, such as the reason not to vaccinate or the reason for the accommodation, would be prohibited.

No other employee would have a right to a staff member’s vaccination status. The only exception to protecting a worker’s medical information is if it is necessary for the operation of the business. For any other non-business related reason, confidentiality is a must.

Supervisors wouldn’t have the right to know if a worker has requested an accommodation to not take the vaccine. They also don’t have the right to question or encourage the employee to be vaccinated.

Do not disclose vaccine status to coworkers 

If your company is requiring all employees to receive a vaccine, it’s safe to let staff members assume everyone is in compliance and has not requested an accommodation. Do not verify who is vaccinated or who has asked to be exempt unless there is a legitimate business reason to do so. An example might be a supervisor’s need to keep the employee on stockroom duties instead of serving the public. Then the employee’s status alone — vaccinated/unvaccinated — is the only information you should disclose.

While you may encourage employees to keep their personal medical information private, they may choose to tell their colleagues. If so, remind staff members that while some employees may opt to share, your company does not require or encourage it. No one should assume that someone who isn’t sharing has or has not been vaccinated, nor has or has not requested an accommodation.

Do not provide badges, wristbands, or any other physical verification of vaccine status to employees. This would objectively require employees to disclose their personal medical information and should never be your policy. You may allow employees to wear any item (like a pin or wristband) that verifies their status, similar to wearing an “I voted” sticker, but this should align with your dress code policy and be completely voluntary.

Managing the unvaccinated in the workplace

For workers who are unable to get the vaccine for medical reasons or refuse because of a sincerely held religious belief, employers must accommodate their request. This doesn’t mean the company shouldn’t take steps to mitigate risk to others, however.

If a colleague of an unvaccinated employee is immunocompromised or is at high risk for significant outcomes as a result of contracting COVID-19, you may wonder what your rights and responsibilities are. To date, the EEOC hasn’t provided guidance to address separating vaccinated from unvaccinated workers. Doing so on an individual level may violate the law; doing so by groups (like all front-facing employees) may be allowed.

Until there is guidance, there are still options. For unvaccinated workers, you’re within your rights to require they take steps to mitigate risk to others. You may impose mask mandates to these staffers, and require remote work or distancing in the workplace. You may also require frequent COVID-19 testing to assure they pose no risk to their peers.

The EEOC allows businesses to require testing for employees who pose a direct threat to others. Some businesses are requiring weekly testing for non-vaccinated employees: others more or less frequent. If you decide to require testing, remember that employers must pay for all costs associated with this work-related requirement.

As return to work safely continues to roll out, new updates and guidance are likely forthcoming. In the interim, follow the basics: keep private medical information confidential to the extent possible. Only when there is a legitimate business necessity should limited staff be aware of the vaccination status of employees.