Dear Littler: We are a retail chain on the West Coast and are almost back to pre-COVID-19 operational levels. Now that vaccines are widely available, we’re hoping our workforce (and the public!) will soon be fully vaccinated. We’ve been hearing a lot of conflicting information about what we may and may not require of our employees. Because our business is public facing, may we at least ask our employees whether they are vaccinated?

                                — Pondering in Portland

Dear Pondering:

We hear you! As companies around the country contemplate re-opening and restoring business operations to something resembling the pre-pandemic “normal,” the first question on many employers’ minds is “may we ask our employees about their vaccination status?”  As federal, state, and local guidance on these issues is changing quite literally on a day-to-day basis, it is difficult to keep up with current information, and to avoid misinformation and common misconceptions. The answer to your question, therefore, is not straight-forward. Your one question is actually a series of questions employers around the country should be asking themselves. Let’s break it down:

May We Ask?  

As of the date this article was published, no state or locality has prohibited employers from asking whether or not an employee is vaccinated, or whether they plan to get vaccinated (or conversely, whether they have decided not to obtain a COVID-19 vaccination).  Indeed, several states and localities, including Washington State, Oregon, and Santa Clara, California, require employers to determine the vaccination status of their employees.  Others, notably California, may soon follow suit.  On the other hand, at least one state (Montana) has adopted a law that prohibits discrimination on the basis of COVID-19 vaccination status; Montana’s law does not prohibit an employer from asking employees whether they have been vaccinated, but limits what an employer may do with that information if it does collect it (and, potentially, sets up claims for “vaccine status” discrimination down the road, both from vaccinated and non-vaccinated workers).

Should We Ask? 

The maxim “just because you may do something, doesn’t mean you should do something” applies in full force here.  There are numerous good reasons for an employer to obtain vaccination status from employees.  As current CDC guidance provides that fully-vaccinated individuals in most instances need not wear masks or engage in social distancing, an employer may want to inquire as to its employees’ vaccination status to begin re-opening in line with current CDC recommendations (employers should be aware, however, that not all states have adjusted their guidance to align with CDC recommendations).  Alternately, before deciding on such protocols, an employer may wish to establish a “baseline” to determine what percentage of its workforce is vaccinated and what percentage is not (and/or not planning to).  There is no “magic number” of vaccinated employees that should dictate an employer’s planning, but knowing whether most, some, or few employees are vaccinated may inform that decision. 

As with any collection of employee data (particularly sensitive personal information), an employer will want to ask why it is collecting this information, and what it plans to do with it.  Simply asking for the sake of knowing, with no thought as to what it plans to do with the information, is unlikely to be a productive exercise.  Similarly, employers should discuss with counsel plans for sharing information as to their employees’ vaccination status with others in the workplace—some may maintain the information strictly within the Human Resources department, while others will want (or need) to share limited information with front-line supervisors and others who may be responsible for ensuring compliance with the company’s COVID-19 protocols.  Still others may opt for a voluntary disclosure system, where employees may choose to indicate their vaccination status as a precondition of not wearing a mask or social distancing in the workplace.

What About Requiring Proof of Vaccination? 

Employers generally may ask employees to provide proof of vaccination by providing a copy of their vaccination card as administered by a health care provider (and, at least in Oregon, are currently required to do so).  Doing so, however, may inadvertently implicate requirements for the retention of medical records beyond those applicable to routine personnel documents.  In addition, it appears anecdotally that not all individuals who are obtaining vaccines are being given an “official” card or record showing their vaccination status.  And instructions for counterfeiting the CDC card are circulating on the Web.  More troubling, the lack of consistency among vaccine documents in various states and localities increases the potential for document fraud and is difficult for employers to police.

One workaround for many employers is to require that employees provide an attestation of their vaccine status.  Because an attestation is not a document created by a health care provider, it is less likely to trigger any medical record retention requirements.  An attestation also provides an employer with the ability to remind employees that attesting to incorrect information, or knowingly providing false information, will lead to discipline.

In its recent guidance on vaccination, the U.S. Equal Employment Opportunity Commission (EEOC) takes the position that although a request for vaccination status is not a medical examination or disability-related inquiry under the Americans with Disabilities Act (ADA), any documents reflecting employee vaccination status are confidential medical records, and should be maintained separately from personnel records pursuant to the ADA.  A number of courts have disagreed with the EEOC’s position and have held that if a request for certain health information is not a disability-related inquiry, documents generated in response to the request are not confidential medical records under the ADA.  Littler has done a detailed analysis of the EEOC’s updated guidance (which does not yet take into account CDC’s recent updates) here.

But What About The “Vaccine Passport Bans” We’ve Read About? 

An increasing number of states have adopted so-called “vaccine passport bans.”  These generally apply to the public at large, and do not limit an employer asking its employees about their vaccination status.  Most commonly, a so-called “vaccination passport ban” applies to a business requiring customers or patrons to show proof of their vaccination status as a condition of receiving services or entry into the business.  This means, for example, that an employer in the retail sector may be able to ask its employees about their vaccination status (and require some form of proof of vaccination), but it would not be permissible for the business to require proof of vaccine status as a condition of coming in to shop in a retail store.  Of course, nothing prohibits an employer from asking non-vaccinated (or vaccinated) patrons to wear a mask while on their premises—but in those states with vaccine passport bans, it may be difficult for an employer to police this policy by way of requiring proof (not to mention the logistical and practical complications in doing so).

So That’s Everything We Need to Know? 

Not quite.  Requests for vaccination information, even where generally permissible, may implicate state and local privacy laws, and the form of any request may need to be tailored to meet the requirements of the jurisdiction in which the employer operates. Employers that are themselves providing vaccinations to employees must be sure to meet requirements under the ADA and potentially the Health Insurance Portability and Accountability Act (HIPAA).  Perhaps most important, as we noted earlier, federal, state, and local guidance is constantly changing.  And guidance from one agency may conflict with guidance issued by another.  Pondering, your return-to-work plans that include vaccination inquiries will necessarily need to be tailored to each jurisdiction in which you operate.

Good luck!