COVID vaccines and employee privacy

Published on

There are many reasons why employers may want or need to know whether their employees have been vaccinated against COVID-19: the safety of staff and customers, a desire to modify mask rules, or even legal mandates. As a general rule, employers may ask employees for proof that they have received a COVID vaccination, but there are several factors that should be considered if and when doing so. These include ensuring the questions are asked correctly, that privacy measures are in place, and that employee information is safeguarded.

First, employers should be careful about how they request this information. The Americans with Disabilities Act (“ADA”) places limits on employers’ ability to inquire about employees' medical history and specific medical conditions, and also specifies when employers may request medical examinations of their employees. In December of 2020, the U.S. Equal Employment Opportunity Commission (“EEOC”) issued guidance addressing such inquiries and compliance with the ADA. It stated that employers may generally inquire whether employees are vaccinated and ask for proof of vaccination without running afoul of the ADA, because such inquiries are unlikely to elicit information regarding a disability.

However, employers should remain cautions. The EEOC in its guidance reminded employers that inquiring why an employee chooses not to get a vaccine could uncover underlying medical conditions that require accommodations. Employer knowledge of underlying medical conditions could also increase the risk of a disability discrimination claim if the employee later experiences an adverse employment action.

Second, employers collecting employees' vaccination information must comply with state laws regulating the collection, use, and disclosure of employee data. In California, the California Consumer Privacy Act (“CCPA”) requires employers to provide their California-resident employees with a privacy notice at or before the point of data collection. In addition, California's Confidentiality of Medical Information Act, restricts employers to requesting or using an employee’s "medical information" to certain circumstances. Employers must also "establish appropriate procedures to ensure the confidentiality and protection from unauthorized use and disclosure of that information."

Third, once any medical information is collected about an employee, it must be stored in a secure method and access must be limited to authorized personnel. The unauthorized access of medical information may give rise to a private lawsuit under California law, and the CCPA makes bringing such suits as class actions much easier. The security of this data should be first-order issue when planning to ask employees about vaccination status.

Finally, employers should know if they are under any legal mandate to inquire about vaccine status. Santa Clara County in California recently adopted a health order requiring that all employers survey their employees’ COVID vaccination status by June 1. Political watchers across the state suspect that other local governments, and even the state, may follow this path. It is therefore crucial to understand any applicable mandates when designing a program.

Bottom Line

Before asking employees about their vaccination status, all employers should:

  1. Work with counsel to verify which laws and local health orders are applicable, and design the program with these in mind.
  2. Prepare to store the vaccination status data as you would other sensitive data such as Social Security Numbers, driver’s license numbers or other personally identifying information.
  3. Ensure your questioning is targeted to vaccination status to avoid triggering accommodation requirements under the ADA.
  4. Provide employees with appropriate privacy disclosures prior to or at the time of asking about vaccination status.