How to respond if an employee refuses to complete an attestation of vaccination
Questions about vaccinations and vaccine mandates are a buzz in workplaces across the country. One of the biggest questions we’re hearing is if you can require employees to show you proof of vaccination. If they refuse, what recourse do you have? Let’s dive in and address this burning question.
Q: “What recourse does an employer have against an employee if we are requiring them to complete an attestation form regarding the employee’s covid vaccination status? Can the employer terminate the employee or prevent them from reporting to work until the form has been completed? By requiring the employee to respond to the request, is the company violating any HIPAA, ADA or PHI laws?” – Anonymous, Hawaii
A: The Americans with Disabilities Act (ADA) and many similar state discrimination laws limit employers from asking employees for medical information unless the question is both job-related and consistent with business necessity. The Equal Employment Opportunity Commission (EEOC) interprets the laws and assists employees who believe they have been discriminated against to investigate their claims.
When can an employer ask for medical information? The EEOC has said that employers may ask employees whether they have a fever, are experiencing symptoms of covid, or have tested for covid, because employers do need this information to meet their obligations to provide a safe workplace. The EEOC has also said that a person’s vaccination status is not a medical inquiry in and of itself, and that employers may ask employees for this information. Employees who refuse to disclose their status are treated as unvaccinated and may be excluded from the workplace.
The Health Insurance Portability and Affordability Act (HIPAA) is a law primarily intended to allow individuals to qualify for health insurance even if they have pre-existing conditions. The law does prevent health care providers who engage in certain electronic transactions from sharing certain private patient health information (PHI) with others without the patient’s consent. Once a patient has consented to share that information, however, it is no longer protected. Most employers are not covered by HIPAA in their role as employers. (Some employers who are also health care providers or insurance plan administrators may have HIPAA obligations, and must keep patient data out of employee files—for example, as when an employee is also a patient).
Simply put, a person’s vaccination status is not protected as PHI in the workplace. In contrast, medical information that employees share with their employers—results of tests for covid, for example, medical information disclosed in connection with requests for accommodation of disabilities—is protected by the ADA’s medical confidentiality requirements and should be shared only with employer representatives with a need to know.
Employees may be surprised that the laws do not immunize them from adverse employment action if they fail to disclose their immunization status or to obtain a covid vaccination if they can safely do so. The United States has a long history of putting public health above individual choice, however—the history of the country’s response past pandemics is fascinating and illuminating.
Moreover, prior to the covid outbreak, many employers regularly monitored (and no doubt still do) their employees for various health conditions, including tuberculosis, and for exposure to workplace hazards like heavy metals and loud noises. Vaccination status is important for employers to know whether they must exclude people who have close contacts with individuals with covid from the workplace, or if they can continue to work unless they develop symptoms or test positive. They may also need this information to determine whether employees must wear masks while working indoors—although the recent resurgence of covid through the Delta variant has led to renewed CDC recommendations and local orders mandating all persons wear masks indoors regardless of vaccination status, a sad reminder that the virus that causes covid is mutating faster than we can vaccinate our population.
To answer your question, then: Questions about employee covid vaccination status are not requests for PHI or medical information. Employers are not prohibited from demanding to know their employees’ vaccination status during a worldwide pandemic when there is unquestionably a business need for that information.
Employers I have spoken with do not want to take disciplinary action against individuals who refuse to disclose their status or, worse, who lie about it—but they may do so if there is no other way to maintain a safe workplace.
