COVID-19 Vaccines: What Can You Ask? What Can You Require? What Can You Disclose?

As we emerge from the worst pandemic in a century, businesses and employers are struggling with issues involving the rapidly developed vaccines that have begun to sharply curb the spread of COVID-19. These vaccines, offered by Moderna, Pfizer and Johnson & Johnson, have been granted emergency use authorizations (EUAs) from the Food and Drug Administration and full unrestricted approval is anticipated in the coming months. As of June 4, 2021, 54.7% of Pennsylvanians age 18 older have been fully vaccinated, and the AMA reports that 96% of practicing doctors in the United States are vaccinated.

Still, there are many who have not received the vaccine for a variety of reasons – legitimate medical contraindications; religious objections; unavailability of vaccines in disadvantaged communities; or fear spread through misinformation. There also is a great volume of inaccurate advice circulating about what employers may ask, require, or disclose, and what exceptions may apply. Here is some guidance for medical practices facing these dilemmas:


First, let’s clear up one common misunderstanding. The Health Insurance Portability and Accountability Act (HIPAA) privacy rule is often incorrectly cited as a barrier to COVID-19 vaccination inquiries. HIPAA only restricts “covered entities” from disclosing “protected health information” (PHI) without the patient’s authorization unless an exception applies. Covered entities are health care providers, payors and clearinghouses. In workplace situations, an employer is generally not acting as a covered entity with regard to its employees. Medical practices that provide care to their employees are covered entities and must treat their medical information the same as all other PHI. However, the Americans with Disabilities Act (ADA) and other federal laws regulate certain workplace and public accommodation issues that may impact vaccine inquiries and requirements.

Title I of the ADA applies to private employers with 15 or more employees, state and local government employers, employment agencies and labor unions. The Pennsylvania Human Relations Act (PHRA) applies to employers with as few as four employees, and generally mirrors the ADA. Title III of the ADA prohibits discrimination on the basis of disability in the activities of places of public accommodations including doctors’ offices. Accordingly, the ADA is more likely than HIPAA to apply to vaccine questions and policies.

Title VII of the Civil Rights Act prohibits discrimination based on race, color, national origin, religion and sex, including pregnancy. Religious objections to vaccines will need to be evaluated under Title VII.

Another federal law, Title II of the Genetic Information Nondiscrimination Act of 2008 (GINA), prohibits genetic information against employees or applicants because of genetic information and may restrict certain inquiries. The ADA, Title VII and GINA are interpreted and enforced by the Equal Employment Opportunity Commission (EEOC).

Can you ask if your staff has been vaccinated?

Yes, you may ask your employees about their status, and even request proof of vaccination (such as the CDC’s Vaccination Record Card). Guidance published by the EEOC states that when an employer asks employees whether they obtained a COVID-19 vaccine, the employer is not asking a question that is likely to disclose the existence of a disability. Requesting documentation or other confirmation of vaccination is not prohibited as a disability-related inquiry under the ADA. However, documentation or other confirmation of vaccination provided by the employee to the employer is medical information about the employee and must be kept confidential.

Can you require your staff to be vaccinated?

Yes, you may require COVID-19 vaccination for all employees who physically enter the workplace, subject to the reasonable accommodation provisions of the ADA and Title VII. The U.S. District Court for the Southern District of Texas dismissed a challenge to a vaccine mandate by employees of Houston Methodist Hospital on June 15, 2021. The court stated “Methodist is trying to do their business of saving lives without giving [the employees] the COVID-19 virus. It is a choice made to keep staff, patients, and their families safer. [Plaintiff] can freely choose to accept or refuse a COVID-19 vaccine; however, if she refuses, she will simply need to work somewhere else.”

If an employee declines vaccination for religious reasons, the EEOC advises: “Once an employer is on notice that an employee’s sincerely held religious belief, practice, or observance prevents the employee from getting a COVID-19 vaccine, the employer must provide a reasonable accommodation unless it would pose an undue hardship.” Accommodations may include requiring the unvaccinated employee to continue to wear a face mask, relocating the employee to a different physical location in the workplace where there is less traffic, reassigning to different duties, or permitting telework. The employee must show that the requested accommodation will have more than minimal cost to the employer. The EEOC cautions “Ultimately, if an employee cannot be accommodated, employers should determine if any other rights apply under the EEO laws or other federal, state, and local authorities before taking adverse employment action against an unvaccinated employee.”

If an employee cites medical reasons for declining vaccination, the employer should consider reasonable accommodations. If the employee has a protected disability, the employee must let the employer know that he or she needs a reasonable accommodation, and the employer must enter into an interactive dialogue to explore accommodations.

The Job Accommodation Network,, is an excellent resource for employers looking for accommodation options. Under the ADA, an employer may require an individual with a disability to meet a qualification standard applied to all employees, such as a safety-related standard requiring COVID-19 vaccination, if the standard is job-related and consistent with business necessity.

How about offering incentives to get vaccine?

The EEOC advises that employers may offer incentives to employees to voluntarily provide documentation or other confirmation of vaccination obtained from a third party in the community, such as a pharmacy, personal health care provider, or public clinic. Employers that are administering vaccines to their employees may offer incentives for employees to be vaccinated, as long as the incentives are not coercive. However, these incentives should be modest, because a very large incentive could make employees feel pressured to disclose protected medical information. There is no guidance about what amounts would be considered excessive.

What if patients ask whether you or your staff have received the vaccine?

Patients have the right to ask, but you have no obligation to answer. The question does not violate HIPAA, and you have every right to disclose your own vaccination status (or other health information) to anyone you choose. Your employees may make their own choices to disclose their status. As an employer, you may disclose the percentage of your staff who have been vaccinated, but you may not disclose any individual employee’s status without their consent.

What about OHSA?

In previous guidance, the Occupational Safety and Health Administration (OSHA) advised employers who require employees to receive the COVID-19 vaccination as a condition of employment that they must record an employee’s adverse reaction to the vaccination in their OSHA 300 workplace illness logs if the employee’s reaction is “a new case” and results in (a) an absence from work of more than one day, (b) medical treatment beyond first aid, or (c) restricted work or transfer to another job. On May 24, 2021, OSHA rescinded this guidance and replaced it with the following:

“DOL and OSHA, as well as other federal agencies, are working diligently to encourage COVID-19 vaccinations. OSHA does not wish to have any appearance of discouraging workers from receiving COVID-19 vaccination, and also does not wish to disincentivize employers’ vaccination efforts. As a result, OSHA will not enforce 29 CFR 1904’s recording requirements to require any employers to record worker side effects from COVID-19 vaccination through May 2022. We will reevaluate the agency’s position at that time to determine the best course of action moving forward.”

What next?

Many vaccine opponents cite the provisional status of the FDA’s emergency use authorizations as the basis for their objections to being forced to serve as “guinea pigs” for experimental vaccines. The federal court in Texas rejected this argument, and the EEOC’s guidance did not address this issue. Both Pfizer and Moderna have applied to the FDA for full approval, and action is expected later this year.

Full approval would allow the companies’ vaccines to remain on the market after the end of the federal Public Health Emergency and also would permit direct-to-consumer advertising. Watch for further guidance from the applicable government agencies as these developments occur. As always, if you are unsure of your rights and responsibilities, consult knowledgeable counsel.

Mr. Maruca is a healthcare partner of the national law firm Fox Rothschild LLP in their Pittsburgh office. He can be reached at (412) 394-5575 or [email protected].