With the recent adoption of amended Cal/OSHA COVID-19 Regulations, and its allowances for fully vaccinated employees,[1] employers must consider how they will manage employees at their worksites and facilities, and whether they will make any distinction between employees who are fully vaccinated[2] and those who are not.

The purpose of this special bulletin is to address the complex and multilayered legal issues implicated by employer requests for documentation concerning employees’ vaccination status and uses of that information.[3] This bulletin addresses four (4) principle issues:

(1) Requests for documentation concerning employees’ vaccination status;

(2) Confidentiality requirements related to information concerning employees’ vaccination status;

(3) Limitations on employers’ use or disclosure of information concerning employees’ vaccination status; and

(4) Employee authorizations to allow employers to use and disclose information concerning employees’ vaccination status for additional legitimate and non-discriminatory purposes.

Liebert Cassidy Whitmore attorneys are prepared to provide advice and counsel to employers on these issues and others related to employee vaccination status.

I. The ADA and the FEHA Permit Employers to Request Employee Vaccination Records/Status

A. General Authority

Under the Americans with Disabilities Act (“ADA”)[4] and the Fair Employment and Housing Act (“FEHA”),[5] employers may request or require that employees provide documentation concerning their vaccination status.[6] Such requests are permissible because the requested information relates to the employee’s vaccination status, not a health or medical condition that may qualify as a disability. As a result, the request for an employee’s vaccination status does not constitute a disability-related inquiry under either the ADA or the FEHA, and employers may permissibly request or require the production of documentation concerning employees’ vaccination status.

B. Restrictions on Follow-Up Questions by the Employer and Documentation that May Disclose Protected Information

There are important limitations on employer requests for additional information from an employee and on what other information may be included on documentation concerning the employee’s vaccination status.

If an employer asks follow-up questions that relate to the reasons why an unvaccinated employee is not vaccinated, the employer risks turning a lawful request related to the employee’s vaccination status into an unlawful disability-related inquiry. Such follow-up questions would constitute disability-related inquiries because the questions are likely to elicit information about the employee’s health or medical conditions. Employers must avoid making such inquiries unless the employer can demonstrate that such inquiry is job-related and consistent with business necessity. In this context, Liebert Cassidy Whitmore recommends against pursuing such lines of questioning.

If an employer requests documentation concerning the employees’ vaccination status, the employer should instruct its employees to redact any information that relates to employees’ health or medical conditions.[7] The employer should review employee-provided documentation in order to ensure that it does not contain any such information, and the employer should return such documentation if it does. Employers may avoid this issue by requesting that employees provide a copy of the vaccination card issued by the Centers for Disease Control and Prevention (“CDC”), rather than other medical records, as the CDC-issued card provides no other medical information.

C. Employer Options for Documenting Employee Vaccination Statuses

In order to take advantage of the allowances provided under the amended Cal/OSHA COVID-19 Regulations, which authorize employers to exempt fully vaccinated employees from certain regulatory requirements, employers must document employees’ vaccination statuses. As a best practice, Liebert Cassidy Whitmore recommends that employers request a vaccination record provided by either the CDC or the employee’s health care provider.[8] Such a vaccination record offers the strongest evidence of an employee’s vaccination status.

If such records are not available, Liebert Cassidy Whitmore recommends that the employer request that the employee attest to or self-certify to their vaccination status. The attestation should be in writing, and it should include the date and the employee’s signature if possible. Liebert Cassidy Whitmore will have model self-attestation forms available shortly. If the employee provides a verbal attestation, the employer should record in writing the employee’s oral attestation. The recorded attestation should include the date, time, and location where it was given verbally, as well as the name, position, and signature of the employer’s representative who witnessed the attestation.

D. Managing Employees Who Refuse to Provide Documentation Concerning their Vaccination Status

If an employee refuses to provide documentation of vaccination status, the employer must treat that employee as not fully vaccinated, and should treat such employee in the same manner that the employer treats other employees who the employer knows are unvaccinated. For example, if an employer requires employees to be vaccinated before returning to its worksites or facilities, the employer may exclude from those workplaces those employees who refuse to provide the requested documentation. Alternatively, if the employer requires unvaccinated employees to report to its worksites or facilities, but requires that such employees use additional Personal Protective Equipment (“PPE”) while at work, the employer could reasonably require that employees who refuse to provide documentation of their vaccination status also wear such PPE.

Note: The ADA authorizes employers to establish and enforce a safety-related “qualification standard” that includes a “requirement that an individual shall not pose a direct threat to the health and safety of individuals in the workplace.”[9] If the employer establishes such a standard, it may determine that unvaccinated employees pose a “significant risk of substantial harm to the health or safety of the individuals or others that cannot be eliminated or reduced by a reasonable [workplace] accommodation.”[10] While employers must be mindful to provide reasonable accommodations to employees who cannot be vaccinated due to a qualifying disability or a sincerely held religious belief, employers are not obligated to provide employees an accommodation that would pose a direct threat to the health and safety of the workplace. As such, it may be that certain unvaccinated employees, or employees who refuse to provide their vaccination records or status, cannot be reasonably accommodated at the workplace due to a direct threat to the health and safety of the workplace as a result of their presence there.

E. Permissibility of Providing Incentives to Encourage Disclosure of Vaccination Status

Employers may provide incentives to employees who agree to provide documentation concerning their vaccination status, but employers should be very cautious about how such incentives are structured and which employees may qualify for the receipt of such incentives.

The Equal Employment Opportunity Commission (“EEOC”) provides that federal equal employment opportunity (“EEO”) laws do not preclude employers from offering employees incentives to provide documentation concerning their vaccination status.[11] Employers should take care that the incentive program does not discriminate against employees who cannot be vaccinated due to a qualifying disability, sincerely held religious belief, or pregnancy. For example, if an employer provides two days of vacation leave to all employees who provide documentation of their vaccination status, it should offer the same leave benefit to employees who could not take a vaccine due to a qualifying disability, religious belief, or pregnancy status.

Employers should also be cautious about inadvertently implicating other laws by the structure of the incentive program, as certain incentives may violate state law. For example, if the employer offers employees the chance to win a cash prize, the incentive may violate the Penal Code,[12] which prohibits lotteries and games of chance.

While the purpose of this bulletin is not to address the myriad legal issues related to the design and structure of incentive programs, Liebert Cassidy Whitmore encourages employers who have questions about such incentives to contact the firm to discuss these issues in more depth before adopting an incentive program for its employees.

II. Confidentiality Requirements for Employee Medical Information

Once an employer obtains documentation concerning an employee’s vaccination status, that information will constitute confidential medical information under both the ADA and the Confidentiality of Medical Information Act (“CMIA”).[13] Additionally, the amended Cal/OSHA COVID-19 Regulations protect employee medical records implicated by the regulations and only permit disclosure where expressly permitted or required by law.[14]

Note: The Privacy Rule[15] of the Health Insurance Portability and Accountability Act (“HIPAA”) covers healthcare providers, health plans, and healthcare clearinghouses and does not cover or apply to employers. However, as provided in this section, employers are subject to the confidentiality requirements of both the ADA and the CMIA.

Employers in possession of confidential medical information about their employees are subject to strict statutory obligations related to the protection and preservation of such information.

Note: Confidentiality obligations apply regardless of whether the information indicates that the employee is vaccinated or unvaccinated.[16]

Under the ADA, employers must keep confidential medical information in a medical file that is separate and distinct from the employee’s personnel records.[17] The CMIA imposes more rigorous confidentiality obligations, requiring that employers “establish appropriate procedures to ensure the confidentiality and protection from unauthorized use and disclosure of [employees’ confidential medical] information.”[18] The CMIA further provides that such “procedures may include, but are not limited to instruction regarding confidentiality of employees and agents handling files containing medical information, and security systems restricting access to files concerning medical information.”[19]

Due to the stringent obligations under both the ADA and the CMIA, Liebert Cassidy Whitmore recommends that any employer that will solicit documentation concerning its employees’ vaccination status first establish a medical record/information policy and procedure. Such a policy should restrict employee access to information about employees’ vaccination status to those employees who need to know the information, such as Human Resources staff and individual employees’ immediate supervisors. The policy should also include other security measures and safeguards to protect such information, such as requiring passcodes to access sensitive files or anonymizing or encrypting employees’ information.

III. Use and Disclosure of Information Concerning Employee Vaccination Status

In addition to requiring confidentiality, the CMIA also expressly limits how and when the employer may use or disclose such information. Civil Code section 56.20, subsection (c) provides the general requirement that employers obtain a signed authorization before using or disclosing employees’ medical information:

No employer shall use, disclose, or knowingly permit its employees or agents to use or disclose medical information which the employer possesses pertaining to its employees, without the patient [(i.e., the employee)] having first signed an authorization under Section . . . 56.21 permitting such use or disclosure.

Civil Code section 56.20, subsection (c) then provides the following four (4) limited exceptions to the above rule:

1. 1. The information may be disclosed if the disclosure is compelled by judicial or administrative process or by any other specific provision of law.
   2. That part of the information which is relevant in a lawsuit, arbitration, grievance, or other claim or challenge to which the employer and employee are parties and in which the patient has placed in issue his or her medical history, mental or physical condition, or treatment may be used or disclosed in connection with that proceeding.
   3. The information may be used only for the purpose of administering and maintaining employee benefit plans, including health care plans and plans providing short-term and long-term disability income, workers’ compensation and for determining eligibility for paid and unpaid leave from work for medical reasons.
   4. The information may be disclosed to a provider of health care or other health care professional or facility to aid the diagnosis or treatment of the patient, where the patient or other person specified in subdivision (c) of Section 56.21 is unable to authorize the disclosure.

Given the express statutory limitations on the permissible uses and disclosures of employees’ confidential medical information, employers must strictly limit their uses and disclosures of such information to those purposes provided in the statute, unless the employee provides a CMIA-compliant written authorization allowing the employer to use or disclose such information for other purposes.

IV. Employee Authorization for Additional Use and Disclosure of Information by the Employer

A. Authorizations in General

In order to use information concerning employees’ vaccination status for purposes other than Civil Code section 56.20’s limited exceptions, an employer must first obtain from the employee a CMIA-compliant authorization.

The CMIA sets forth certain requirements in order for an employee authorization to be considered valid.[20] Pursuant to the CMIA, the authorization must satisfy each of the following requirements:

1. 1. Be handwritten by the employee, or else typed in at least 14-point font;
   2. Be clearly separate from any other language on the page and must be executed by a signature that serves only to execute the authorization;
   3. Be signed and dated by the employee;
   4. State the limitations, if any, on the types of medical information to be disclosed;
   5. State the names or functions of both the person(s) authorized to make disclosures and the persons or entities authorized to receive disclosures of the medical information;
   6. State a specific date after which the employer may no longer disclose the medical information;
   7. State the limitations, if any, on the use of the information; and
   8. Advise the employee that he or she may receive a copy of the authorization.

Liebert Cassidy Whitmore has prepared a CMIA-compliant model authorization for employer use. Such template authorization is available as part of the firm’s updated model COVID-19 Personnel Policies.

Best Practice: Employers that seek CMIA authorization to use and disclose employees’ vaccination status should request authorization to use and disclose the information “for legitimate and non-discriminatory business purposes where the information is necessary for the employer to make work-related decisions authorized by, or required for compliance with federal, state, or local laws.” Requesting authorization for such purposes will allow the employer to use the information in a number of ways, including in order to exempt fully vaccinated employees from certain requirements under the amended Cal/OSHA COVID-19 Regulations, including the obligation to wear face coverings.

Employers should request CMIA authorizations to use and disclose vaccinated employees’ vaccination status, because the amended Cal/OSHA COVID-19 Regulations[21] differentiate between fully vaccinated employees and others by reducing or eliminating regulatory requirements for fully vaccinated employees in certain circumstances. However, an employer must receive CMIA-compliant authorization from the fully vaccinated employee, in addition to documentation concerning that status, before allowing the employee to take advantage of the relaxed requirements. The employer needs a CMIA authorization because implementing the relaxed requirements necessitates that the employer use the employee’s confidential medical information for purposes other than those provided for in the CMIA.

The authorization should provide additional authority to the employer to disclose information about an employee’s vaccination status because allowing fully vaccinated employees to take advantage of the relaxed regulatory restrictions may lead to constructive disclosures of the employee’s vaccination status. For example, if the employer uses its employees’ vaccination information to allow fully vaccinated employees to remove their face coverings, it is arguable that the employer is effectively disclosing such employees’ statuses as fully vaccinated. While the likelihood of a legal claim based on such a disclosure is low, accounting for such disclosure in the authorization will reduce the risk of such a claim.

B. The Importance of Authorizations for Reasons Related to the Amended Cal/OSHA COVID-19 Regulations

The amended Cal/OSHA COVID-19 Regulations distinguish between fully vaccinated employees and those who are not fully vaccinated in terms of certain regulatory requirements. Specifically, the amended regulations allow for reduced regulatory restrictions with respect to the following subjects:

1. 1. Face covering requirements;[22]
   2. Exclusion of employees who had close contact COVID-19 exposure;[23] and
   3. COVID-19 testing of employees following a close contact COVID-19 exposure.[24]

However, employers may not reduce such regulatory restrictions for fully vaccinated employees unless such employees provide the employer addition CMIA use and disclosure authorizations, as the purposes for which the employer intends to use such information are not provided for in the CMIA. Additional use and disclosure authority will benefit both fully vaccinated employees and employers because such authorization will allow employees to take advantage of their vaccination status. It will also reduce operational costs related to the testing and exclusion of fully vaccinated employees. Since fully vaccinated employees likely will want to avail themselves of the benefits that their vaccination affords, employers may consider informing their employees of the workplace benefits of being fully vaccinated and authorizing additional use and disclosure of employees’ vaccination status to the employer.

C. Considerations before Providing Additional Benefits to Fully Vaccinated Employees

When using information about employees’ vaccination status for other legitimate and non-discriminatory business purposes not expressly provided for in the Cal/OSHA COVID-19 Regulations, employers should be mindful that certain employees who are not fully vaccinated may have qualifying disabilities that preclude their vaccination and/or hold sincere religious beliefs that prevent their vaccination. Therefore, employers should not provide other benefits to fully vaccinated employees that may result in the disparate treatment of employees who cannot be vaccinated and who are members of a protected classification.

Liebert Cassidy Whitmore recommends that, before an employer undertakes an action that provides or may be perceived as providing fully vaccinated employees a benefit that is limited to those employees, employers contact counsel to discuss potential implications related to employees who cannot be or do not want to be vaccinated for reasons related to a qualifying disability or a sincerely held religious belief.

D. Managing Employees Who Refuse to Authorize Use or Disclosure of Vaccination Status or Records

Employers must treat employees who refuse to provide the additional CMIA authorization as though they are not fully vaccinated for the purposes provided in the amended Cal/OSHA COVID-19 Regulations.

While the CMIA expressly prohibits discrimination against employees who refuse to provide authorization,[25] the CMIA also provides that an employee’s refusal to sign an authorization will not “prohibit an employer from taking such action as is necessary in the absence of [such] medical information.”[26] Therefore, the employer may take necessary actions in order to satisfy its other legal obligations, including those provided under the Cal/OSHA COVID-19 Regulations.

In the event that an employee produces a vaccination record to their employer, but refuses to authorize the employer’s use of such information for other legitimate and non-discriminatory purposes, the employer should acknowledge and accept the employee’s refusal to provide the employer the additional use authority. However, the employer should consider informing the employee that refusal to provide such authorization will require that the employer treat the employee as not fully vaccinated for all purposes, other than those expressly provided for in the CMIA. As provided above, this would include circumstances where the employer intends to use information about the employee’s vaccination status to exempt the employee from certain regulatory requirements that would otherwise apply, such as the face covering requirements.

While employers should encourage their employees to provide the requisite CMIA authorization necessary for employers to provide their fully vaccinated employees the benefits that their vaccination status affords them under the law, employers should also be prepared to manage employees who refuse to provide such additional use authorization and must consequently be treated as not fully vaccinated, even if the employer knows that the employee is fully vaccinated.

V. Conclusion

Complex legal requirements and changing regulatory obligations related to the use of vaccination records present unique challenges to employers as they attempt to navigate the reopening of their worksites and facilities and the return of their employees to those workplaces.

Liebert Cassidy Whitmore attorneys are familiar with the laws implicated and are available to assist employers with specific challenges related to these matters.

[1] The amended Cal/OSHA COVID-19 Regulations are available at the following web address: https://www.dir.ca.gov/OSHSB/documents/Jun172021-COVID-19-Prevention-Emergency-txtcourtesy-Readoption.pdf. The amended regulations define “fully vaccinated” to mean “the employer has documented that the person received, at least 14 days prior, either the second dose in a two-dose COVID-19 vaccine series or a single-dose COVID-19 vaccine. Vaccines must be FDA approved; have an emergency use authorization from the FDA; or, for persons fully vaccinated outside the United States, be listed for emergency use by the World Health Organization (WHO).” (See 8 C.C.R. § 3205(b)(9).) Importantly, the amended regulatory definition of “fully vaccinated” requires the employer to have documented such status in order to treat the employee as fully vaccinated. The amended Cal/OSHA COVID-19 Regulations allow fully vaccinated employees to go without face coverings (See 8 C.C.R. § 3205(c)(6)); be excepted from certain COVID-19 testing requirements if asymptomatic (See 8 C.C.R. § 3205(c)(3)(B)(5)); and be excepted from certain exclusion requirements if asymptomatic (See 8 C.C.R. § 3205(b)(9)(B)(1).)

[2] The Centers for Disease Control and Prevention (“CDC”) defines “fully vaccinated” to mean either two (2) weeks after an individual’s second (2nd) dose in a two-dose vaccination series (e.g., Pfizer/BioNTech or Moderna vaccines) or two (2) weeks after an individual’s single-dose vaccination (e.g., Johnson & Johnson Janssen vaccine).

[3] The legal advice provided herein assumes that the employer did not administer its own vaccination program of its employees. If the employer did administer its own vaccination program, other legal requirements will apply that are not discussed in this bulletin. Such employers should contact counsel for specific legal guidance concerning such issues.

[4] Equal Employment Opportunity Commission (“EEOC”), “What You Should Know About COVID-19 and the ADA, the Rehabilitation Act, and Other EEO Laws” (“EEOC Guidance”), K.4., K.9., https://www.eeoc.gov/wysk/what-you-should-know-about-covid-19-and-ada-rehabilitation-act-and-other-eeo-laws (Last updated on May 28, 2021).

[5] Department of Fair Employment and Housing (“DFEH”) “Employment Information on COVID-19” (“DFEH Guidance”), p. 10, https:/www.dfeh.ca.gov/wp-content/uploads/sites/32/2020/03/DFEH-Employment-Information-on-COVID-19-FAQ_ENG.pdf (Last updated on March 4, 2021).

[6] See the discussion in the following section of the bulletin. The Cal/OSHA COVID-19 Regulations define “fully vaccinated” to mean the employer “has documented” that the person received, at least 14 days prior, either the second dose in a two-dose COVID-19 vaccine series or a single-dose COVID-19 vaccine. Liebert Cassidy Whitmore recommends that if the employer elects to request vaccination information from its employees, the employer should request that employees provide documentation demonstrating the employees’ vaccination status. If the employer instead requests employees to attest or certify to their vaccination status, it should get the attestation or certification signed and in writing.

[7] See footnote 1.

[8] Requesting vaccination records from the CDC or an employee’s health care provider is consistent with California Department of Public Health (“CDPH”) guidance advising employers to do the same. (See CDPH, Vaccine Record Guidelines & Standards (Published on June 14, 2021), https://www.cdph.ca.gov/Programs/CID/DCDC/Pages/COVID-19/Vaccine-Record-Guidelines-Standards.aspx.) It is best practice to request vaccination records from the CDC or an employee’s health care provider, although an employee attestation meets the requirements set by the amended Cal/OSHA Regulations. (See footnote 1 (defining “fully vaccinated”).)

[9] See EEOC Guidance, K.5., https://www.eeoc.gov/wysk/what-you-should-know-about-covid-19-and-ada-rehabilitation-act-and-other-eeo-laws (Last updated on May 28, 2021).

[10] The analysis involves two steps: determining if there is a direct threat and, if there is, assessing whether a reasonable accommodation would reduce or eliminate the threat. This requires an individualized assessment of each unvaccinated employee and his or her unique circumstances. Additionally, the employer must consider whether providing a reasonable accommodation, absent undue hardship, would reduce or eliminate the threat. See EEOC Guidance, K.5., https://www.eeoc.gov/wysk/what-you-should-know-about-covid-19-and-ada-rehabilitation-act-and-other-eeo-laws (Last updated on May 28, 2021).

[11] EEOC Guidance, K.16., https://www.eeoc.gov/wysk/what-you-should-know-about-covid-19-and-ada-rehabilitation-act-and-other-eeo-laws (Last updated on May 28, 2021).

[12] See Penal Code §§ 319, 320 (defining and prohibiting lotteries, respectively).

[13] Civil Code §§ 56, et seq.

[14] See amended regulation 8 C.C.R. § 3205(c)(3)(C), https://www.dir.ca.gov/OSHSB/documents/Jun172021-COVID-19-Prevention-Emergency-txtcourtesy-Readoption.pdf.

[15] See 45 C.F.R. §§ 160, 162, 164.

[16] EEOC Guidance, K.4., https://www.eeoc.gov/wysk/what-you-should-know-about-covid-19-and-ada-rehabilitation-act-and-other-eeo-laws (Last updated on May 28, 2021).

[17] 29 C.F.R. §§ 1630.14(b)(1)(i)–(iii), (c)(1)(i)–(iii); 29 C.F.R. pt. 1630 app. § 1630.14(b); see also EEOC “Pandemic Preparedness in the Workplace and the Americans with Disabilities Act,” A.2., Footnote 19, https://www.eeoc.gov/laws/guidance/pandemic-preparedness-workplace-and-americans-disabilities-act (Last updated on March 19, 2020).

[18] Civil Code § 56.20(a).

[19] Civil Code § 56.20(a).

[20] See Civil Code § 56.21.

[21] See Proposed Regulations 8 C.C.R. §§ 3205-3205.4, https://www.dir.ca.gov/OSHSB/documents/Jun172021-COVID-19-Prevention-Emergency-txtcourtesy-Readoption.pdf.

[22] The amended Cal/OSHA COVID-19 Regulations allow fully vaccinated employees to go without face coverings. (See 8 C.C.R. § 3205(c)(6).)

[23] The amended Cal/OSHA COVID-19 Regulations allow fully vaccinated employees to be excepted from certain exclusion requirements if asymptomatic (See 8 C.C.R. § 3205(b)(9)(B)(1).)

[24] The amended Cal/OSHA COVID-19 Regulations allow fully vaccinated employees to be excepted from certain COVID-19 testing requirements if asymptomatic. (See 8 C.C.R. § 3205(c)(3)(B)(5).)

[25] See Civil Code § 56.20(b).

[26] Civil Code § 56.20(b).

This Special Bulletin is published for the benefit of the clients of Liebert Cassidy Whitmore. The information in this Special Bulletin should not be acted upon without professional advice.