The Vaccination Conundrum

The great COVID-19 vaccination debate continues. Slowly but surely, however, federal regulators are clarifying the legal parameters around asking for evidence of and requiring vaccinations in the workplace.

President Biden has directed the Department of Labor’s Occupational Safety and Health Administration (OSHA) to issue rules requiring employers with 100 or more employees to mandate that their employees be vaccinated or be tested on a regular basis. There are a host of implementation issues expected to be addressed in the forthcoming regulations (are teleworking employees subject to these requirements, and who pays for the testing if the employer allows that as an option, for example).

Many employers appear to be very supportive of this initiative, as it removes them to some extent from the middle of the debate between those who want vaccination mandates for everyone and those who do not want to be subject to such requirements. But a lawsuit challenging the mandate has already been filed, and more will likely be in the offing once the OSHA rules actually are promulgated.

In the interim, the U.S. Department of Health and Human Services (HHS) issued guidance on Sept. 30 explaining why the Health Insurance Portability and Accountability Act (HIPAA) privacy regime (the Privacy Rule), which applies to all employers regardless of size, does not bar businesses from asking for and maintaining employee vaccination information.

As HHS explains in that guidance, the Privacy Rule generally does not regulate the ability to request vaccination information from patients, employees and visitors regardless of whether the request is made by an employer, school, store, restaurant, entertainment venue or another individual. It instead regulates the use and disclosure of such information without prior consent.

HHS also made clear that the Privacy Rule does not prohibit an employer from requiring a workforce member to disclose his or her vaccination status to the employer, clients, or other parties (including other employees). The documentation provided to demonstrate vaccination must, however, be kept confidential and stored separately from the employee’s personnel files in accordance with the Americans with Disabilities Act (ADA) requirements.

A health provider, insurer or insurance plan (or one of their business associates) generally may provide an individual’s vaccination documentation directly to a third party only if it has received affirmative consent from that individual to do so. In its guidance, HHS outlined a prior consent exception permitting a health provider to disclose protected health information related to an individual’s vaccination status directly to an individual’s employer without that individual’s affirmative prior consent if the following conditions are satisfied:

• The employer has requested the documentation
• The disclosure consists of findings related to work-related illness or workplace-related medical surveillance
• The employer needs the information to comply with legal requirements (including the OSHA mandates) and
• The provider provides written notice to the individual that the information will be disclosed (this is solely a notification requirement).

In its Sept. 30 guidance, however, HHS also goes much further than just outlining the rules that apply to requiring disclosure of vaccination status, noting that neither the Privacy Rule nor any other federal law prevents an employer from requiring that all employees physically entering the workplace be vaccinated against COVID-19, subject to reasonable accommodation requirements for individuals that have documented medical reasons prohibiting them from receiving the vaccination or who have legitimate religious objections to doing so.

As noted in prior columns, employers that impose vaccination mandates are required to make such accommodations only if—in the context of their businesses—such accommodations are “reasonable.” For some, teleworking may be a viable accommodation. For jobs that cannot be done remotely, “reasonable” accommodations may include masking and physically separating the non-vaccinated individual from vaccinated employees if such physical separation is feasible.

The nuances of the final OSHA mandates and the regional differences in employee-related vaccination demands and objections undoubtedly will continue to drive a range of employer-imposed requirements. An increasing percentage of employers already are requiring employees to be vaccinated to be in the workplace, in part because their vaccinated employees are demanding such policies. The administrative burdens associated with regular testing requirements for unvaccinated employees may spur an increase in the percentage of employers imposing such mandates.

As noted at the outset, one issue being watched closely is whether OSHA will require an employer to pay for the testing if the employer offers that option to its employees. In the absence of any such OSHA requirement, there do not appear to be any legal impediments to requiring employees to pay for their own testing.

Employers that decide to allow the testing option may seek to subsidize the costs of allowing that testing alternative by imposing health plan surcharges on non-vaccinated employees. Delta Airlines already is imposing a $200 monthly surcharge on unvaccinated employees enrolled in its health plan presumably through a wellness plan construct that allows the imposition of such penalties on those who do not satisfy the wellness plan requirements—here, being vaccinated—(again, subject to reasonable accommodation requirements for those who cannot be vaccinated for properly documented medical or religious reasons).

Because the wellness plan rules are not within OSHA’s purview, it is very unlikely that anything it issues will bar this option, and I believe it equally unlikely that the EEOC, DOL or HHS—which together do have wellness plan regulatory authority—would step in to bar this approach given the general Biden administration pressure to maximize vaccination incentives.

The final story remains unwritten, but the COVID-19 vaccination legal framework on what can and cannot be done is being clarified slowly but surely. The bottom line: more to come.