May 14, 2021 | 5 minute read

NOTE: Following this update, the EEOC published revised guidance regarding, among other things, confidentiality status of employee vaccine records.  For updated information, please see Bracewell’s alert entitled “EEOC Issues Guidance Confirming Vaccine Incentives are Lawful, Among Other Updates”, which can be found here.


On Thursday, May 13, 2021, the Centers for Disease Control and Prevention (CDC) delivered welcome news for vaccinated individuals in the form of revised Interim Public Health Recommendations for Fully Vaccinated People. The new guidance provides: “[f]ully vaccinated people can resume activities without wearing a mask or physically distancing, except where required by federal, state, local, tribal, or territorial laws, rules, and regulations, including local business and workplace guidance.”  In general, an individual is considered fully vaccinated two weeks after the second dose in the case of a two-dose series vaccine or two weeks after a the first dose in a single-dose vaccine.

With this announcement, employers are likely to re-evaluate their workplace mask policies.  In doing so, they must keep in mind not only the CDC recommendations but also other legal standards and guidance, such as state and local laws and guidance issued by the Equal Employment Opportunity Commission (EEOC) and the Occupational Safety and Health Administration (OSHA).  For example in California, L.A. County public health officials swiftly responded to the CDC guidance by stating businesses must still adhere to the distancing and masking requirements at workplaces until the California Division of Occupational Safety and Health changes its guidelines.  Likewise, employers may want to consider that federal OSHA’s current guidance—which has remained unchanged since January—identifies wearing masks in the workplace as a safety measure.

Here are some key questions and answers employers should consider moving forward.

1.  Can fully vaccinated employees go mask-less in a meeting with unvaccinated employees?
Yes.  The new CDC Guidance provides that “fully vaccinated people can resume activities without wearing a mask or physically distancing,” subject to applicable laws and regulations and workplace guidance.  Therefore, vaccinated employees may be permitted to attend meetings with unvaccinated employees without the vaccinated employees wearing a mask.  The CDC’s position is based on the efficacy of the vaccine in protecting vaccinated employees against symptomatic and severe COVID-19 as well as the “growing body of evidence” suggesting that fully vaccinated people are less likely to transmit the virus to others.  In sum, a fully vaccinated employee poses little risk to an unvaccinated employee.

2. If an employer permits fully vaccinated employees to be mask-less in the workplace, should it require proof of vaccination?
Maybe.  While many employers will be comfortable relying on the “honor system,” employers may want to consider asking for proof of vaccination from employees who choose not to wear a mask in the workplace.  Requiring proof of vaccination for mask-less employees could be one way for the employer to demonstrate that it is providing a safe workplace. For many employers, this requirement will represent a significant change to their approach to the vaccine. Recognizing the potential for certain laws to implicate privacy concerns, employers may want to describe the policy as a voluntary disclosure of vaccination status, i.e., employees are only required to submit proof of vaccination if they want to be mask-free in the workplace.

3. Can an employer require stickers, pins, badges or other forms of identification for vaccinated employees in the workplace?
Maybe.  Depending on factors such as work location and the method of collecting information, disclosing employee vaccination status may violate confidentiality rules related to medical or personal health information.  There are a variety of federal, state and local laws and regulations that impact an employer’s obligations to maintain the confidentiality of certain employee information, including the Americans with Disabilities Act (ADA), the Genetic Information Nondiscrimination Act (GINA), the Family and Medical Leave Act (FMLA), and the Health Insurance Portability and Accountability Act (HIPAA).

The ADA obligates an employer to maintain confidentiality of information obtained through a medical examination and/or inquiry of an employee.  This information must be “collected and maintained on separate forms and in separate medical files and be treated as a confidential medical record, except that: (i) supervisors and managers may be informed regarding necessary restrictions on the work or duties of the employee and necessary accommodations; (ii) first aid and safety personnel may be informed, when appropriate, if the disability might require emergency treatment; and (iii) government officials investigating compliance with this part [of the regulations] shall be provided relevant information on request.”

In its Technical Assistance Questions and Answers: What You Should Know About COVID-19 and the ADA, the Rehabilitation Act, and Other EEO Laws (last updated in December 2020), the EEOC has advised that asking or requiring an employee to show proof of receipt of a COVID-19 vaccination is not a disability-related inquiry.  The EEOC did caution employers not to ask any follow-up questions, such as asking why an individual did not receive a vaccination, as that question may elicit information about a disability and would be subject to the ADA standard that an inquiry be “job-related and consistent with business necessity.”

Accordingly, absent further guidance or rulings to the contrary, it appears that information regarding vaccination status alone should not be subject to the confidentiality requirements as set forth in the ADA, as it was not obtained through a medical examination and/or inquiry of an employee.  However, the analysis should not end here.  An employer must review applicable state and local laws and regulations.  For example, some states have express regulations governing an employer’s collection, storage, and use of employee medical information.  Moreover, certain state statutes governing privacy and data breaches address the storage and release of medical information.  In addition, state privacy laws could be implicated.  Further, if an employer obtains information regarding vaccine status through a health care provider or health plan, rather than directly through the employee, HIPAA confidentiality requirements may be implicated.

As referenced above in the answer to Question 2, an employer who wants to implement an identification system may mitigate risk by using a voluntary disclosure policy.  If a vaccinated employee prefers not to disclose the employee’s vaccine status to the employer or wear the identification item, the employee would simply continue to wear a mask in the workplace.

Employers may also consider messaging that the pin/sticker/badge indicates an employee has been approved to be mask-free in the workplace, rather than that the employee has been vaccinated.  While the distinction may seem slight, it could be meaningful in the context of a challenge to the employer’s confidentiality practices.  For example, because there may be a small number of unvaccinated employees with disabilities who have requested and been approved for a reasonable accommodation of not wearing a mask, the fact that an employee can be identified as being approved not to wear a mask does not automatically equate to the disclosure that the employee has been vaccinated.

4. Will state laws impact how employers react to this new CDC guidance?
Potentially, yes. There have been bills introduced in legislatures in many states to prohibit “vaccine passports” or other inquiries concerning an individual’s vaccination status. In Florida, Gov. Ron DeSantis already signed legislation prohibiting businesses from requiring customers to offer proof of vaccination—though that statute does not appear to regulate the employer-employee relationship.  In fact, the only bill passed by a state legislature that would explicitly regulate vaccine passports in the employer-employee relationship was in Wisconsin—and Gov. Tony Evers vetoed that measure.

Importantly, there is legislation currently pending in some states that would explicitly prohibit employers from discriminating against employees based upon vaccination status. For instance, a bill introduced in the Texas Legislature that is currently pending in committee would amend the state’s anti-discrimination law specifically to ban any adverse employment action against an employee based upon vaccination status.  While that Texas bill very well may not become law, the proposal does illustrate what we should expect to see in some state legislatures going forward.

In addition to proposed legislation, there have been executive orders by governors in a number of states, including Montana and Texas for example, prohibiting state and local governmental entities and some private sector businesses from requiring vaccine passports.  However, these orders do not appear to regulate private sector employers’ relationships with their employees.

The efforts to enact state law restrictions on employers will likely intensify with this new guidance from the CDC.  Any employer that intends to make an effort in response to this new guidance to ascertain which of its employees have been vaccinated or impose different standards on vaccinated and unvaccinated employees, will need to carefully monitor state law developments to assure their plans do not run afoul of any state legal restrictions.