Eager for your workers to get vaccinated and return to the workplace? You are not alone. As employers explore options for returning employees to the workplace, questions linger about how to track who has – and who has not – been vaccinated. Employers need to be mindful of how they ask for vaccination-related information and what they do with the information once it has been provided.

There are several ways vaccination information can be tracked, recorded, and stored. When deciding which method will work best, employers must keep in mind employee protections under anti-discrimination and Health Insurance Portability and Accountability Act (HIPPA) laws. This is especially important when questioning individuals who choose not to be vaccinated and the reasons behind their decision.[1] Whether the employer utilizes a third-party risk management provider to gather/store vaccination information or chooses to track things in-house, there are a few best practices to keep in mind:

• Asking or requiring an employee to show proof of receipt of a COVID-19 vaccination is not considered a disability-related question. (See FN1)
• Before soliciting vaccination information from employees, the employer should answer the question, “who wants the information, and why?” (e.g., government tracking purposes, customer inquiry, or internal health and safety protocols?)
• Consider the following guidelines when creating a vaccination information request form:
  • Make sure the request is not likely to cause the individual to disclose information about a disability (e.g., do not ask for an explanation if the individual indicates they did not receive the vaccination)
  • Make clear the request is not asking the individual to provide any medical information
  • Create a tracking system that allows follow up with individuals who indicate they are not yet fully vaccinated or those who decline to provide their vaccination status.
  • Employers subject to the California Consumer Privacy Act (CCPA) may want to include CCPA notice[2] A sample CCPA Notice may be found here[3].
  • Be sure reasonable safeguard measures are in place to protect the vaccination information provided. This may include a review of existing access, disclosure, and record retention policies.