In response to COVID-19 vaccination mandates and employer-mandated vaccination policies, federal agencies continue to issue guidance.  The U.S. Equal Employment Opportunity Commission (EEOC) and the U.S. Health and Human Services’ Office for Civil Rights (OCR) have released additional guidance addressing common employer concerns regarding vaccination status, discrimination, and reasonable accommodations.

EEOC Guidance

On October 25, 2021, the EEOC updated and expanded its technical assistance related to COVID-19, addressing questions regarding the interplay between federal anti-discrimination laws and COVID-19 vaccination mandates.  Specifically, the updates relate to the application of federal anti-discrimination law to objections to vaccination based on sincerely held religious beliefs.

The EEOC enforces the Americans with Disabilities Act (ADA), which, among other things, places limits on medical and disabled-related inquiries, prohibits disability discrimination, and requires employers to consider and grant requests for reasonable accommodations to individuals with disabilities, which would include those who are unable to comply with COVID-19 vaccination mandates because of medical issues. The EEOC also enforces Title VII of the Civil Rights Act (Title VII), which prohibits religious discrimination and requires employers to consider requests for reasonable accommodations.  Neither the ADA nor Title VII prevents employers from requiring all employees physically entering the workplace to be fully vaccinated against COVID-19, subject to the reasonable accommodation provisions of the ADA and Title VII discussed below.


Although we have addressed these issues before, we revisit them here for purposes of context.  With limited exceptions, the ADA requires employers to keep confidential any medical information they learn about any applicant or employee.  However, the ADA does not prevent employers from complying with CDC guidance and vaccination mandates. Regarding the confidentiality of medical information related to COVID-19, employers must keep the following guidance in mind:

  • Employers must maintain all medical information related to COVID-19 in existing medical files separate from personnel files.
  • Employers that require daily temperature checks may maintain a log of the results but must maintain the confidentiality of the data.
  • Employers may disclose the name of an employee to a public health agency when it learns that the employee has tested positive for COVID-19. However, employers should make every effort to limit the number of people who get to know the name of the employee who tested positive.
  • If an employee is working remotely or on leave while exhibiting COVID-19 symptoms, the employer may not disclose the reason for the leave, just the fact that the individual is on leave.
  • An employer may withdraw a job offer when it needs an applicant with COVID-19 or symptoms to start work immediately. The fact that an applicant is at a higher risk from COVID-19 does not justify unilaterally postponing a start date or withdrawing a job offer.  However, an employer may choose to allow telework.

The ADA also requires employers to provide reasonable accommodations to individuals with disabilities unless the accommodation would pose an undue hardship.  An employee with a disability who does not get vaccinated because of the disability must let the employer know that he or she needs a reasonable accommodation. Employers are obligated to engage in an interactive process to identify workplace accommodation options that do not impose an undue hardship on the employer.  Under the ADA, courts define “undue hardship” as significant difficultly or expense.  If the requested accommodation would result in undue hardship, the employer must offer an alternative accommodation if one is available absent undue hardship.  In addition, employers can refuse an accommodation if allowing the unvaccinated employee to continue working would pose a direct threat to the health and safety of the employee or others.

Title VII

Title VII  recognizes the concept of reasonable accommodations based on religious objections.  With vaccine mandates stemming from both federal and state levels, the EEOC technical guidance addresses objections to employer vaccination requirements based on sincerely held religious beliefs.

Employees and applicants must inform their employers if they seek an exception to the employer’s vaccine mandate due to a sincerely held religious belief, practice or observance.  Employers are required to consider requests for religious accommodations and must assume that an employee’s request for a religious accommodation is based on a sincerely held religious belief, practice or observance.  However, if an employer knows of facts that provide an objective basis for questioning the religious nature or sincerity of a belief, practice or observance, the employer may request additional supporting information.  Employers that demonstrate “undue hardship” or direct threat criteria are not required to accommodate an employee’s request for an accommodation. Under Title VII, courts define “undue hardship” as having more than minimal cost or burden.  This is an easier standard for employers to meet than the ADA standard.

OCR Guidance

On September 30, 2021, OCR issued guidance “to help consumers, businesses, and health care entities understand when the Health Insurance Portability and Accountability Act of 1996 (HIPAA) applies to disclosures about COVID-19 vaccination status.” OCR issued the following guidance regarding employers inquiring into an employee’s vaccination status and whether such inquiry is in violation of HIPAA:

  • The HIPAA Privacy Rule does not prohibit any business from asking whether an individual has received a particular vaccine, including COVID-19 vaccines.
  • The HIPAA Privacy Rule does not prohibit businesses from asking whether their customers or clients have received a COVID-19 vaccine.
  • The HIPAA Privacy Rule does not apply to employment records, including employment records held by covered entities or business associates in their capacity as employers. Generally, the Privacy Rule does not regulate what information can be requested from employees as part of the terms and conditions of employment that an employer may impose on its workforce. Therefore, under HIPAA, an employer is not prohibited from requiring a workforce member to disclose whether such individual has received a COVID-19 vaccine to the employer, clients, or other parties.
  • The HIPAA Privacy Rule does not prohibit an employer from requiring or requesting each employee to:
    • Provide documentation of their COVID-19 or flu vaccination to their current or prospective employer.
    • Sign a HIPAA authorization for a covered health care provider to disclose the employee’s COVID-19 vaccination record to their employer.
    • Disclose whether they have received a COVID-19 vaccine in response to queries from current or prospective patients.
  • The HIPAA Privacy Rule does prohibit covered entities and their business associates from using or disclosing an individual’s protected health information (PHI) (e.g. information about whether the individual has received a vaccine) except with the individual’s authorization or as otherwise expressly permitted or required by the Privacy Rule.


Employers should be mindful of the restrictions that the HIPAA Privacy Rule does and does not impose with regard to COVID-19 vaccination status as set forth in the OCR Guidance.  When responding to reasonable accommodation requests under both the ADA or Title VII, employers must consider them on an individualized case-by-case basis.  Employers should not assume that there is no reasonable accommodation that would permit the employee to continue to perform the essential functions of the job.  Employers must engage in an interactive dialogue with employees who might need a reasonable accommodation.  Although employers are generally not required to provide the specific accommodation requested if a suitable alternative accommodation exists, depending on the employee’s job and the workplace, employers should  consider all the options, including but not limited to telework, regular testing, mask mandates, social distance requirements, or reassignment, before denying an accommodation request.  It is unlawful for an employer to disclose that an employee is receiving a reasonable accommodation or to retaliate against an employee for requesting an accommodation.  We will keep you informed of further developments on vaccine mandates and employer obligations.  In the meantime, Murtha Cullina’s attorneys are prepared to provide guidance on these and related issues.