Pandemic conditions have improved enough for some employers to bring their employees back to the office, raising issues about whether to mandate vaccinations and how to manage partially inoculated workforces.
For some companies, however, scaling up their operations after months of pandemic-driven slowdowns means sending their workers—such as sales representatives or service providers—to their clients’ homes and offices. Some clients might want to know if those workers have been vaccinated.
Seyfarth Shaw attorney Karla Grossenbacher spoke to Bloomberg Law about the obligations and best practices related to companies communicating their workers’ vaccination status to their clients. Grossenbacher leads Seyfarth’s workplace privacy team, and its labor and employment practice in Washington, D.C.
The following conversation has been edited for clarity.
Does an employer have any legal obligations to disclose if they send an unvaccinated employee to a client’s location?
No. Absent some sort of contractual obligation negotiated between the employer and the client that would theoretically require such a disclosure, I don’t know of any legal obligation that an employer would have to reveal the vaccination status of their employees to a third party.
In fact, the legal obligation is quite the opposite. Employers must keep documentation or other confirmation of vaccination of their employees confidential.
What law creates that restriction?
The Americans with Disabilities Act creates that restriction. The Equal Employment Opportunity Commission put out guidance on May 28 that states that documentation or other confirmation of vaccination is subject to ADA confidentiality requirements. The ADA requires that confidential information be kept separate from the personnel file and treated as a confidential medical record.
There are only three exceptions listed in the regulations in terms of who the employer can share that information with. As you might guess, a client to which the employee goes on site is not one of those exceptions. [Grossenbacher later added that managers and supervisors can be informed so that they’re aware of necessary accommodations and restrictions; first aid and safety personnel too, if the disability necessitates emergency treatment; and government officials may be told in the course of investigating regulatory compliance or a potential violation.]
How is that restriction enforced?
An employee can file a charge with the EEOC and would presumably need to do so to exhaust their administrative remedies in order to file a lawsuit in court. Of course the EEOC has the ability to file lawsuits in court over ADA violations, including those asserting violations of the ADA’s confidentiality requirements.
What are the penalties for unlawfully disclosing confidential medical information?
The standard damages available in an ADA lawsuit would apply. You can get compensatory and punitive damages, which are capped, and attorneys’ fees. Although tangible injury is required to file suit under the ADA for violation of its confidentiality requirements, courts have held that emotional distress and other non-economic injuries are sufficient to state a claim.
When you look at the cases claiming ADA confidentiality violations, typically people are seeking emotional distress type damages: “You revealed my medical information and that caused me shame and embarrassment.” You could see somebody making the argument with respect to Covid vaccination status.
Also, there could be tort liability for invasion of privacy or disclosure of private facts, which unlike the ADA would be uncapped compensatory and punitive damages.
Are there ways for an employer to communicate something about the vaccination status of employees entering a client’s location without violating the law?
Well, that’s tricky because we start with the proposition that the EEOC has said employee vaccination status is confidential. So it would be best to have the client ask the employee directly for the information. The client doesn’t have an employment relationship with the employee, absent some sort of joint employment relationship. They actually have greater freedom to ask things of employees, like their vaccination status.
If that’s not possible, I suppose there could be some way where the employer could communicate that the employee is fit for duty or satisfies the client’s requirements for on-site visits. But if one of those requirements is that they must be fully vaccinated, then the employer would be disclosing confirmation of vaccination status, so it is a difficult issue for employers to confront.
Hopefully the EEOC will continue to update its guidance and give us their thoughts on whether that would be a violation of confidentiality for employers who have a business relationship with a client and send their employees on site, and whether there would be an exception to that, like there was for communicating positive Covid test results.
VIDEO: As employers are making plans to return to their workplaces. How quickly they succeed will likely depend on how many of their employees get vaccinated.