Articles | Cases

Five tips for employers pondering what to do next about CDC masking guidance


While the U.S. Centers for Disease Control and Prevention (CDC) unexpectedly lifted many of its COVID-19 safety recommendations for people who are fully vaccinated, including mask and social-distancing guidelines (with some industry exceptions), OSHA and the Equal Employment Opportunity Commission (EEOC) have expressed their intent to address, but have not yet updated their guidance, in light of the new CDC guidance. The OSHA website notes, "OSHA is reviewing the recent CDC guidance and will update our materials on this website accordingly. Until those updates are complete, please refer to the CDC guidance for information on measures appropriate to protect fully vaccinated workers." Some employers are waiting for clearer OSHA guidance before making significant changes to their COVID-19 mitigation protocols.

In addition, there are state and local laws that may take precedent. Some jurisdictions may still have a Governor's mask mandate or an OSH Plan emergency temporary standard or state law that requires masking and distancing.

Employers facing complicated return to work issues are frustrated by the lack of guidance particularly on how to verify if an employee has been fully vaccinated and to what extent vaccinated workers can be treated differently from unvaccinated workers. While information is changing rapidly and it's critical to keep up with the federal, state, and local rules here are five tips to help navigate this challenging situation.

  1. Know what can be asked about vaccination status

    As COVID-19 work-related restrictions ease for the fully vaccinated, employers have legitimate business reasons to ask employees about their vaccination status. Essentially the EEOC has said it is lawful for employers to ask about vaccination status, to mandate a vaccine with certain exceptions for religious and disability-related reasons, and to offer incentives, as long as they are not coercive. Employers should limit the inquiry to a question that can be answered with a simple "yes" or "no," and be mindful of federal and state laws on disability, privacy, and discrimination if additional information is needed. The EEOC suggests warning employees not to provide any other medical information in response to your question. If an employee has not been vaccinated, the employer should never ask, "Why not?" as this can trigger information protected by the ADA and GINA.

    It's also important to understand local laws related to vaccinated status. In what appears to be a first-of-its-kind mandate, Santa Clara County in Northern California recently issued an order requiring business and government entities to ascertain and keep a record of the vaccination status of all personnel including employees, independent contractors, contractors, and vendors. Some states, such as Washington and Oregon require employers to demonstrate that they have verified vaccination status for workers who are not masked or socially distanced.

    On the other extreme, on May 7, Montana became the first jurisdiction to recognize an individual's vaccination status as a protected category. The law also prohibits employers from requiring employees to disclose their immunization status and bars employers from requiring employees to receive certain types of vaccines or to possess an immunity passport. In Florida, legal experts seem to have differing opinions on the law signed by Governor Ron DeSantis that banned vaccine passports. The law prohibits businesses from requiring patrons or customers to provide documentation certifying that they received the COVID-19 vaccine but doesn't specifically prohibit private businesses from requiring that their employees show proof of vaccination or certification that they recovered from the virus.

  2. Determine if and how you will require proof of vaccination

    While in most states it is lawful to require proof of the vaccination and more states are allowing employers to alter workplace safeguards for fully vaccinated employees, employers will need to decide what works best for their workplace and adheres to federal, state, and local laws. There is nothing in the CDC guidance that obligates the employer to verify vaccination status; however, employers may want to have proof of vaccination status before allowing employees to work without masks and may want to have all unvaccinated employees follow appropriate mitigation measures.

    Some options employers are using include making a copy of the white vaccination card, viewing the card and keeping a log of the information, using a self-attestation form, asking the question on daily healthcare screenings, or using the honor system. In New York, the Excelsior Pass registry provides digital proof of the vaccination. Employers should also consider whether vaccination records must be updated to account for potential booster vaccinations. Whenever information is collected, employers should explain how confidentiality is treated, provide consistent messaging about the processes, and training and talking points for managers.

    Again, it's important to stay current on state and local actions. Recent changes to Michigan Occupational Safety and Health Administration's (MIOSHA) emergency COVID-19 rules provide that fully vaccinated individuals need not be socially distanced or wear masks (unless "in the healthcare setting where patients may be present and when using airplane or public transportation if required by the latest CDC guidance"). If an employer chooses to eliminate the social distancing and mask requirements for fully vaccinated employees, the employer must do so in a "manner deemed effective for the place of employment," which "may include:

    1. Keeping records of whether employees are fully vaccinated persons.
    2. Posting signs in the work area reminding employees that are not fully vaccinated to wear face coverings and maintain appropriate distancing.
    3. Allowing or requiring remote work."

    Alternatively, employers may continue requiring face coverings and social distancing for all employees regardless of vaccination status.

  3. Know what records to maintain

    In recently updated guidance, the EEOC states, "If employers choose to obtain vaccination information from their employees, employers must keep vaccination information confidential pursuant to the ADA." This means it must be treated as confidential and kept separately from the employee's personnel file. Similarly, if the employer creates a tracking system or summary document, it should be treated confidentially, separate from employment records.

    The law firm Conn Maciel Carey LLP notes that from an OSHA perspective, the white cards would seem to meet the definition of a medical record under 29 C.F.R. 1910.1020(c)(6)(i). If an employer obtains a copy of the white card to substantiate and track vaccination status, it will have to maintain that record for the term of the employee's employment plus 30 years. However, "if, instead, an employer decides to generate its own tracking system or summary document for tracking employees' vaccination statuses that is created by an employee who is not a health care professional, that document would likely not be considered a medical record covered by the retention requirements of 29 C.F.R. 1910.1020."

  4. Be cautious when sharing information

    Since vaccination status records are confidential, they should only be shared with those who have a business need-to-know. When safety rules differ for vaccinated and unvaccinated employees, supervisors who enforce the policy have a bona fide need-to-know. They need to be properly trained about the confidential nature of the information, and how to answer questions from workers, and not make inquiries beyond what is necessary.

  5. Stay focused on the health and safety of workers

    The rapidly evolving and inconsistent guidance raises complicated questions for employers. Some states such as California still have mask mandates. For multi-jurisdictional employers, the safest approach might be to follow the most restrictive requirements and relax protocols uniformly when appropriate. Employers that aren't subject to more stringent local laws will have to decide whether to drop mandates or keep stricter rules in place. Such changes should be considered carefully based on the workplace setting, the type of workforce, and your risk tolerance.

    If workers are treated differently based on vaccination status such as interacting with the public, working in certain areas, using communal areas, and so on, it's critical to have valid justifications (confirmed with legal counsel) and follow the interactive process for workers unable to be vaccinated for medical and religious reasons. OSHA requires employers to maintain a workplace free of known safety and health hazards and has issued guidance stating that businesses should not treat unvaccinated employees differently than vaccinated employees. While the CDC guidance is a welcome step toward resuming normal activities, it is for the general public, and OSHA has enforcement authority for workplace safety.

    Employers need to consider the practical impact of changing the mitigation strategies, how to effectively manage them, and safeguard against bullying, harassment, or other inappropriate conduct. The impact on morale, retention, and recruiting as well as customers should be carefully weighed. Employers of large numbers of both vaccinated and unvaccinated individuals who work in enclosed spaces may prefer to move slowly until further regulatory guidance is available.