Digital Vaccine Passports & the Legal Risks for Employers

Immediately after the CDC issued new guidance loosening restrictions for vaccinated Americans, many employers are starting to wonder whether post-pandemic life is nearly in our grasp. After a year of isolation, people are ready to travel, eat indoors at restaurants, attend movies and concerts with friends, and safely return to the workplace. While the prospect is exciting, it is also nerve-wracking for those wondering how we will be able determine who is fully vaccinated. It is also worth remembering that with few exceptions, the CDC has thus far stated that fully vaccinated individuals must continue to follow mask-wearing, distancing, handwashing and other COVID-19 protocols. Employers, nevertheless, are now considering whether digital vaccine passports are the key to returning to normal life and getting back into the workplace.

While the concept of digital vaccine passports might seem like a perfect solution, implementation is muddled not only by administrative feasibility, but the web of legal and business considerations raised if requiring the passport to return to the workplace or enter a business. This article untangles some of these complex legal considerations, including privacy and ethical concerns, offering employers guidance in evaluating their feasibility at the workplace.

What is a digital vaccine passport?

Companies across the world are hard at work developing secure app-based systems for a digital vaccine passport—documentation you can easily pull up on your mobile phone as an app or through the digital wallet feature, proving that you have been fully vaccinated against COVID-19. The passport is essentially a digital ID card (whether app based or a QR code), which can be scanned to confirm the holder’s vaccine status. The goal of digitizing proof of vaccination is seemingly simple—efficiency, ease and harmony across industries—most prominently in travel, hospitality, entertainment and health care.

The idea of requiring individuals to carry a digital vaccine passport to travel, visit certain businesses, or just to work has already provoked heated debate, including geopolitical gamesmanship in the travel industry as well as the threat of discrimination. The latter includes not only grave apprehension toward the unpredictability of digital privacy, but the liability employers could face in requiring employees to be vaccinated to return to work.

What is going on in the rest of the world?

Britain, Denmark, several additional European countries and Thailand have announced plans to roll out digital vaccine passport programs, to be utilized across industries. Israel became the first to implement its digitized program in late February 2021, capitalizing on its high vaccination rate. Several airlines and tourism-reliant industries or destinations will also require some form of proof of vaccination for employees and patrons. Specifically, Etihad Airways and Emirates will start using a digital travel pass developed by the International Air Transport Association. Further, the World Economic Forum and the Commons Project Foundation, a Swiss nonprofit, are testing a digital vaccine passport called CommonPass.

Are vaccine passports legal?

While requiring proof of vaccination may be legal, businesses and employers should carefully evaluate potential legal consequences and practical considerations pertinent to their industry.

Recent guidance issued by the EEOC reminds employers that employees can be required to show proof of vaccination before returning to work—with certain important exceptions. Many employers have long been requiring workers to submit temperature checks and health questionnaires before entering the premises. This right, however, is not absolute. Even in the context of digital vaccine passports, employers must be prepared to accommodate situations where employees are unable to receive the vaccine for disability-related or religious reasons.

Guidance issued by California workplace authorities on March 4 is illustrative of the hurdles employers across the country face if they mandate the vaccine: They cannot discriminate against or harass employees on the basis of a protected characteristic, must provide disability-related or religious accommodations where necessary, and cannot retaliate against anyone for requesting accommodations.

Disability-Related Accommodations

Under EEOC (and California) guidance, if an employee refuses vaccine due to disability, the employer is obligated to engage in the interactive process to determine the availability of reasonable accommodation without causing the business undue hardship. When confronted with employees refusing the vaccine due to their disability, it is critical employers remember that whether a reasonable accommodation exists is a fact-specific determination. Thus, each interactive process is unique to the individual employee and job.

Some suggestions for potential accommodations in this context include the ability to work from home and whether reasonable procedures and safeguards may be implemented at the worksite that would enable the employee to work without endangering themselves or others. While California authorities do not offer specific “reasonable procedures and safeguards,” appropriate considerations include the use of masks and other personal protective equipment (PPE), social distancing or perhaps even moving the disabled employee to an enclosed area to work. Of course, in reality, the employer will most likely have to provide more than one of these safeguards. Moreover, if employers have complied with these same procedures over the past year and the work performance has been meeting business expectations, it may be difficult to show that these seemingly cost-effective safeguards would constitute business hardship.

Religious Accommodations

Another consideration employers must take into account relates to Title VII of the Civil Rights Act and protection for employees who refuse vaccines over sincerely held religious beliefs. Though businesses can require employees to provide proof of inoculation, it should be prepared to provide a reasonable accommodation if an employee’s sincerely held religious belief, practice, or observance prevents them from receiving the vaccination—unless the accommodation would pose an undue hardship under Title VII.

The EEOC uses a very broad definition of “religion” that goes beyond membership in a church and includes firmly and sincerely held moral or ethical beliefs. For instance, an employee’s objection could be based on a moral belief against receiving certain chemicals in the body. When dealing with an employee’s request for accommodation, employers should assume that it is based on a sincerely held belief. Though employers can request supporting documentation if there is an objective basis for questing the belief, this is a very sensitive area of law and employers should coordinate with legal counsel before taking any steps in this regard.

What are the privacy concerns?

Despite the complex legal risks associated with a digital vaccine passport, one thing is for certain—the endeavor is controversial and raises enormous concerns for health privacy and data sharing. The managing system of the app must therefore be trustworthy, requiring intuitive forethought for an array of factors surrounding design and deployment. Accordingly, resilience to data breaches and the reliability of authentication present monumental challenge. Biometrics—specifically, facial recognition linked to a camera system—are often considered a solution to authenticity concerns. However, researchers and technologists also point to the risk of bias in algorithms. Thus, leaders in data science and big tech are exploring techniques for encryption and privacy-enhancing data management, as well as redefining the algorithms that monitor, predict, and react to anomalies in the flow and use of personal data.

In light of huge privacy concerns, the country’s tech giants and health care organizations have joined together and fueled rapid advancement in the realm of biometrics and the evolution of identity systems. One coalition of leading technology and healthcare companies—the Vaccine Credential Initiative—has a goal to develop universal standards for vaccine credential apps to achieve equitable accessibility.

But technologists also warn of further challenge—time. In the short term, the public should be wary of rushed tech solutions allowing one-use apps. The creation of enduring and stable ethical technology that will not store private data or make it possible to track users takes ample time and resources. Employers may feel the pull to implement the first solution presented to them in order to regain normalcy as quickly as possible, but doing so may not be the best course of action.

There is no doubt that vaccine passports create a relatively strange (and perhaps uncomfortable) dynamic, adding volumes to the personal and sensitive data that will be routinely collected and willingly given for a privilege (whether to attend a baseball game or return to work). As our lives become more dependent on the evolving ecosystem of digital data storage, employers must strive to be alert and informed as to the technical infrastructure and development behind a future digital passport.

For example, it is important to understand the inherent risks (despite proactive protective measures) in digital data storage to ensure that safeguards are implemented to maintain data security and integrity. This may include necessary assurance that the employer’s smartphone (or other collection device) is not storing the employee’s information for any purpose longer than simple verification.

What are the ethical concerns?

Although proof of vaccination to participate in certain activities and enter specific countries is not a new concept, there is little (if any) precedent for society-wide restrictions and the use of a digitized screening process. Accordingly, much of the debate is focused on the proven and continued inequitable distribution of the vaccine to people of color and poorer communities. In requiring proof of vaccination, vaccinated populations are thus bestowed opportunities that populations without the same access to the vaccine are not provided. This may lead to distressing and unfair results—professional/upper class white populations disproportionately allowed into the workplace, shops, sports events, and restaurants, while people of color or members of the working class are disproportionately left out. If an employer requires employees to carry a vaccine passport, segments of a diverse workforce may be negatively impacted.

Thus, before adopting a digital vaccine passport, it is critical that employers evaluate these ethical considerations and remain vigilant in identifying the potential for the disparate impact caused by inequitable national vaccine distribution.

Where does this leave employers?

It is still unclear what will happen in the coming weeks and months with respect to the use of digital vaccine passports. Will they be widely used in an effort to bring us back to pre-pandemic life, or are they so fraught with risk that they become little-used oddities? President Joe Biden included a directive for government agencies to “asses the feasibility” of linking COVID-19 vaccinations to international vaccination certificates and producing digital versions of them, which may be a harbinger that digital vaccine passports will be given serious consideration in the general business sector. While several domestic airlines and cruise lines have implemented digital health requirements, as it stands there is no national COVID-19 vaccination certification or “passport” yet.

While this article covered most of the obvious legal risks involved with such a program, the full extent of the legal ramifications related to digital vaccine passports remains unknown. If your business is considering requiring proof of inoculation for employees (or patrons), you should work closely with counsel to consider the legal and business risks against the benefit to the business as a whole.

Emily N. Litzinger is a partner at Fisher Phillips and practices out of the firm’s Louisville office. She is a trusted adviser and experienced litigator who counsels and defends employers through the intricacies of labor and employment law and works with her clients to develop preventative strategies to ensure compliance and avoid costly litigation.

Alexa R. Hanlon is an associate and practices out of the firm’s Sacramento office. She defends and counsels clients on rapidly changing employment laws, including workplace discrimination, harassment and wage and hour issues.