Updated 9/10/21
Small businesses with 100 employees or more may soon be required to mandate employee vaccines. That’s the top take away from President Biden’s newly released COVID-19 Action Plan. If the new rules are enacted businesses could also be required to provide paid time off for employees to get vaccinated. These orders are expected to be challenged but if enacted could take effect within a few weeks. The administration is also requiring that federal workers and employees of federal government contractors be vaccinated. For more information on how to help get your employees vaccinated check out the U.S. Chamber Foundation's downloadable Employee Vaccination Guide.
________________________________________________
Businesses across the globe are encouraging and even mandating their employees to receive the COVID-19 vaccination. One way to enforce a vaccine policy is through self-attestation — asking employees to inform the company of their vaccine status.
Because self-attestation relies on the honor system, there are multiple pros and cons to this method. One advantage is that a self-attestation policy makes it easy for employees to “prove” they have been vaccinated, said Glenn S. Grindlinger, regional practice lead for Fox Rothschild's Labor & Employment Department. On the other hand, unless the employer spot checks the self-attestations and asks to see a vaccination record, “there is little risk to the employee that [they] will be reprimanded if they lied on the form,” he added.
If your company is considering a vaccine self-attestation policy, here are your options for doing it right while complying with the Health Insurance Portability and Accountability Act (HIPAA) and other laws.
[Read more: Can Small Businesses Mandate Employee Vaccinations?]
What is self-attestation?
Self-attestation regarding vaccines is when an employer asks its employees to share their COVID-19 vaccine status. Self-attestation doesn’t necessarily require physical or electronic proof such as a vaccination record card; instead, employees are typically asked to complete and sign a form confirming their status.
“[Employees] do not need to search for their COVID vaccine card, which they may have received months ago and misplaced,” Grindlinger explained. “It [also] helps foster trust between the employer and the employee as the employer is relying on the employee being truthful in their self-attestation, which also provides the employee with the knowledge that the employer will rely on the employee’s say-so about their vaccination status.”
However, employers should also be aware that not requiring proof of vaccination could give some employees a chance to lie on their forms.
“A certain percentage of people are going to lie about having the required vaccinations and then they will be working in a place that is supposed to protect everyone else from infections,” said Austin Dowsy, HR manager at Aimvein.
If vaccinations are not mandatory in your workplace, you will have to decide how to handle situations in which employees are found to be lying on their self-attestation form.
“Most companies will terminate an employee who lies about their college degree or other credential,” said Josh Bersin, HR global analyst and founder and CEO of The Josh Bersin Company. “I think a similar policy will end up emerging for vaccine status issues.”
I believe the soundest approach is to make a strict, clear and unambiguous policy here and enforce it. If not, you risk ending up being branded a ‘non-safe’ employer or company to do business with.
Josh Bersin, HR global analyst and founder and CEO of The Josh Bersin Company
Is asking for vaccination proof a violation of HIPAA?
The Health Insurance Portability and Accountability Act of 1996 was enacted to protect data privacy while safeguarding health information. HIPAA’s main objectives are to reduce healthcare coverage costs and to control how health information is stored by healthcare providers in case of data theft. To implement HIPAA, the U.S. Department of Health and Human Services (HHS) created the Standards for Privacy of Individually Identifiable Health Information, commonly known as the HIPAA Privacy Rule. This rule addressed individuals disclosing their personal medical information with organizations which are subject to the Privacy Rule. Patients also have the right to receive their personal health information under the Privacy Rule.
Many businesses are confused as to whether or not asking employees for their vaccination or medical card is a violation of HIPAA. According to HIPAA’s fine print, the Privacy Rule only applies to certain businesses and entities that handle personal health information including doctors, hospitals and other associated businesses. This means that an individual's personal health information is protected by limiting its usage among HIPAA-covered entities. Therefore, it is not a HIPAA violation to ask an employee for vaccination proof. However, under HIPAA it is a violation for an employee’s medical provider to disclose this information without prior authorization.
Compliance with other laws
With federal, state and local laws changing rapidly, employers must keep up with the current guidance on vaccine self-attestation. While HIPAA is not a factor for many businesses requiring vaccine status self-attestation, employers must ensure they’re complying with other laws.
For example, while it is permissible to ask an employee’s vaccine status under the Americans with Disabilities Act (ADA), the territory can become murky if employers ask why an employee did not receive a vaccination. This is because it could open up dialogue to an employee’s disability, which is against ADA’s policy.
Another law, the Genetic Information Nondiscrimination Act (GINA), makes it illegal for employers to discriminate against employees because of their genetic information. It’s not against GINA to ask an employee for their vaccination status, however, it’s best to avoid any questions that would have them reveal any genetic information including genetic diseases or family medical history.
Along with limiting your questions, the U.S. Equal Employment Opportunity Commission (EEOC) requires employers to keep the vaccination status of their employees confidential. This information is deemed personal medical information so its use should be restricted only to the employer’s inquiry and never sent or revealed to other parties.
[Read more: How to Host a Vaccine Event for Employees]
Vaccine self-attestation options: Examples of employee self-attestation forms
The best way to receive and keep track of your employees’ self-attestation regarding vaccines is to create a form for them to fill out. On this form, employers should decide whether or not they will require documentation as proof to confirm vaccination.
“In situations where the employee does not have documentation, the employer should consider other forms of evidence of employment authorization,” said Dowsy. “Such evidence may include signed non-forge documents, the credible witness who has direct knowledge of the employee's work authorization status, etc.”
There are a few basic forms that can be found online from other universities and businesses requiring self-attestation:
- Form that asserts employees have received a vaccine.This form should be the same for each employee and ask for dates of inoculation, the definition of the term ‘fully vaccinated’ and a statement that employees understand the consequences of lying on the form. Grindlinger recommends including a line that “affirms that the employee has accurately and truthfully answered the question concerning the employee’s vaccination status.”
- Form that asserts an employee’s vaccine status. This form is a simplified version of the above, only requiring employees to fill out whether or not they’re vaccinated. Employers can use this form to check vaccination status and take future action based on the employee response.
- Form that asserts the employee chose not to get the vaccine. These forms can have language that confirms an employee is choosing not to receive the vaccine. An example response can be phrased as follows: “I am not fully vaccinated and chose not to receive the COVID-19 vaccine. I understand that my choosing not to receive the vaccine may result in my required adherence to public health and safety measures such as social distancing and the wearing of masks.” These forms may not ask employees to provide a reason for non-vaccination.
If your company has decided to mandate vaccinations for in-person employees, you may wish to require a confidential request form from employees seeking exemption for medical reasons or sincerely held religious beliefs. Employers must determine whether they will make accommodation arrangements for exempt employees and those who choose not to receive the COVID-19 vaccine.
“The policy should clearly state that if an employee cannot be vaccinated due to religious or health reasons they should contact a designated person within the company who can discuss the matter with the employee and potential accommodations that could be provided,” said Grindlinger.
[Read more: Considering Mandating Vaccines for Employees? What Small Businesses Need to Know]
No matter how your company decides to handle COVID-19 vaccinations, it’s important to clearly document, communicate and enforce your policy.
“I believe the soundest approach is to make a strict, clear and unambiguous policy here and enforce it,” Bersin told CO—. “If not, you risk ending up being branded a ‘non-safe’ employer or company to do business with.”
CO— aims to bring you inspiration from leading respected experts. However, before making any business decision, you should consult a professional who can advise you based on your individual situation.
Follow us on Instagram for more expert tips & business owners’ stories.
CO—is committed to helping you start, run and grow your small business. Learn more about the benefits of small business membership in the U.S. Chamber of Commerce, here.
