Can we ask for proof of vaccination? Isn’t this a HIPAA violation or an illegal inquiry under the ADA or somehow confidential information?

Employers can ask for proof of vaccination unless there is a state or local law or order to the contrary.*
When an employer is requesting or reviewing medical information in its capacity as an employer, as it would be when asking about an employee’s vaccination status, it is considered to be an employment record. In such cases, HIPAA would not apply to the employer. The Americans with Disabilities Act (ADA) will govern the collection and storage of this information.

The Equal Employment Opportunity Commission (EEOC), which enforces the ADA, has stated that asking about vaccination is not a disability-related inquiry, though it could turn into one if you ask follow-up questions about why the employee is not vaccinated. Asking a yes or no question, or requesting to see the employee’s vaccination card, does not violate any federal laws or require proof that the inquiry is job-related.
 
Finally, just because employees think that something is or should be private or confidential doesn’t mean they can’t be required to share it with their employer. Social Security numbers, birth dates, and home addresses are all pieces of information an employee may not want to advertise, but sharing is necessary and required for work. Vaccination status is similar. However, all of this information, once gathered, should not be shared by the employer with third parties, except on a need-to-know basis.

*It appears that some governors may attempt to prevent certain entities from requiring “immunity passports” (e.g., proof of vaccination) through an executive order (EO), though as of July 31, none of the EOs already issued appear to apply to private businesses and their employees. Also note that if there is a law in place that prevents treating vaccinated and unvaccinated employees differently (like in Montana), you may be able to ask, but not take any action based on the response.

Should we keep a record of who is vaccinated or make copies of vaccination cards? If we do, how long should we keep that information?

If you’re asking about vaccination status, you’ll want to keep some kind of record (so you don’t have to ask multiple times), but how you do this is up to you, unless state or local law has imposed specific record keeping requirements. You may want to keep something simple like a spreadsheet with the employee’s name and a simple “yes” or “no” in the vaccination column. If you’d prefer to make a copy of their vaccination card, that should be kept with other employee medical information, separate from their personnel file. Per OSHA, these records should be kept for 30 years.

If we keep a record of who is vaccinated, can we share it with managers who will be required to enforce policies based on that information, such as masking and social distancing?

Yes. We recommend not sharing this information any more widely than necessary. While anonymized information is okay to share (e.g., “80% of our employees are vaccinated”), each employee’s vaccination status should be treated as confidential, even if the fact that they are wearing a mask to work seems to reveal their status publicly. Obviously, managers will need this information if they are expected to enforce vaccination-dependent policies, and employers should train them on how they should be enforcing the policies and how and when to escalate issues to HR or a higher level of management.