Can businesses require proof of vaccination? Experts say yes

As companies rush to develop so-called "vaccine passports" and as access to COVID-19 vaccines expands, the debate about whether businesses can require proof of vaccination from employees and patrons is heating up.

And Americans' support for requiring proof of vaccination depends on which activity the proof would be needed for, according to exclusive polling. 

Tech companies, including IBM, Microsoft and Oracle, have been working on vaccine credentials that can be flashed at ball games, concerts and airports for entry, and some businesses are wondering whether they can or should require employees to show proof of vaccination before returning to work sites. The Equal Employment Opportunity Commission has already weighed in, holding that, "generally," employers have the right to require their employees to get one of the approved vaccines. 

While American businesses may still may be months away from deciding whether to implement vaccination requirements, every American who wants a vaccine will soon have the ability to get one. 

"It is lawful and ethical for a business to require proof of vaccination as a condition of working or getting service," Georgetown Law professor and public health expert Lawrence Gostin told CBS News. "The employer must offer medical and religious exemptions. Businesses have a legal and ethical obligation to provide a safe environment. Requiring vaccinations is the best way to do that."

But that doesn't mean there aren't — and won't be — legal exceptions and challenges, aside from privacy concerns.

Governors Ron DeSantis of Florida and Greg Abbott of Texas have made their opposition to vaccine passports quite clear. Using his emergency powers, DeSantis has not only prohibited public entities, but private businesses as well from requiring proof of vaccination for entry. In his executive order, DeSantis reasoned that many Floridians haven't had the chance to get the COVID-19 vaccine yet. 

"Whereas, many Floridians have not yet had the opportunity to obtain a COVID-19 vaccination, some have infection-acquired immunity, and others may be unable to obtain a COVID-19 vaccine due to health, religious or other reasons; and whereas, Florida seeks to ensure that every Floridian who desires a COVID-19 vaccine can obtain one, but such vaccines will not be mandated; and whereas, no COVID-19 vaccine is required by law; and whereas, individual COVID-19 vaccination records are private health information which should not be shared by mandate; and whereas, so-called COVID-19 vaccine passports reduce individual freedom and will harm patient privacy ... businesses in Florida are prohibited from requiring patrons or customers to provide any documentation certifying COVID-19 vaccination or post-transmission recovery to gain access to, entry upon, or service from the business," DeSantis' executive order reads. 

Despite the EEOC's opinion that mandating vaccination would be appropriate, "that's not necessarily the end of the story ... given the executive order in Florida where the governor seems to think whatever the EEOC says doesn't matter in Florida," noted University of Pennsylvania Carey Law School professor Eric Feldman.

State laws differ, but Walter Olson, a senior fellow at the Cato Institute's Robert A. Levy Center for Constitutional Studies, has a hard time seeing how governors can restrict private companies that receive no government funding from requiring proof of vaccination to enter. Olson said he's wondered where DeSantis' authority to restrict the freedom of private businesses lies. 

"It's harder to argue that that's part of public health authority," Olson said. 

DeSantis' office did not address how he has the authority to restrict private businesses from requiring vaccines, but a spokesperson for the governors' office said: "The Governor issued Executive Order 21-81 prohibiting vaccine passports in Florida as it is completely unacceptable for government or the private sector to impose this requirement to participate in normal society. The Governor has been clear from the beginning: receiving the vaccine is the choice of each individual and will not be mandated in any way."

Americans are beginning to form their own opinions of vaccine passports. 

According to Harris Poll data provided exclusively to CBS News, 59% of those surveyed have heard "a lot" or "quite a bit" about the concept of vaccine passports, while 41% have heard "not much" or "nothing at all" about them. And while most of those polled supported requiring something like a vaccine passport for flying on a plane (68% supported the idea) sporting events (61%), concerts (60%) and attending college (60%), only 46% said proof of vaccination should be required to enter a store. Of those polled, 57% said proof of vaccination should be required for work. 

Democrats were more supportive of vaccine passport requirements at each of these places than were Republicans. Americans are concerned about the security of vaccine passports too, with 60% of respondents saying they are "somewhat" or "very" concerned about the privacy of vaccination credentials. The Harris poll, conducted April 9-11, included 1,963 American adults. 

Feldman said governors can probably apply some requirements or restrictions on vaccine credentials, such as in the case of public universities, but what the governors can limit without legislation is likely to vary by state. 

"I think it's an open question in Florida," Feldman said. "I don't think it's an open question that the governor has all sorts of powers. I would assume that one of those powers would be for the governor to be able to say our state is not going to create, maintain or support any form of a uniform vaccine registry. My guess is the (Florida) governor's probably on solid legal footing by saying no public facility or facility that receives state funds will be permitted to require the demonstration of vaccination status for entry. I think the real complication in Florida is that the governor went a step further and said no private business can ask for that either." 

Gostin points out that states, which have the power to regulate business, could prohibit proof of vaccination.

"But this requires legislation," Gostin said. "The governor acting on his own doesn't have the authority to force businesses to act in the way he thinks they should. It also clashes with federal oversight because the EEOC has said businesses can require vaccinations," Gostin said. 

In New York, residents can now access a state-promoted app called Excelsior Pass that shows proof of vaccination or a negative COVID-19 test. It can be used at large-scale venues, but the state is not requiring proof of vaccination — it's leaving that up to businesses. 

When it comes to businesses requiring employees to present proof of vaccination, Olson said companies are generally within their rights to do so, but they should consider several possible objections. 

Religious exemptions may arise here. However, while the employer might need to find ways to accommodate the employee, Olson doesn't believe religious objections will generally hold up in court. 

"My guess is the courts will not recognize much of a right to differ from your employer's policy," Olson said. 

The Americans with Disabilities Act may also be a factor: Some employees may not be able to get vaccinated because they have severe disabilities. The employer would likely need to make more accommodations for an employee under the ADA than for an employee with religious objections, Olson said. 

The final objection employers may hear relates to HIPAA, or the Health Insurance Portability and Accountability Act. Most people don't understand HIPAA and think it creates more privacy protections than it actually does, Olson said. 

"HIPAA isn't really relevant," Olson said. "... The answer is, no, HIPAA does not provide you with rights to patronize a business that doesn't want to serve you, much less to work for an employer."

But companies that create vaccine credentials will need to consider privacy and data protection. The Biden administration has said the federal government will not be involved in creating or storing any sort of vaccine credentials, but it will provide guidance for private companies that want to. Those guidelines will ensure the protection of private information and ensure equitable access to such vaccine credentials. 

Feldman said he understands people who don't want to get vaccinated but still want to participate fully in society without COVID-19 outbreaks, but that's not where the U.S. is.

"If we could all participate in everything and not get vaccinated and not have outbreaks, that would be the ideal solution," Feldman said. "But we're not there. So then, do you throw the door open partially or do you keep it closed? Do you enable those who are situated in a particular way, i.e., having gotten vaccinated, to at least start to re-engage in life as they knew it as much as possible or not? So, I think the characterization of this as exclusion can be recharacterized as an effort to include as many people as we can in the renormalization of life."