Vaccination status was the easy record; exemptions were the hard one

The week

On September 9, 2021, President Biden announced a COVID-19 action plan with several vaccination requirements. OSHA would develop an emergency temporary standard requiring employers with 100 or more employees to ensure workers were vaccinated or tested weekly. CMS would require vaccination for staff at health care facilities participating in Medicare and Medicaid. Executive orders signed that day required vaccination for federal executive branch employees, with exceptions required by law, and directed that covered federal contracts include a vaccination requirement for contractor employees. The White House said the measures would cover about 100 million workers, roughly two-thirds of the US workforce. OSHA and CMS issued their rules in November 2021, and both were challenged in court. Many banks, health systems and agencies had already announced their own requirements or began planning for the federal ones.

The September 2021 requirements produced months of litigation, and most attention went to the court fights. Inside organizations, the work was operational and fast. HR, occupational health, legal and IT had to answer, for every worker, a question they had never tracked, and act on the answer. Three capabilities were needed at once: status records, collecting and protecting proof of vaccination; testing workflows, managing weekly results for those not vaccinated; and exemption decisions, judging requests for medical or religious accommodation. The first two were data problems with known solutions. The third was adjudication, and it is where errors produced claims that outlasted the mandates by years.

Status records: medical data in an HR system

Collecting status meant gathering proof, checking it to some standard, storing it securely and reporting on it. Vaccination status is medical information. For most employers it is not governed by HIPAA, which covers health plans, providers and clearinghouses in their health care roles, not employers as employers. But federal disability law requires employers to keep employee medical information confidential and separate from general personnel files, and the EEOC said that applied to vaccination information. State laws can add more. Organizations should check with counsel on the rules that apply to them.

Many organizations began by collecting card photos through email or uploads to shared drives, which created the scattered sensitive data security teams spend years removing. Better programs used a dedicated module in an HR or occupational health system, with access limited to a small team, an audit trail, and a retention rule set at the start. Health systems had an advantage because occupational health already tracked staff immunizations such as influenza. Managers needed only a yes or no on whether someone could come to work, never the underlying record.

Testing workflows: a weekly deadline at scale

Weekly testing turned a one-time collection into a recurring process. Each unvaccinated worker needed a scheduled or supplied test, a result submitted on time, and a consequence if it was missing or positive. Multi-site employers had to handle different testing options by location, and test supply was uneven in late 2021.

Systems built in a hurry for status collection often struggled here. The workflow needed automated reminders before each deadline, integration with testing providers where possible, a clear rule for what happens when a result is late, and a link to attendance or site access so that the rule was actually applied. These are standard case-and-deadline features, and organizations that configured them in an existing HR or ticketing platform generally coped. The failures were mostly about volume: manual tracking of hundreds of weekly results by email does not hold for long.

Testing also raised cost and labor questions that touched the workflow design. The OSHA standard did not itself require employers to pay for tests, but collective bargaining agreements and some state laws could, and time spent testing could count as paid work. Those answers determined whether testing was scheduled on shift, supplied on site or left to employees, and each choice needed different system support.

Exemption decisions: adjudication with legal weight

Exemptions were different in kind. Federal employment law requires employers to consider reasonable accommodation for disability and for sincerely held religious beliefs, unless accommodation would cause undue hardship. Each request is an individual decision, made on facts and documents, that must be consistent with every similar decision the organization makes. It is closer to claims adjudication than to data collection.

Large employers received requests in volume, often in a few weeks. Organizations that treated them as email exchanges between a worker and a manager ended up with inconsistent outcomes: similar requests approved in one department and denied in another, reasons not recorded, accommodations offered to some and not others. Each inconsistency is evidence in a later dispute.

A defensible process looks like case management. Standard intake forms for medical and religious requests. A small central review team, separate from line managers, applying written criteria. A documented interactive dialogue with each requester. A record of accommodations considered, such as testing, masking, remote work or reassignment, and why each was or was not feasible for that role. Consistent decision letters. A log that allows the organization to compare outcomes across departments and spot drift. The religious side needed particular care, because questioning the sincerity of a belief is legally delicate and should rest on specific, documented facts.

Medical requests needed a parallel safeguard. Supporting documentation from a clinician should go to occupational health or a designated medical reviewer, not to the manager or the general HR file. The decision-maker should see what is needed to decide and nothing more.

The three capabilities differed in how long their consequences lasted. Status and testing records mattered while the requirements were in force and could be retired on a retention schedule afterward. Exemption decisions created individual claims that could be litigated long after the policy ended, and the quality of the record was the organization’s main defense. Organizations that put their strongest people and tools on status collection, and handled exemptions informally, had the priorities reversed.

With hindsight

From 2026, the requirements had very different fates. In January 2022 the Supreme Court stayed the OSHA standard, which OSHA then withdrew as an enforceable rule, while allowing the CMS health care staff requirement to take effect. Courts blocked the contractor requirement, and the administration ended the federal employee and contractor requirements in May 2023, with CMS withdrawing its staff rule around the same time. The exemption decisions lasted longer. Lawsuits by workers whose religious accommodation requests were denied continued for years, and some juries returned large verdicts. In June 2023, the Supreme Court’s decision in Groff v. DeJoy raised the bar employers must clear to show undue hardship when refusing a religious accommodation, which affects every accommodation process today. Employers that kept consistent, documented exemption records have been far better placed in those disputes than those that relied on email.