Employee Vaccination Tracking: Collection, Storage, and Retention

Employers can ask workers whether they are vaccinated and collect documentation proving it, and the Equal Employment Opportunity Commission has confirmed that this specific question is not a disability-related inquiry under the Americans with Disabilities Act.¹ That green light is narrower than it looks. The moment an employee hands over a vaccination card, the paper in your hand is medical information, and employee vaccination tracking has to be built around the confidentiality, retention, and disclosure rules that come with that classification. Get the system right at the start and most of the risk disappears. Get it wrong and a single misfiled document can produce a complaint.

What You Can Legally Ask

The ADA generally bars employers from making medical inquiries of current employees unless the question is job-related and consistent with business necessity.² Asking about vaccination status sits outside that restriction because an employee could be unvaccinated for reasons that have nothing to do with a disability, so the question itself does not tend to reveal protected medical information.¹

The trap is in the follow-up. If an employee says no and you start asking why, those questions can pull disability information into the open, and at that point the business-necessity standard applies.³ Train the people running your tracking program to log the status and stop. Reasons belong in a separate accommodation conversation, not in the tracking file.

State law is the other constraint. Roughly a dozen states have passed laws limiting or prohibiting certain employer vaccine mandates. Federal permission to ask is not permission to require, so check what your state allows before you decide what to do with the information you collect.

What Information to Collect

A record that actually does its job needs enough detail to confirm the employee’s status and to figure out when boosters or additional doses are due. For each vaccine, collect:

The employee’s full legal name, matched to what your HR system has on file.
The vaccine manufacturer, since dosing schedules and booster timelines vary by product.
The date of each dose, to confirm a completed series and to time future doses.
The lot number, which matters if a batch is later recalled or flagged.

Acceptable proof includes a vaccination record card, a verified digital certificate from a state immunization registry, or documentation from a healthcare provider. Look for a provider signature, clinic stamp, or digital verification seal. You are not performing forensic document analysis; you are confirming that the record looks authentic and matches the person in front of you.

Collect the minimum you need. Every additional field you add is another piece of medical information you have to secure for decades, and the less you hold, the less you have to lose.

How to Store the Records

Vaccination documentation is medical information under the ADA even though the question that produced it was not a medical inquiry. The statute requires medical information to be collected on separate forms and stored in separate medical files, kept apart from the regular personnel file.² The implementing regulation applies the same rule to both applicants and current employees.⁴

In practical terms: vaccination records cannot share a folder, filing cabinet, or digital directory with performance reviews, discipline records, or payroll. Only three narrow categories of people can be told what is in them:

Supervisors and managers, and only as to necessary work restrictions or accommodations, not the underlying medical detail.
First aid and safety personnel, if a condition could require emergency treatment.
Government investigators checking ADA compliance.

Everyone else is out. Password-protect digital files, physically secure paper, and limit access to a designated handful of HR staff. Accidental disclosures during routine personnel actions are exactly the kind of mistake that generates complaints.

Design of the System Itself

The tracking tool can be a locked spreadsheet or dedicated HR software with role-based access controls. The workflow matters more than the technology. Designate the small group of administrators who will handle raw documentation. Have them enter validated data points and cross-check each entry against the source to catch transcription errors. Then move the source document, whether a scanned card or an uploaded certificate, into the restricted medical file.⁴

What managers and safety coordinators see should be limited: name, status (compliant, pending, exempt), and relevant dates. No copies of the source documents. No notes on why someone is exempt. Think dashboard, not filing cabinet. A manager who needs to know whether a team member can be sent to a client site that requires vaccination gets a yes or no, nothing more.

Audit periodically. Every entry in the dashboard should have a matching document in the medical file, and no medical documents should have drifted into personnel folders. This is housekeeping that feels unnecessary until an EEOC complaint arrives.

HIPAA Is Not the Rule Here

This is the most common misconception in the field. HIPAA governs healthcare providers, health plans, and their business associates. It generally does not cover employment records, even when those records contain health information. The Department of Health and Human Services has said this directly: the Privacy Rule does not protect employment records and in most cases does not apply to employer actions.⁵ The ADA’s confidentiality provisions are what protect vaccination records once they are in the employer’s hands.

A different federal rule can reach a third-party vendor. The FTC’s Health Breach Notification Rule covers vendors of personal health records and related entities that handle health information electronically. If you use an outside digital platform to collect and store vaccination records, that vendor may have obligations under the rule, including notifying affected individuals within 60 calendar days of discovering a breach.⁶ Confirm the vendor’s breach-notification procedures before you sign.

Keeping Accommodation Records Separate

When you require vaccination, some employees will ask for exemptions on disability or religious grounds. The details of adjudicating those requests are their own subject, but tracking-wise the rule is simple: do not put accommodation records in the vaccination tracking file. Accommodation paperwork holds far more sensitive information than a yes-or-no status, and mixing them enlarges the confidentiality problem without giving you anything useful.

In the tracking dashboard, an approved exemption should appear as “exempt.” Nothing about the diagnosis, the religious basis, the documentation submitted, or the interactive discussion belongs there. Store that material in the medical file and keep it locked to the administrators who need it to run the accommodation process.

How Long to Keep Records, and How to Destroy Them

OSHA requires employers to retain employee medical records for the duration of employment plus 30 years.⁷ Vaccination records you collect today will still need to be secure decades from now. One exception exists: records of employees who worked less than a year do not need to be retained past the end of employment, provided the records are given to the employee at termination.

That timeline changes how you build. A spreadsheet on one HR employee’s laptop is not a retention system; it is a liability waiting for that laptop to be replaced. Centralized, backed-up, access-controlled storage is the baseline. Plan for the system outlasting the software you picked to run it.

When records finally reach the end of their retention period, disposal has to prevent the information from being read or reconstructed. Paper gets shredded or incinerated. Electronic records need to be permanently erased or the storage media destroyed. A qualified secure-destruction vendor is a reasonable option, particularly for organizations that have accumulated years of records across multiple systems.

Telling Employees What You Are Doing

Before you collect anything, give employees a written notice that explains what you are collecting, why, how it will be stored, who will have access, and what happens if they decline. This is the single most effective way to cut down on pushback and confusion. The notice should also explain how to request a religious or medical accommodation, who to contact, and what documentation is needed. Employees who can see the path forward are less likely to escalate out of uncertainty.

Keep the language plain. A short FAQ tends to land better than a dense policy memo. When the policy changes because new vaccines are added, booster requirements shift, or state law moves, update the notice and redistribute it. A policy that was clearly explained in 2024 and never touched again can create trouble under 2026 enforcement.

What Getting It Wrong Costs

Financial exposure comes from several directions. Under ADA Title I, an employee who proves that an employer improperly disclosed medical information or retaliated against someone for requesting an accommodation can recover compensatory and punitive damages. Federal law caps the combined figure based on employer size, from $50,000 for employers with 15 to 100 employees up to $300,000 for employers with more than 500. Back pay and equitable relief sit on top of those caps.

State law adds another layer. Administrative fines for unauthorized disclosure of employee medical records vary widely and can reach into the hundreds of thousands of dollars in states with aggressive enforcement. None of those numbers include litigation costs, settlement pressure, or the reputational damage of a publicized breach of employee health data. A well-designed tracking system built before something goes wrong is always the cheapest option on the table.

1
U.S. Equal Employment Opportunity Commission. What You Should Know About COVID-19 and the ADA, the Rehabilitation Act, and Other EEO Laws
2
Office of the Law Revision Counsel. 42 U.S. Code 12112 – Discrimination
3
U.S. Equal Employment Opportunity Commission. Enforcement Guidance on Disability-Related Inquiries and Medical Examinations of Employees Under the ADA
4
eCFR. 29 CFR 1630.14 – Medical Examinations and Inquiries Specifically Permitted
5
U.S. Department of Health and Human Services. Employers and Health Information in the Workplace
6
Federal Trade Commission. Complying with FTC’s Health Breach Notification Rule
7
Occupational Safety and Health Administration. 1910.1020 – Access to Employee Exposure and Medical Records