Consult local legal counsel about requirements under state privacy laws and how they may affect the ability to track student and employee vaccination status.
The Department of Education’s (ED’s) COVID-19 Handbook states that “institutions of higher education can consider verifying the vaccination status of their students, faculty, and staff.” The Family Educational Rights and Privacy Act (FERPA) prohibits institutions from sharing personally identifiable information (PII) in a student’s educational record, including vaccination information. Schools can record and track vaccination information in Health Insurance Portability and Accountability Act (HIPAA)--compliant recordkeeping systems, but they can’t share the PII without written consent from the student, or the student’s parent if the student is a minor.
Under federal law, the EEOC’s updated guidance indicates that employers can require employees to provide documentation of their vaccination status – but makes clear this documentation qualifies as medical information under the ADA, so schools must keep information about an employee’s vaccination status confidential and store it separately from the employee’s personnel files.