Vaccination status was the easy record; exemptions were the hard one

The week

On September 9, 2021, President Biden announced a COVID-19 action plan built around several vaccination requirements. The White House called it the “Path out of the Pandemic.” For employers across the country, it turned a public health debate into an operational project with deadlines.

The announcement did not come from nowhere. Over the summer, federal requirements had been tightening step by step. In late July the Department of Veterans Affairs required vaccination for its health care workers. Days later, the White House asked federal employees to attest to their vaccination status or accept masking, distancing and regular testing. In mid-August the administration said nursing home staff would need to be vaccinated for those homes to keep receiving Medicare and Medicaid funding.

Then, on August 23, the Food and Drug Administration granted full approval to the Pfizer-BioNTech vaccine for people aged 16 and over. Until then, every COVID-19 vaccine in the United States had been used under an emergency use authorization. Full approval removed an argument many employers had treated as a reason to wait. The next day, the Secretary of Defense ordered vaccination for members of the armed forces. A wave of private employers, including large banks, hospital systems and technology companies, announced or tightened their own requirements over the following weeks.

The September 9 plan widened all of this at once. It had several parts, each aimed at a different group of workers.

• Large private employers. OSHA, the federal Occupational Safety and Health Administration, which sets workplace safety rules, would develop an emergency temporary standard. That is a fast-track rule OSHA can issue when it finds workers face a grave danger, without the usual lengthy rulemaking. It would require employers with 100 or more employees to ensure workers were vaccinated or tested weekly.
• Health care staff. CMS, the Centers for Medicare & Medicaid Services, would require vaccination for staff at health care facilities participating in Medicare and Medicaid. This extended the nursing home requirement announced in August to hospitals and many other provider types. Because almost every hospital depends on those programs, that reached most of the health care workforce.
• Federal employees and contractors. Two executive orders signed that day, numbered 14042 and 14043, did the rest. One required vaccination for federal executive branch employees, with exceptions required by law. The other directed that covered federal contracts include a clause requiring compliance with workplace safety guidance, which turned out to mean vaccination for contractor employees.

The White House said the measures would cover about 100 million workers, roughly two-thirds of the US workforce.

The detailed rules took a while to arrive. A federal task force issued the contractor guidance later in September. It set December 8 as the original date by which covered contractor employees had to be fully vaccinated. Federal employees were given a deadline of November 22. OSHA and CMS published their rules on November 5, 2021, and both were challenged in court almost at once. Employers did not wait. Many banks, health systems and agencies had already announced their own requirements or began planning for the federal ones.

One feature of the plan mattered more than it first appeared. The OSHA standard would let employers offer weekly testing as an alternative to vaccination. The health care and federal requirements, as they were eventually written, did not offer that alternative. For hospital staff and federal workers, an approved exemption would become the only route other than vaccination.

The OSHA standard, as published in November, also required employers to give paid time off to get vaccinated and reasonable paid sick leave to recover from side effects. That pulled payroll and timekeeping teams into a project that had started as a health question.

That planning landed on teams that rarely work together at speed: human resources, occupational health (the in-house function that looks after staff health and safety), legal, and IT. Overnight, they needed to know something about every worker that they had never tracked before, store it safely, and act on it every week. Some workers would also ask to be excused on medical or religious grounds, and each of those requests needed a careful, individual answer.

Most public attention that autumn went to the politics and the lawsuits. Inside organizations, less visible machinery was being built, and the part that seemed most like paperwork turned out to matter most.

Take the head of HR at a regional bank with 3,000 employees in the second week of September 2021. Her chief executive wants to know by Friday how many staff are vaccinated. Her general counsel wants to know where that information will be stored and who can see it. Branch managers are already forwarding photos of vaccination cards by email. And in her inbox are the first dozen requests for religious exemptions, each written differently, each asking for something slightly different.

Her counterpart at a hospital system down the road faces a harder version of the same week. Her workforce is larger, spread across many sites, and includes contractors, students and volunteers. Her chief nursing officer is worried about losing staff in the middle of a pandemic. And the federal rule her system will soon fall under offers no weekly testing route for staff who decline vaccination.

The September 2021 requirements produced months of litigation, and most attention went to the court fights. Inside organizations, the work was operational and fast. HR, occupational health, legal and IT had to answer, for every worker, a question they had never tracked, and act on the answer.

Three capabilities were needed at once: status records, collecting and protecting proof of vaccination; testing workflows, managing weekly results for those not vaccinated; and exemption decisions, judging requests for medical or religious accommodation. The first two were data problems with known solutions. The third was adjudication, and it is where errors produced claims that outlasted the mandates by years.

The sections below start with how the three kinds of work differed and then take each capability on its own. They then explain why the third carried the lasting risk, who should own each piece, and what the difference looked like between two employers. They close with the questions that still apply.

Three different kinds of work

The three capabilities were easy to lump together as “the vaccine project,” but they were different kinds of work.

Status records are a collection exercise. You ask everyone a question, gather a piece of evidence, check it and file it. The work is tedious and sensitive, but well understood.

Testing workflows are a recurring process with deadlines. The same people have to do the same thing every week, and someone has to notice when they do not. It resembles managing expiring professional licenses or mandatory training, except on a seven-day cycle.

Exemption decisions are judgments. Each one involves a particular person, particular facts and a legal standard, and the organization must be able to explain later why it decided as it did, and why it decided similar cases the same way. That is closer to how an insurer handles claims, or how a court handles cases, than to anything in an ordinary HR system.

The technology needed for each follows from the kind of work. Collection needs secure storage. Recurring processes need reminders, deadlines and escalation. Judgments need what software people call case management: a system in which each request becomes a file, with a standard intake, a history of every step, the documents relied on, the decision and the reasons, all searchable so that one case can be compared with another.

Why the three were so often merged

Most organizations started from the question the chief executive asked, which was a number: what share of our people are vaccinated. That question is answered by status records alone. A project scoped around it naturally treated testing as an add-on and exemptions as an exception path, a box to tick on the same form.

The merge also happened because the same employee could pass through all three. A worker declines to share status, then asks for a religious exemption, then is placed into weekly testing while the request is pending. To that employee it is one experience. To the organization it is three different kinds of work with different owners, different evidence and different risks.

How the mix differed by type of organization

The federal requirements did not weigh the three capabilities equally across sectors. Which rule applied changed which capability carried the most volume and the most risk.

• Hospitals and other CMS-certified providers. The CMS rule covered staff regardless of whether they had patient contact, including many contractors, students and volunteers. It required facilities to track and securely document each person’s status and to document every exemption request. With no testing alternative in the rule, exemptions became the only path for anyone who would not be vaccinated. That made the exemption process the pressure point.
• Larger banks, broker-dealers and other private employers. An employer with 100 or more employees would fall under the OSHA standard, which allowed a vaccinate-or-test policy. For an employer that chose that route, an exemption mostly decided who tested and who masked, so the stakes of each decision were lower. Many financial firms went further and adopted mandatory vaccination policies of their own, which moved them back into the hospital pattern.
• Smaller credit unions and community banks. Below 100 employees, the OSHA standard would not have applied at all. Their choices came from their own policies and from state law, which pulled in different directions by state.
• Federal agencies. The employee order offered no testing alternative for those who declined vaccination. Agencies handled exemption requests through their own HR and equal employment offices, often in very large numbers, under central guidance from the federal task force.
• State and local agencies. OSHA does not regulate state and local government employers directly. In states that run their own OSHA-approved plans, which also cover public employees, those plans were expected to adopt the standard or something at least as effective. Elsewhere, public employers acted under their own executive or council decisions.

These differences matter for reading what came later. The organizations whose exemption decisions were litigated most heavily were, for the most part, those for which an exemption was the only alternative to vaccination.

Status records: medical data in an HR system

Collecting status meant gathering proof, checking it to some standard, storing it securely and reporting on it. Vaccination status is medical information, and that brings rules with it.

For most employers it is not governed by HIPAA, which covers health plans, providers and clearinghouses in their health care roles, not employers as employers. HIPAA, the federal health privacy law, is often assumed to cover any health information anywhere, but it does not. A hospital is covered by HIPAA for its patients’ records, but when it acts as an employer, its staff records fall under employment law instead.

That does not mean anything goes. Federal disability law requires employers to keep employee medical information confidential and separate from general personnel files, and the EEOC, the Equal Employment Opportunity Commission, which enforces federal anti-discrimination law in the workplace, said that applied to vaccination information. State laws can add more. Organizations should check with counsel on the rules that apply to them.

Many organizations began by collecting card photos through email or uploads to shared drives, which created the scattered sensitive data security teams spend years removing. Every forwarded email leaves a copy in someone’s mailbox, and every shared folder tends to be visible to more people than intended. Months later, nobody can say for certain where all the copies are.

Better programs used a dedicated module in an HR or occupational health system, with access limited to a small team, an audit trail (an automatic log of who looked at or changed each record, and when), and a retention rule set at the start, meaning a decision about how long the records would be kept and when they would be destroyed. Health systems had an advantage because occupational health already tracked staff immunizations such as influenza. Managers needed only a yes or no on whether someone could come to work, never the underlying record.

A branch manager deciding who can open the branch on Monday needs to know whether each person is cleared. He does not need to see a vaccination card, a test result or a doctor’s note. Designing the system so that managers see only “cleared” or “not cleared” protects employees and protects the organization from managers making decisions based on information they should not have.

What counted as proof

The rules eventually set out what evidence was acceptable, and the details shaped the system design. The OSHA standard accepted a CDC vaccination card, a digital copy of it, or records from a health care provider or state immunization registry. A signed attestation was allowed only for an employee who could not produce proof, and it had to carry a warning about false statements. Prior infection and antibody tests did not count as vaccination under the standard.

Each of those rules needs a field and a decision in the system. The record has to hold the evidence type, the dates of each dose, who checked it and when. Where an attestation is used, the system should note why proof was unavailable. Without those fields, a later audit cannot distinguish a verified record from a guess.

State law complicated the picture. Montana had already made vaccination status a protected characteristic in employment earlier in 2021, with limited exceptions for certain health care facilities. In October, the governor of Texas issued an executive order barring any entity in the state from compelling vaccination of a person who objected. The order covered objections of conscience, religious belief and medical reasons, including recovery from COVID-19. In November, Florida enacted a law requiring private employers with a vaccine requirement to offer several exemptions, including one for documented prior infection. A multi-state employer could not run one status rule everywhere.

Designing the access model

The access design is where a status program succeeds or fails. A sound model has three layers.

1. The evidence layer. Card images and provider records, visible only to the small verification team, and stored in the medical file rather than the personnel file.
2. The status layer. A derived value, such as “verified fully vaccinated,” “exemption approved” or “testing required,” visible to HR operations.
3. The clearance layer. A plain yes or no for managers, schedulers and building access systems, with no medical detail behind it.

Only the clearance layer should flow into other systems. If the HR system pushes the status layer into the scheduling or payroll system, the organization has just copied medical information into places where dozens of people can read it.

The evidence an auditor would ask for

An internal auditor, a regulator or opposing counsel would later want to see four things.

• A data map showing every place vaccination information was collected or stored.
• The list of people with access to the evidence layer, and when that list was last reviewed.
• The audit log showing who viewed which records.
• The retention schedule, with proof that it was followed.

The data map is usually the hardest, because the early weeks produced copies in mailboxes, chat threads and shared drives. A cleanup effort that searches for and removes those copies, and documents that it did so, is unglamorous. It is also the only way to stand behind the claim that the information is held in one controlled place.

Testing workflows: a weekly deadline at scale

Weekly testing turned a one-time collection into a recurring process. Each unvaccinated worker needed a scheduled or supplied test, a result submitted on time, and a consequence if it was missing or positive. Multi-site employers had to handle different testing options by location, and test supply was uneven in late 2021.

Systems built in a hurry for status collection often struggled here. The workflow needed automated reminders before each deadline, integration with testing providers where possible, a clear rule for what happens when a result is late, and a link to attendance or site access so that the rule was actually applied.

Integration here means connecting two computer systems so that information flows between them automatically. If a testing lab can send results straight into the employer’s system, nobody has to read and retype them, and nothing gets lost in an inbox. A link to site access might mean that a badge stops opening the office door when a required test is overdue, which removes the awkward job of enforcement from individual managers.

These are standard case-and-deadline features, and organizations that configured them in an existing HR or ticketing platform generally coped. A ticketing platform is the kind of system an IT help desk uses to track requests from opening to closing, and it turns out to suit almost any process with items, owners and deadlines. The failures were mostly about volume: manual tracking of hundreds of weekly results by email does not hold for long.

What a valid test meant

The OSHA standard set conditions on the tests themselves. A test had to be authorized by the FDA to detect current infection and used according to its instructions. A test that the employee both administered and read at home did not count unless the employer or an authorized telehealth service observed it, or a lab or provider processed it.

That rule added fields and steps to the workflow. The system had to record the test type, the date of collection, who observed or processed it, and the result. An employer that offered supervised testing on site needed a scheduled slot for each worker, staff to observe, and a way to log each observation. An employer that relied on outside labs needed to accept results from many sources and check them against the seven-day window.

Positive results and return to work

The testing workflow also had to handle the case everyone hoped to avoid. Under the OSHA standard, employees had to report a positive test or diagnosis promptly, and the employer had to remove them from the workplace. Return was allowed when the person met the CDC’s isolation criteria, had a negative molecular test after a positive antigen test, or was cleared by a health care provider.

Each of those exits needs a status in the system and a trigger that restores site access only when the criteria are met. If removal and return live in a manager’s calendar, the employer cannot later show that it applied the rule evenly.

Who pays, and on whose time

Testing also raised cost and labor questions that touched the workflow design. The OSHA standard did not itself require employers to pay for tests, but collective bargaining agreements and some state laws could, and time spent testing could count as paid work. Florida’s November 2021 law, for example, required employers that used a testing exemption to provide testing at no cost to the employee. Those answers determined whether testing was scheduled on shift, supplied on site or left to employees, and each choice needed different system support.

Unionized public employers faced a further step. Changes to working conditions, including testing schedules, could be subject to bargaining, so the workflow could not go live until the terms were agreed. A county that built the system before the agreement was signed sometimes had to rebuild it.

Measures that showed whether it worked

Three measures told leaders whether the testing workflow was holding. The first was the share of results received on time each week. The second was the number of people overdue and how long they had been overdue. The third was the time between a missed deadline and the consequence taking effect. A rising overdue count was the earliest sign that the process had slipped back to manual handling.

Exemption decisions: adjudication with legal weight

Exemptions were different in kind. Federal employment law requires employers to consider reasonable accommodation for disability and for sincerely held religious beliefs, unless accommodation would cause undue hardship.

A few terms need defining. A reasonable accommodation is an adjustment to how or where someone works that lets them do the job despite a disability or a religious practice, such as remote work or a different shift. Undue hardship is the legal threshold at which an employer may refuse, because the accommodation would cost or burden the business too much. Where exactly that threshold lies has been the subject of significant legal argument, as the hindsight section below explains.

Each request is an individual decision, made on facts and documents, that must be consistent with every similar decision the organization makes. It is closer to claims adjudication than to data collection.

Large employers received requests in volume, often in a few weeks. Organizations that treated them as email exchanges between a worker and a manager ended up with inconsistent outcomes: similar requests approved in one department and denied in another, reasons not recorded, accommodations offered to some and not others. Each inconsistency is evidence in a later dispute.

The two legal tracks

Medical and religious requests ran on different legal tracks, and a good process kept them apart.

Medical requests fall under the Americans with Disabilities Act and, for federal agencies, the Rehabilitation Act. The employer must engage with the employee, consider accommodations, and can refuse only for undue hardship or where the person would pose a direct threat to health or safety that accommodation cannot reduce. The direct-threat analysis is individual and should rest on current medical knowledge, which in 2021 meant public health guidance on transmission.

Religious requests fall under Title VII of the Civil Rights Act. In 2021 the governing reading of undue hardship came from a 1977 Supreme Court case, which many lower courts had read as allowing refusal for anything more than a minimal cost. Many employers relied on that low bar. Some decided that any religious accommodation in a clinical setting was an undue hardship and stopped analyzing individual roles.

What the EEOC said about sincerity

On October 25, 2021, the EEOC updated its COVID-19 technical assistance with a section on religious objections to vaccination. It said employees need no special words to request a religious accommodation. Employers should ordinarily assume that a stated religious belief is sincere. If an employer has an objective basis for questioning the religious nature or the sincerity of a particular belief, it may make a limited factual inquiry and ask for additional supporting information. Social, political or economic views, and personal preferences, are not religious beliefs protected by Title VII.

That guidance set the outline of a defensible sincerity review. Doubt must rest on specific facts about the individual, not on the reviewer’s view of the religion. The inquiry must be limited. And the reason for any doubt must be written down at the time.

The process

A defensible process looks like case management. It includes:

• Standard intake forms for medical and religious requests.
• A small central review team, separate from line managers, applying written criteria.
• A documented interactive dialogue with each requester, meaning a genuine back-and-forth to understand the request and explore options, rather than a single yes or no.
• A record of accommodations considered, such as testing, masking, remote work or reassignment, and why each was or was not feasible for that role.
• Consistent decision letters.
• A log that allows the organization to compare outcomes across departments and spot drift.

The religious side needed particular care, because questioning the sincerity of a belief is legally delicate and should rest on specific, documented facts.

Medical requests needed a parallel safeguard. Supporting documentation from a clinician should go to occupational health or a designated medical reviewer, not to the manager or the general HR file. The decision-maker should see what is needed to decide and nothing more.

Role-by-role hardship analysis

The heart of each decision was whether an accommodation would work for that particular role. The answer differs sharply by job, and a good case file shows that the reviewer looked at the job, not the category.

• A bank operations analyst who had worked remotely for eighteen months could often keep doing so. Denying that person on hardship grounds needed a specific reason.
• A branch teller or a broker-dealer’s trading floor staff could not work remotely, but weekly testing and masking might be workable where the employer already ran testing for others.
• An intensive care nurse at a CMS-certified hospital worked with very vulnerable patients under a rule that offered no testing route. Reassignment to a non-patient-facing role might be an option in some systems and not in others, and the file should say which.
• A county caseworker who visits homes raised different questions from a county records clerk, even within the same department.

Some employers granted exemptions but made unpaid leave the accommodation for everyone exempted. That choice was itself challenged in court. Whatever its merits, an accommodation applied to everyone without regard to role is hard to present as the outcome of individual analysis.

Staffing and throughput

A central team must be sized for the peak, which arrived in the weeks before each deadline. The workload per case is not trivial: intake review, a conversation, any follow-up request, a role analysis, a decision, a letter and an appeal path. Organizations that borrowed trained investigators from employee relations, or experienced claims staff from benefits administration, tended to cope better than those that assigned the work to generalists.

Throughput measures belong in the case system from the start: requests received and decided each week, the age of open cases, and the share decided after an interactive conversation rather than on paper alone. Pending cases also need a defined interim status, so that an employee waiting for a decision is not disciplined for missing a deadline the process itself caused.

Why the third capability mattered most

The three capabilities differed in how long their consequences lasted. Status and testing records mattered while the requirements were in force and could be retired on a retention schedule afterward. Exemption decisions created individual claims that could be litigated long after the policy ended, and the quality of the record was the organization’s main defense.

Consider the lawyer defending the organization two years later. The policy may be gone. The people who made the decision may have moved on. What remains is the file. If it shows a standard form, a conversation, options considered, reasons recorded and outcomes consistent with similar cases, the organization can tell a coherent story. If it shows a two-line email from a manager saying “denied,” it cannot.

Organizations that put their strongest people and tools on status collection, and handled exemptions informally, had the priorities reversed. It is an understandable mistake. Status collection was urgent, visible and measurable, and the chief executive wanted a number by Friday. Exemptions arrived more slowly and looked like individual HR matters. But the risk was concentrated in the exemptions.

How the risk compounded

Each weak exemption decision carried three kinds of exposure. There was the individual claim itself. There was the pattern: once one claim succeeded in discovery, similar files from the same process became easier for other plaintiffs to obtain and use. And there was the reputational cost inside the workforce, among staff who saw colleagues treated differently for similar requests.

Those exposures did not depend on whether the mandate survived. A worker dismissed after a denied request in December 2021 had a claim whether or not the rule behind the policy was later stayed or withdrawn. The policy’s legal fate and the individual decision’s legal fate were separate.

The strongest case against this view

A fair counter-argument runs as follows. In autumn 2021, a hospital facing a CMS deadline, survey enforcement and severe staffing pressure could not afford a slow, careful process. A blanket rule was quicker and, under the low hardship bar courts then applied, likely to be upheld. Many exemption suits were in fact dismissed early, often because the stated objection was found not to be religious. On that view, the litigation risk was real but overstated.

The argument has force on speed. It is weaker on substance. A central team with written criteria is usually faster than hundreds of managers deciding alone, because it does not repeat the same analysis in every department. Early dismissals also tended to depend on the record: an employer could win quickly when its file showed what the employee said and why it was assessed as it was. And the hardship standard that made blanket denials look safe did not stay put, as the hindsight section shows.

Who should own it, and how the pieces fit

One reason the exemption work was so often under-built is that it had no natural owner. Status collection looked like an HR data task. Testing looked like an occupational health task. Exemptions touched HR, legal, occupational health, line management and, for religious requests, questions that none of those functions felt comfortable judging. When everyone owns a piece, nobody owns the whole.

A workable arrangement assigns each capability to one accountable leader and makes the connections explicit. A sensible split might look like this:

• Status records belong with occupational health or HR, with IT providing a restricted system and the security team confirming that access is limited and logged.
• Testing workflows belong with HR operations, with facilities or security linked in so that the consequences of a missed test, such as restricted site access, happen automatically and evenly.
• Exemption decisions belong with a central accommodation team, usually within HR, advised by employment counsel and supported by occupational health for medical documentation.

The three must still talk to one another. An approved exemption usually means the person moves into the testing workflow, or into another accommodation such as remote work, and the systems need to reflect that without anyone retyping it. A denied exemption may change someone’s status and their access to a site. If those hand-offs run through email, errors creep in at exactly the points where an employee is most likely to feel wronged.

The hand-offs, mapped

Four hand-offs carried most of the risk of error, and each deserved a defined trigger.

1. An exemption request is filed: the employee’s clearance moves to a pending state with a defined interim rule.
2. An exemption is approved: the employee moves to the agreed accommodation, such as testing, remote work or reassignment, and the clearance follows.
3. An exemption is denied: the employee receives a deadline to comply, and the clearance changes only after that deadline passes.
4. A requirement ends or changes: every derived status is recalculated, and the retention clock starts on records no longer needed.

The IT and security role

IT and security teams had a narrower role than many assumed, but an important one. They chose and configured the platform, set up access controls and logging, connected it to identity and badge systems, and owned the cleanup of copies held elsewhere. They did not decide cases. Keeping that boundary clear protected IT staff from becoming informal decision-makers because they happened to have access to the data.

There is a technology lesson in this too, though a modest one. Organizations that already had a flexible case management or ticketing platform, and people who knew how to configure it, could stand up all three capabilities in weeks. Those starting from spreadsheets and shared mailboxes spent the same weeks firefighting. The difference was readiness rather than sophistication: a general-purpose workflow tool, already licensed and understood, pays off whenever a new requirement arrives suddenly.

Finally, the board or senior leadership should see more than the headline vaccination rate. A short regular report on the number of exemption requests, how long they took to decide, approval rates by department and any appeals would have told leaders where the real risk was building.

Two employers, 150 requests each

Suppose two employers, each with 5,000 staff, receive 150 exemption requests in a month.

The first routes every request to the employee’s own manager. Managers reply by email, some after a conversation and some without. A warehouse supervisor approves remote testing for one employee; a supervisor in another building denies a near-identical request for a similar role. Nobody records what alternatives were considered. Nobody can produce a list of all 150 requests and their outcomes.

The second sets up a small central team with written criteria and a standard intake form. Each request becomes a case file. The team speaks with each requester, records the options considered for that role and why each was or was not workable, and sends a consistent letter. Every two weeks it reviews outcomes by department to catch drift. Medical documents go to occupational health; managers learn only the outcome.

Both employers make difficult decisions. Only the second can show how and why it made them.

The same two employers, two years later

Move both employers forward to a lawsuit filed in 2023 by a worker whose request was denied. The first employer must search the mailboxes of dozens of managers, some of whom have left. It finds partial threads, no criteria and no comparison with similar cases. Its lawyers must explain differences in outcome they cannot account for.

The second employer exports one case file and the decision log. It can show the criteria, the conversation, the options considered for that role and how similar roles were treated. It may still lose, especially under a higher hardship standard. But it argues from evidence rather than reconstruction, and its costs of discovery are a fraction of the first employer’s.

The same errors recurred from one employer to the next:

• Collecting medical data by email. Fast to start, slow and costly to clean up.
• Showing managers too much. A yes or no is enough for scheduling.
• Tracking weekly tests by hand. It works for a few weeks and then breaks.
• Letting line managers decide exemptions. It guarantees inconsistency.
• Recording outcomes but not reasons. The reasons are the defense.
• Probing belief with a generic questionnaire. Questions that test theology rather than the individual’s stated belief invite claims.
• Deciding by category rather than by role. A blanket answer reads as no analysis at all.
• Forgetting retention. Sensitive records kept indefinitely become a liability of their own.

The same questions, beyond COVID-19

Vaccination mandates have passed, but the same pattern appears whenever an organization suddenly has to collect sensitive information about every employee or make many individual judgments quickly.

Return-to-office mandates are the clearest recent case. When employers and the federal government ordered staff back to offices in 2024 and 2025, accommodation requests followed, including disability-based requests to keep working remotely. The same three-part structure applied: a status record of who works where, a recurring process of attendance tracking, and a set of individual judgments on requests to stay remote. The judgments again carried the lasting risk.

The pattern will recur with any future public health requirement, with new screening or background rules for sensitive roles, and with any policy that turns a personal characteristic into a condition of work. An organization that has a standing accommodation process, a configurable case platform and a restricted medical data store can absorb the next surprise in weeks. These questions apply to any such case:

1. Where exactly is employee medical information stored, and who can see it? Can we prove that with an audit trail?
2. Do managers see only what they need to make a scheduling or access decision?
3. When we need a recurring process, such as weekly evidence, do we have a platform with reminders, deadlines and escalation, or are we relying on email?
4. Who decides accommodation requests today: a central team with written criteria, or individual managers?
5. Can we produce a list of all requests and outcomes by department, and when did anyone last compare them?

With hindsight

The requirements met very different fates. OSHA published its standard on November 5, 2021, and the Fifth Circuit paused it within days. Challenges from around the country were then consolidated in the Sixth Circuit, which lifted that pause in December. In January 2022 the Supreme Court stayed the OSHA standard, which OSHA then withdrew as an enforceable rule later that month, while allowing the CMS health care staff requirement to take effect. A stay is a court order pausing a rule while legal challenges proceed; for the OSHA standard, the pause effectively ended it.

The two decisions came the same day, in National Federation of Independent Business v. OSHA and Biden v. Missouri. The Court treated the two rules differently because of the agencies’ powers. CMS has long set conditions for facilities that take Medicare and Medicaid funds. The Court found that OSHA lacked authority for so broad a workplace mandate. Hospitals therefore spent early 2022 running exemption processes under a live rule, while most private employers saw their federal obligation disappear.

A federal court in Georgia blocked the contractor requirement nationwide in December 2021, and a federal court in Texas blocked the federal employee requirement in January 2022. The administration ended the federal employee and contractor requirements in May 2023, with CMS withdrawing its staff rule around the same time. So within about a year and a half, the vaccination mandates that had consumed so much organizational energy were gone, and the status and testing records they produced could be retired on a retention schedule.

The exemption decisions lasted longer. EEOC data showed religious discrimination charges rising from about 2,100 in fiscal 2021 to more than 13,800 in fiscal 2022, a jump the agency linked largely to vaccine-related claims. Lawsuits by workers whose religious accommodation requests were denied continued for years, and some juries returned large verdicts. In November 2024, for example, a federal jury in Detroit awarded a former Blue Cross Blue Shield of Michigan employee about $12.7 million, most of it punitive damages, over a denied religious exemption. The company disputed her claim. For the organizations involved, the decisions made in a few hectic weeks in late 2021 became the subject of litigation long after anyone was checking vaccination cards.

In June 2023, the Supreme Court’s decision in Groff v. DeJoy raised the bar employers must clear to show undue hardship when refusing a religious accommodation, which affects every accommodation process today. Employers must now show a burden that is substantial in the overall context of the business, rather than any cost above a trivial one. The reasons recorded for each decision carry even more weight than before.

Groff did not settle individual cases. Lower courts have since applied the new standard fact by fact, weighing the actual costs and alternatives each employer considered. That puts the contents of each case file, rather than any general policy statement, at the center of the dispute.

The military shows how long the tail can be. Congress directed the end of the armed forces’ vaccination requirement, which was rescinded in January 2023. In January 2025 an executive order directed that service members discharged solely for refusing the vaccine be offered reinstatement with back pay. Decisions made under one administration’s policy were reopened under the next.

Employers that kept consistent, documented exemption records have been far better placed in those disputes than those that relied on email. The pattern applies well beyond vaccines. Whenever a policy requires many individual judgments about employees, quickly, the urgent data collection will draw the attention, but the judgments carry the long-term risk. Those deserve the strongest people, a proper case file for every decision, and regular checks for consistency, from the very first week.