How workplaces, hospitals, universities, and other organizations make vaccination-related decisions
This page explains how employers, healthcare systems, universities, and other organizations set their own vaccination policies within the limits of federal and state law. These are institutional policies — not government mandates and not federal recommendations. They operate through employment contracts, terms of enrollment, facility rules, and organizational health and safety standards.
Institutional vaccination policies are distinct from the federal recommendation process explained on the U.S. Federal Vaccine Policy page and from the state school-entry requirements explained on the State School Vaccination Requirements page. They are also distinct from the emergency-era federal mechanisms explained on the Emergency Powers and Pandemic Policy page, although some institutional policies were shaped by those mechanisms during the COVID-19 period.
Institutions set vaccination policies for a range of reasons.
Employers in healthcare, laboratory, and other high-exposure settings may require vaccination to reduce the risk of disease transmission among staff and the people they serve.
Hospitals, nursing homes, and other clinical settings have ongoing obligations to maintain infection control programs as a condition of licensure, accreditation, and federal program participation.
Facilities that participate in Medicare and Medicaid must meet CMS Conditions of Participation, which include health and safety standards. Vaccination policies may be part of a facility's infection control compliance.
Organizations such as The Joint Commission may set infection control and vaccination-related standards for accredited healthcare facilities.
Some institutions adopt vaccination policies to reduce legal exposure related to disease transmission in their facilities or workplaces.
Institutions that serve vulnerable populations — including young children, elderly residents, and immunocompromised individuals — may set vaccination expectations for staff who interact directly with those populations.
This section is not an endorsement or critique of any institutional vaccination policy. It describes the range of reasons institutions cite when establishing such policies.
Private employers generally have the legal authority to set conditions of employment, including health-related requirements, subject to applicable federal and state law. The key legal boundaries include:
In many states, employment is "at will," meaning employers can set workplace conditions — including vaccination requirements — as long as those conditions do not violate specific legal protections. Employees who decline to meet a vaccination requirement may face consequences including reassignment, unpaid leave, or termination, depending on the employer's policy and applicable law.
Under the ADA, employers must provide reasonable accommodations for employees with qualifying medical conditions that prevent vaccination, unless doing so would impose an undue hardship on the employer. A reasonable accommodation might include masking, testing, remote work, or reassignment to a position with less exposure risk.
Under Title VII, employers must provide reasonable accommodations for employees with sincerely held religious beliefs that prevent vaccination, unless doing so would impose an undue hardship on the employer. The accommodation process is similar to the ADA framework but evaluates the nature of the religious belief rather than a medical condition.
EEOC guidance provides the primary federal framework for how employers should handle both medical and religious accommodation requests related to vaccination. For detailed guidance, see the EEOC's COVID-19/ADA/Title VII resource page.
Employers that collect vaccination status or medical information from employees must handle that information in accordance with ADA confidentiality requirements. Medical information must be kept separate from general personnel files and shared only on a need-to-know basis.
Some states have enacted laws that limit employer vaccination requirements. The most prominent example is Idaho, which enacted the Idaho Medical Freedom Act (SB 1210, signed April 2025, effective July 1, 2025). This law prohibits government entities, schools, and private businesses in Idaho from requiring medical interventions — including vaccines — as a condition of employment, entry, or services.
The Idaho law includes limited exceptions: requirements mandated by federal law (such as certain CMS-certified facility obligations) and requirements related to business travel to foreign jurisdictions that mandate vaccination.
Other states have considered or enacted more limited restrictions on employer vaccination requirements. The scope and enforceability of these laws vary and are evolving. Readers should consult their state's current law for specific guidance.
The practical impact of an institutional vaccination policy depends on the specific policy, the setting, and applicable law. Common outcomes include:
The employee or student meets the vaccination requirement and no further action is needed.
An employee or student requests a medical or religious exemption. The institution reviews the request under its accommodation procedures and applicable law (ADA, Title VII, or institutional policy).
If an accommodation is granted, the institution may require alternative measures such as regular testing, masking, modified duties, or reassignment to a different role or location.
If no accommodation applies and the individual does not meet the requirement, consequences may include exclusion from specific duties, clinical placements, or campus housing; unpaid leave; or termination of employment.
Vaccination status and accommodation requests are treated as medical information subject to confidentiality requirements.
The specifics vary widely by institution, setting, and jurisdiction. Employer policies at a hospital operating under CMS conditions of participation may look very different from policies at a private-sector office or a university residence hall.
Healthcare facilities face additional considerations beyond general employment law. Patient safety obligations, accreditation standards, and federal program participation requirements can all influence vaccination policy in clinical settings.
Facilities that participate in Medicare and Medicaid must meet CMS Conditions of Participation (CoPs) and Conditions for Coverage (CfCs), which include infection control and prevention standards. Vaccination policies may be part of a facility's infection control program.
During the COVID-19 pandemic, CMS issued a specific interim final rule requiring vaccination for staff at Medicare- and Medicaid-certified facilities. The Supreme Court upheld that rule in Bidenv. Missouri, 595 U.S. 87 (2022). For the full account of that emergency-era action, see the Emergency Powers and Pandemic Policy page.
Healthcare accrediting bodies such as The Joint Commission include infection control standards that can affect how facilities handle staff vaccination. These standards are separate from CMS requirements but may overlap in practice.
Even outside of emergency-era mandates, many healthcare employers maintain vaccination requirements — particularly for influenza, hepatitis B, and other diseases relevant to clinical settings — as part of routine infection control. These policies typically predate the COVID-19 pandemic and are grounded in patient safety rather than government mandates.