Non-binding Guidance: COVID-19 Vaccine Mandate Litigation

This installment of Ropes & Gray’s podcast series Non-binding Guidance explores the current legal challenges relating to vaccine mandates for public and private sector employers and institutions of all types. Join Greg Levine, head of Ropes & Gray’s life sciences regulatory and compliance practice, Megan Bisk, a partner in the employment, executive compensation, and employee benefits practice and lead of the employment specialty group, and David Peloquin, a partner in the health care practice group, as they discuss ongoing lawsuits related to COVID-19 vaccine mandates, the context of approvals through Emergency Use Authorizations, the PREP Act and data privacy implications, and employment law considerations. 

Transcript:

Greg Levine: Welcome to Non-binding Guidance, a podcast series from Ropes & Gray focused on current trends in FDA regulatory law, as well as other important developments affecting the life sciences industry. My name is Greg Levine, and I am head of Ropes & Gray’s life sciences regulatory and compliance practice group, and a partner in the firm, based in Washington, D.C. I am here today with my colleagues Megan Bisk, a partner in the employment, executive compensation, and employee benefits practice, based in Boston, and David Peloquin, a partner in the health care practice group, also based in Boston.

On today's podcast, we will discuss ongoing lawsuits related to COVID-19 vaccine mandates.This question has taken on greater urgency with the spread of the Delta variant of the coronavirus, which appears to be more transmissible and potentially more virulent—it is becoming a “pandemic of the unvaccinated,” and in some locations, it is already leading to the re-imposition of mask mandates. As a result, public and private sector employers and institutions of various types are faced with challenging questions in determining what their policies ought to be with respect to requiring vaccinations.

We’ll begin today by discussing vaccine mandates in the context of the current environment, where all of the coronavirus vaccines have received Emergency Use Authorization but are not yet fully licensed, provide an overview of current cases, and discuss the future of vaccine licensure. I’ll then turn it over to my colleague, David, to discuss PREP Act and data privacy implications. Last but not least, our colleague Megan Bisk will discuss employment law considerations related to vaccine mandates.

A key piece of background information for understanding the current legal challenges to vaccine mandates is that none of the current vaccines is fully approved—or “licensed,” which is the legally correct term—by the FDA. Instead, the vaccines have received Emergency Use Authorization, or EUA, from the FDA under Section 564 of the Federal Food, Drug, and Cosmetic Act. That section allows FDA, pursuant to an appropriate Declaration by the Secretary of HHS, to authorize the use of unapproved medical products or unapproved uses of approved medical products in a public health emergency, when certain criteria are met, including that there are no adequate, approved, and available alternatives.

Here, the Secretary of HHS issued a declaration of a public health emergency related to COVID-19 on February 4, 2020, and that declaration allowed the issuance of EUAs for medical products to treat or diagnose COVID-19. The FDA, in the context of COVID, has granted nearly 400 EUAs, including for personal protective equipment, diagnostic tests, therapeutics, and notably for today’s purposes, for vaccines. But not all EUAs are created alike. For the vaccines that have been authorized, what FDA required was essentially an “EUA on steroids,” meaning that they set the bar for authorization quite high. They required large, randomized, placebo-controlled studies and a demonstration of minimum effectiveness of at least 50%, which the currently authorized vaccines all surpassed by a longshot. And since the authorization of these vaccines, there have been hundreds of millions of doses administered in the U.S., which has allowed the collection of substantial amount of additional safety data on the vaccines.

So, turning to the litigation challenges, we have been tracking a number of cases around the country, as of a couple days ago, there are now two that have had court decisions in them. The first was Bridges v. Houston Methodist Hospital—that was a wrongful termination case involving a vaccine mandate applicable to employees at a private hospital. The plaintiff there argued that she was wrongfully terminated for refusing to be a “human guinea pig” in what she termed an “experimental” vaccine. In June, the federal district court for the Southern District of Texas dismissed that case in a very short ruling—a four-page ruling—finding first of all that she had not met Texas law requirements for establishing wrongful termination because she wasn’t required to commit an illegal act. But the court also analyzed her claim that the vaccine mandate violated public policy because Section 564 of the Food, Drug, and Cosmetic Act requires that when FDA issues an EUA, it impose conditions of authorization that ensure that potential recipients of a product are informed of the product’s EUA status, the known risks and benefits, and also the option to refuse administration of the product and the consequences, if any, of such refusal. So, the plaintiff argued that in essence, she was not given the option to refuse the product. But the court ruled that she had misconstrued that EUA provision, which among other reasons, she did not have a private right of action to enforce it. 

The court also readily dismissed her argument that this mandate violated federal law governing the protection of human subjects, because a requirement that employees receive an EUA-authorized vaccine was not a clinical trial of the vaccine, and so the federal laws and regulations referred to there were not applicable. In addition, the judge went out of her way to state that “although [the plaintiffs’] claims fail as a matter of law, it is also necessary to clarify that [the plaintiff] has not been coerced,” and that every employment includes limits on the worker’s behavior. So one theme we see in these cases, and we’ll see in the next one that I’ll talk about in a minute, is the court’s are saying, “No one is strapping you down and physically forcing you to have these vaccines taken, and you might have other options. In the case of private employment, you can be employed elsewhere.”

The other case that has had a court ruling is Klaassen v. Indiana University—that involved a challenge to the vaccine mandate issued by Indiana University that, at least in its initial form, would have required proof of vaccination for students and others—teachers, other employees—to be present on-campus this coming fall. There’s an interesting feature in this case in that Indiana’s legislature had enacted a “Vaccine Passport Law” that prohibited state and local government units—which presumably would include Indiana University, a state public institution—from requiring or issuing vaccine “passports,” which are any kind of documentation to indicate an individual’s COVID immunization status. And so the plaintiffs argued that the mandate violated that state law in addition to violating the federal EUA provisions—similar to the argument in the Houston case—and then also their federal constitutional rights, substantive due process rights. Now, Indiana University later changed its mandate so as not to require proof of vaccination—you have to attest that you’re vaccinated, but no longer have to require proof—and that vaccine passport argument was dropped from the case, and there also was a serious legal question about whether the plaintiffs had a private right of action to enforce that vaccine passport requirement.

But on July 19, a federal judge in that case denied the plaintiffs’ motion for a preliminary injunction against the mandatory vaccination policy at the University, and issued a 100-page order in which the court reviewed the policy, the process by which it was established, the state of the current science on vaccines, and also what’s happening currently with the coronavirus. In fact, this was so recent the court talks about the emergence of the Delta variant and what that might mean. And then it’s quite an involved analysis, but the court, applying a rational basis test, held that the Fourteenth Amendment permits Indiana University to pursue a “reasonable and due process of vaccination in the legitimate interest of public health for its students, faculty, and staff.” And so, this was a preliminary injunction stage—this case is not over—but the court denied the motion for preliminary injunction essentially saying that, “The likelihood of success on the merits was extremely low, if not nil at this point, or the evidence submitted to the court to this point.”

There are a couple of other cases that we’re following that have not yet had substantive rulings, or have had only brief orders without taking on the substance in great detail. One of them is Legaretta v. Macias—this is a case out of New Mexico in which the state corrections employees refused to comply with a county vaccine mandate and were reprimanded as a result. The plaintiffs argued that this vaccine mandate violated the EUA provisions of the Federal Food, Drug, and Cosmetic Act because the plaintiffs were not informed of the option to refuse the vaccine (and were told that they would be fired if they did refuse). They argued that the EUA provisions and federal laws governing the administration of medical products preempted any inconsistent state or local laws. In response to these claims, the defendants noted that the CDC itself had said that the decision to mandate vaccines was a matter of state or other applicable law.And they also argued that the plaintiffs failed to meet the burden of proof for a preliminary injunction—not only was economic loss not enough to be considered irreparable harm, but the plaintiff in this case had only received counseling and had not actually been fired. In a brief order on a TRO, the court denied the request for the TRO and said there was not a showing of irreparable harm that was going to meet the standard, so it was pretty clearly not going to meet TRO requirements. But the motion for the preliminary injunction in that case remains pending.

The other case we’re following closely is California Educators for Medical Freedom v. the Los Angeles Unified School District, where the plaintiffs are school district employees who were told that if they were not vaccinated by April of this year, they could face a “job detriment” and possible termination of employment. Again, the plaintiffs here made a number of arguments, including that the mandate violated California law, the federal law preempted the state’s mandate, and that their substantive due process rights were violated because the plaintiffs had a right to be free from “forced medical experimentation.” The defendants here have argued that the preemption argument was not a “bona fide” cause of action because they did not actually allege any specific federal law that would preempt or supplant state law, and they were trying to raise preemption as a separate claim—cause of action. And they argued that there was no constitutionally protected right upon which the due process claim was based, and their motion to dismiss in that case remains pending.

Turning to where these mandate cases may be heading, eventually, the Pfizer, Moderna, and J&J vaccines are likely to be fully approved by the FDA. Pfizer and Moderna have already indicated that they have started the process of submitting a Biologics Licensing Application—full BLAs for full licensure. And in a press release after the J&J vaccine pause was lifted by the FDA in April 2021, J&J indicated they would submit a BLA at some point. We now know also that the FDA has announced that the Pfizer vaccine is going to receive priority review, which means that at some point probably within the next six months we would expect there to be a decision on that. So, what we’re going to see eventually is going to be a mixed bag of both EUA-authorized and FDA-approved vaccines, and that’s going to muddy somewhat some of these arguments in these cases where they’re relying on the EUA provisions of the FDCA as a key point of argument. Although interestingly, in the Indiana case, the plaintiffs did have said that even if these vaccines receive full licensure, they intend to continue their challenge. So that then would raise for the more fundamental question about whether vaccines can be mandated or whether a coronavirus vaccine could be mandated—there’s old precedent going back to the early 1900s from the Supreme Court that says local health departments or state health departments can mandate vaccines. That’s been pretty well accepted.We all know about childhood vaccine mandates for schools—in fact, Indiana University has mandated certain vaccines for students for years now. Given the background law and the grounds for challenges that we’re seeing, as well as the facts are likely to be changing as these vaccines become fully licensed, employers and schools will still likely face challenges to any mandates that they might impose. But the mix of arguments are likely to change, and at least this EUA argument, which seems to be one that is sort of a favorite among plaintiffs who are challenging these cases, is likely to go away, and they’re going to have to rely on just the more fundamental constitutional principles unless they have some specific state law that they can turn to. So, whether these arguments are likely to succeed, we’ll see. So far, the trend seems to be that the mandates are being upheld when challenged.

David, can you now talk about PREP Act and data privacy considerations when implementing a vaccine mandate?

David Peloquin: Yes. As public vaccination sites close due to a decrease in demand, some clients have been asking about whether they can contract with a health care provider to offer vaccines on site at the employer’s facility to employees or other members of the community in an effort to make vaccines available to underserved populations. Employers sometimes are concerned about the liability they may face in this instance from a person administered the vaccine at the employer site who suffers an adverse reaction as a result of the vaccine. 

In cases in which an employer serves as a site at which vaccines are administered, the Public Readiness and Emergency Preparedness Act, or PREP Act, may provide immunity to liability caused by, arising out of, relating to, or resulting from the distribution or use of the vaccine in such an instance. The PREP Act is a federal law that provides liability immunity under federal and state law to certain individuals and entities, referred to as “covered persons” in the law, against any claim of loss caused by, arising out of, relating to, or resulting from the manufacture, distribution, administration, or use of certain “covered countermeasures.” Vaccinations for COVID-19 that have received an Emergency Use Authorization or that are fully licensed by the FDA qualify as “covered countermeasures.” 

Included in the definition of “covered persons” is a category of individual or entity referred to as a “program planner.” The PREP Act and guidance issued under the Act indicate that a “program planner” includes any person “who supervises or administers a program with respect to the administration, dispensing, distribution, provision, or use of a Covered Countermeasure, including a person who establishes requirements, provides policy guidance, or supplies technical or scientific advice or assistance or provides a facility to administer or use a Covered Countermeasure.” Thus, if an employer makes its facilities available for administration of a COVID-19 vaccine, that employer would likely be considered a “program planner” for purposes of the PREP Act and would likely enjoy the liability immunity available under the PREP Act.

Turning to some data privacy considerations we’ve received questions on from clients, another concern employers often have is which U.S. privacy laws apply to the information they obtain regarding an employee’s vaccination status. Because vaccination status is the health information of employees, many clients immediately assume that the Health Insurance Portability and Accountability Act of 1996, generally known as HIPAA, will apply to the information. This is often not correct, however. It is important to remember that HIPAA applies only to the use and disclosure of protected health information, or PHI, by entities that are considered “covered entities” for purposes of HIPAA. These “covered entities” include health care providers, health plans, and health care clearinghouses. Thus, employers who are not these types of entities typically would not be considered “covered entities” for purposes of HIPAA and the information that they collect regarding employee vaccination status would not be considered PHI subject to HIPAA. 

For employers that are “covered entities” subject to HIPAA, whether information on employee vaccination status is considered PHI will depend on how the information is collected and stored.This is because the definition of “PHI” under HIPAA excludes information that is held in employment records by a covered entity in its role as an employer. Thus, if a “covered entity” health care provider, such as a health clinic or hospital, holds information on its employees’ vaccination status solely in their employment records, that information would not be PHI subject to HIPAA. However, if the “covered entity” also serves as a treating provider to its employees and the information on employee vaccination status is made available to health care providers within the organization who are treating the individual as a patient rather than an employee, then this lack of segregation between the employment records and patient records may cause the vaccination status information to be treated as PHI subject to HIPAA. In that case, the covered entity could use and disclose the vaccination status information only as permitted by the HIPAA Privacy Rule.

Even if employee vaccination status is not subject to HIPAA either because the employer is not a “covered entity” or the employer is a “covered entity” but stores the information solely in employment records, there are likely to be other laws that require the employer to safeguard the employee’s information. For example, the Americans with Disabilities Act, or ADA, requires that employers keep confidential any medical information they learn about a job applicant or employee, even if the information is not about a disability. Guidance from the Equal Employment Opportunity Commission, or EEOC, confirms that an employee’s COVID-19 vaccination status would be considered confidential medical information under the ADA. Medical information about employees should be stored separately from the employee’s personnel file, thus limiting access to this confidential information. Guidance from the EEOC has advised that medical information related to COVID-19 may be stored in existing employee medical files, and thus, an employer should not need to create a separate employee medical file to store employee vaccination records.

In addition to the ADA’s requirements for maintaining employment information in confidential medical files, state privacy laws may impose obligations on employers’ handling of employee vaccination information. For example, the California Consumer Privacy Act, or CCPA, governs the collection of “personal information” of California residents, referred to as “consumers” in the CCPA, by “businesses” that are subject to the CCPA. The CCPA, as amended by the CPRA last year, currently contains a provision that exempts employee personal information from most requirements of the law until January 1, 2023. However, this exemption does not exempt employee personal information from the requirement that a business provide the consumer with information at or before the point of collection that informs the consumer as to the categories of personal information to be collected and the purposes for which the categories of personal information will be used. This requirement is sometimes referred to as the “notice at collection” requirement. Accordingly, employers who are subject to the CCPA should consider how they will provide this notice to employees at the time that they collect the employee’s vaccination status, such as by making the notice available on an online portal through which employees submit vaccination information.

Meg, I’ll now turn it over to you for some more thoughts on considerations for employers.

Megan Bisk: Thanks, David. In the final segment of our podcast today, I thought I would touch on a few practical considerations for employers who choose to mandate vaccination—these considerations intersect with some of the items that Greg and David have just discussed.

First, if you do decide to mandate, be clear about the requirement, including when it takes effect and to whom it applies. This can be accomplished through a policy distributed to employees, or through some other formal written communication, that describes the requirement and indicates the deadline for compliance, the documentation required and the consequences of failing to comply. Further to David’s remarks, one of the key considerations here is how to confirm vaccination, and specifically, whether to collect copies of vaccination cards—which is permitted under federal law and generally permissible under the laws of most states—or to rely on some form of attestation or just an honor system. While the trend seems to be in favor of collecting or at least viewing the actual vaccination record, I have seen some employers take a different approach, particularly in states that have actual or pending legislation that prohibits vaccination passports. These statutes generally don’t apply to the employment context—and therefore don’t restrict an employer’s ability to ask for proof of vaccination—but they tend to correlate with stronger employee resistance to supplying this type of information. For that reason, and because most of the state guidance that allows employers to adopt different protocols for vaccinated vs. unvaccinated employees does not require that an employer obtain actual proof of vaccination status, not all employers are asking for that proof.

Another important consideration is how to deal with employees who decline to be vaccinated. Many employers are hesitant to put in writing that refusal to be vaccinated will lead to termination of employment. And although it is prudent to preserve flexibility, generally speaking, an employer will be in a better position to defend against a challenge to a mandatory vaccination requirement where the consequences of noncompliance have been made clear from the get-go. Other options, short of termination, might include an extended work from home arrangement—which for some employers will be workable and others will not—or an unpaid leave of absence. Although neither is required where an employee isn’t legally entitled to an accommodation—which I’ll touch on in just a moment—they are approaches that can help to mitigate the risk of an employment-related claim and help to retain employees in what is a tight labor market. This can also be particularly useful where an employee’s objection to vaccination is based on the EUA status of the vaccines such that he or she may elect to be vaccinated in the future.

As most listeners are probably already aware, employers who mandate vaccination will be required to provide exceptions for employees who are unable to be vaccinated because of a disability or religious objection. The framework is slightly different for each category of objection. Under the Americans with Disabilities Act, an employer is permitted to impose rules or requirements that prevent a “direct threat” to the health or safety of its employees. Because a vaccination mandate may tend to screen out individuals with disabilities, an employer must show that an unvaccinated employee would pose a direct threat due to a significant risk of harm to either the health or safety of that person or to others in the workplace that can’t be either eliminated or reduced by reasonable accommodation.

What that means is that if an employee with a bona fide disability is unable to be vaccinated as a result of that disability, an employer must make an individualized assessment of the risk posed by that particular employee, considering things such as: (i) duration, (ii) nature and severity, (iii) likelihood, and (iv) imminence of that risk. If the conclusion is that the person who can’t be vaccinated poses a direct threat to themselves or to others, that employee can be excluded from the workplace if he or she declines to be vaccinated. The employer would then be required to follow the typical interactive process that would apply in connection with any disability accommodation request to identify reasonable accommodations—such as a work from home arrangement—that would allow the employee to do his or her job and that do not pose an undue hardship to the employer.

Where it’s not possible to provide a reasonable accommodation—for example, somebody who can’t work remotely, or somebody who can’t safely be in the office through the use of PPE, or social distancing, or other mitigating measures—employers will still want to be careful before jumping to immediate termination. The employee may be entitled to leave under other applicable leave laws or, even if not, again it may be prudent to provide for some period of unpaid leave to minimize the potential for some kind of disability discrimination claim.

Similarly, if an employee expresses a religious objection to the vaccine mandate, the employer has to provide a reasonable accommodation unless it would pose more than a de minimis cost or burden on the employer (a much lower standard than the undue hardship standard that applies in the disability context). There is no requirement that the religious objection tie to an organized or recognized religion—it just has to be a sincerely held belief. An employer can request supporting information if it has an objective basis for questioning the religious nature or sincerity of the belief or practice, but it’s ability to probe at an employee’s objection is otherwise limited.

Most employers already have policies and protocols in place for accommodation requests, and employers should evaluate whether these existing policies and protocols will be workable for managing disability or religious exceptions to a mandatory vaccination requirement, or if it’s necessary to put something else in place. Many employers are used to handling these types of requests on a one-off basis, and an influx of vaccination accommodation requests may necessitate a more standardized approach to requests and certification requirements. At a minimum, employers will want to designate a centralized point of contact for these requests so that they can be evaluated in a consistent manner and also to minimize the extent to which direct managers and supervisors have access to the types of medical and other personal information that may be shared by employees making these requests.

Finally, employers will need to be prepared to reevaluate their vaccination policies going forward as public health conditions change, public health orders—many of which impose different requirements for vaccinated vs. unvaccinated workers—evolve, and more guidance comes out around the need for vaccine boosters. In other words, although many employers have already tackled the difficult question of whether to require vaccination, the inputs relevant to that decision are unlikely to remain static in the future.

Greg Levine: Megan and David, thank you for joining me today. And thank you to our listeners. For more information on this topic and others that we discussed, please visit our website at www.ropesgray.com. And, of course, if we can help you navigate any of the topics we discussed, please don't hesitate to get in touch. You can also subscribe to this series wherever you regularly listen to podcasts, including on Apple and Spotify. Thanks for listening.