Skip to content

U.S. Department of Defense Photo by Lisa Ferdinando

The Vaccine Is Here, Are You Ready?

Every organization has begun to ponder the question: Can we require personnel to be vaccinated against COVID-19? Should we?

The answers to these questions—probably yes, and probably not—are really only part of a complex equation organizational leaders must consider as the momentous hope accompanying multiple approved vaccines crashes into the reality of needing the time and resources to vaccinate billions of people.

Can a Company Mandate the COVID-19 Vaccine?

First, the initial questions. Can an organization mandate that employees receive the vaccine? Jurisdictions around the world will have different answers.

In mid-December, the U.S. Equal Employment Opportunity Commission (EEOC) issued guidance enumerating the limits of mandatory vaccine policies from employers, the implication being that such mandates are likely legal. Such a mandate could be justified by an employer’s duty to provide a safe workplace for its employees, customers, or others in a facility. As the EEOC guidance stipulates, exceptions or special accommodations may be needed for people who cannot take the vaccine due to a disability or a “sincerely held religious belief, practice, or observance.” The guidance is clear that the latter objection should apply liberally: “because the definition of religion is broad and protects beliefs, practices, and observances with which the employer may be unfamiliar, the employer should ordinarily assume that an employee’s request for religious accommodation is based on a sincerely held religious belief.”

While practice and precedent in the United States indicates companies may require vaccines, it is not enumerated in the law. An additional complication with COVID-19 is that the vaccines have received emergency use authorization (EUA) from the Food and Drug Administration. There is no precedent that addresses a company requiring an EUA drug.

In Europe, companies do not generally have the same right to require vaccinations as the way companies do in the United States. According to a Reuters report, in France, some vaccines can be mandated in some professions. In Germany, such mandates are even more restrictive, and in the UK mandates would have significant legal hurdles.

“Logistics, equity, and distribution are the three factors that are going to affect the vaccine rollout,” says Sarah J. Powell, director of emergency management at Temple University. “In the U.S., we have the CDC playbook, which gives guidance on who will be getting the vaccine when. But each state will be implementing the playbook, and they will do it a little differently, so you may have to deal with several different approaches to the vaccine rollout. And if you’re an international organization, you not only need to understand the policies where your headquarters is located, but you need to understand the distribution rollout in every other area of strategic importance. Thailand is going to be different than the Philippines which will be different than Europe.”

Should a Company Mandate the COVID-19 Vaccine?

Setting aside the EUA questions, if U.S. firms can mandate the vaccine, the question turns to should they mandate?

“The number one question is around mandating,” says Powell. “Our public health agency recommends not mandating—and risk communicators will tell you the minute you mention the word ‘mandate,’ people lose their minds. You will lose the trust of a lot of people the minute you try to mandate a medical treatment. You really need to think about the language you use.”

Lisa Oliveri, CPP, PCI, director of global safety and security for the Education Development Center, made a similar point. “I think the general consensus and what I’ve heard from different legal experts thus far is that yes, you technically could mandate it, but that decision will come with a host of challenges. If I had to guess today, I think the COVID-19 vaccination will be strongly encouraged at most organizations, and they will have to tailor very carefully their protocols about personnel coming back to the office and resuming international travel.”

In an interview with NPR, Johnny Taylor Jr., CEO of the Society for Human Resource Management, came to a different conclusion. “I think the issue is pretty clear, and it goes back to I think the default is employers are going to say OSHA says I have to protect this workplace," he said. "I understand the country’s history, racist history, sexist history. I mean, you can go down the list. But at the end of the day, I can’t bring you into the workplace if you pose a legitimate hazard to other employees. So you can’t be so focused on the individual that you put the larger group at risk.”

Some industries may have other mitigating factors. For example, commercial airlines or cruise companies may mandate that passengers provide proof of vaccination. Can or should they force a mandate on their customers that they do not enforce for their employees?

What is the Alternative to Mandating Vaccination?

To summarize the position U.S. companies are in: Companies can likely mandate that their employees show proof of COVID-19 vaccination to start or continue employment. That right could be compromised by the emergency use authorization of the drugs in question, a condition that will likely exist for many, many months. In addition, exemptions could make such mandates untenable. That is particularly true as opinion polling suggests that a significant portion of the U.S. population is suspicious of the COVID-19 vaccine and is either wary of taking it or will refuse it all together. Any widespread compulsory effort may undermine the public’s confidence even more.

For Oliveri and Powell, the answer is that organizations can use their position to educate and encourage.

“This is where the power of risk communications comes in,” says Powell. “You need to use language that is empowering, that is encouraging, that is about bringing people together. You need to be transparent, and you need to speak about the organization as a community where we have an obligation to protect one another.”

The place to start, she says, is working to understand where your employees stand on the issue. It could be that 80 percent are already planning to get vaccinated when they can, in which case a companywide mandate is pointless, since a certain number will be exempt anyway.

At many organizations, the questions and concerns are likely to come from both sides. On one side, some staff or managers will be uncomfortable with a policy that mandates the vaccination. On the other, some staff will not want to work closely with staff who refuse to get vaccinated.

For Oliveri, the key is building and maintaining trust. “I’m hoping that the way we’ve been communicating about COVID-19 for the last 11 months, has built buy-in and trust and that will benefit us on the backend of this pandemic,” she explains.

“It’s important that all of our staff know they are being listened to, that we understand their positions and concerns, and that we are working to develop the most comprehensive and fair plans and protocols so that they feel like before they ever step back into our offices that it is a well thought-out, consistent approach and that we’ve been transparent about the decisions we make and why we make them,” Oliveri adds.

Powell sees an arduous task ahead, with organizations playing an important role. “Organizations need to deeply understand their own people and try to assist with mass vaccinations. It’s going to take all hands on deck to convince people in this country to take the vaccine,” she says. “Especially when you have an established anti-vaccination movement and you see that people are divided on political lines, with 50 percent of Republicans saying they will be less likely to take the vaccine. This is something we have to address, and you can only address it through trusted sources communicating coming together and demonstrating a willingness to take it and the importance of taking it.”

What Are the Risk and Security Implications?

It is important to begin the conversations now—and it starts with making the biggest decision first: will your company mandate the vaccine or not?

“After you make that decision, you can begin planning the policies and procedures you will need to simultaneously reopen or resume operation,” Oliveri says. “You will need to plan how you will communicate the decision to your staff, and you need to be thinking about the other implications of the decision. If it’s a mandate, how will you enforce it? How will your choice affect insurance policies or claims from employees who become unwell if they are vaccinated? How will your organization manage data privacy related to information about who has or has not been vaccinated? There are a lot of really important questions we need to be prepared to address ahead of time and have an organizational plan.”

The decisions have tendrils that stretch through a wide array of an organization’s operations.

“What will your HR policies be?” asks Powell. “How will your post-vaccine policies impact the policies you might have changed since the start of the pandemic? If a person who doesn’t take the vaccine gets sick with COVID, that has the potential to create some really hairy situations—the minute you start brainstorming about it, you see just how many questions you have, questions that are hard to answer.”

Oliveri chairs the International Development Sector Committee (IDSC) of the Overseas Security Advisory Council (OSAC), a public-private partnership established by the U.S. State Department. She said the IDSC steering committee is working on developing a document that will delineate the issues and implications organizations will face once COVID-19 vaccines are widely available. It will likely take the form of questions organizations need to be considering at a high level now so they can develop informed policies and procedures. The document is expected in January 2021.

Powell is decidedly unenthusiastic about security departments playing a role in vaccine mandate enforcement. “One thing I’m concerned about on the security side is when we talk about enforcement of public health measures it really should not be the job of the security officer or law enforcement to enforce it," she says. "It really creates problems with communities; it’s just such a different animal than other types of enforcement. There’s really a question about whether frontline security personnel should have to mediate access control procedures that screen for vaccine mandate adherence. Are they screening for a vaccine passport? If so, what is the procedure when someone doesn’t have one? The decision to mandate is a top-level policy, but the management team needs to truly understand the downstream operational impacts.”

The vaccine passport Powell mentions is very much still a concept centered around travel rather than an implementable system. It is not new that some destinations (or travel companies) will require proof of vaccinations—yellow fever is a common example, with several countries in sub-Saharan Africa requiring proof of vaccination to enter. However, the idea gaining traction is an app for a mobile device that can be used to verify travelers have taken the required vaccinations. A couple of candidates have emerged. The CommonPass is a product currently in trial by the The Commons Project, an NGO established to develop and administer technology health platforms to benefit society. The other candidate is Travel Pass, being developed by the International Air Transport Association.

The idea that the need or desire for travel itself may also be a motivation for people to get the vaccine. “If the COVID-19 vaccine is mandated for travel to certain countries or to travel on specific airlines, that could be a deciding factor for people to get vaccinated," Oliveri says.

Another area for security to consider is more immediate. The first millions of doses of the vaccine have been earmarked for healthcare workers and people who work in facilities caring for seniors. Next in line are likely those in older age groups and with health complications that put them at greater risk.

After that is everyone else, starting with essential workers—and that’s the rub. Many companies and professions are lobbying to be at or near the top of the essential worker hierarchy.

“The lobbying is people saying, ‘Hey, don’t forget about us,’” Powell says. “And I’ve done that, too. I called our public health person and said don’t forget about the people who have been testing thousands of students every day.”

And there are numerous news reports of groups representing people looking to be included in early vaccination protocols, from Amazon to meat packers to news reporters themselves.

So We Return to Normal, or at Least the New Normal, by Spring or Summer, Right?

So many see the various vaccines and rejoice that there is finally light at the end of the tunnel. Powell and Oliveri join the chorus of public health experts who are saying, “Not so fast!” To carry the metaphor forward, the light may finally be there, but it is a long tunnel, and there is a lot of vigilance required for society to get there as safely as possible.

“The vaccine is just one piece,” says Powell. “We don’t even know exactly how it works. We don’t know if you can still pass the infection on to others after you’ve been vaccinated. And different vaccines may act differently. We don’t know if you can still test positive with an antigen test. The public health measures we’ve put in place are still going to need to be in place—especially if you’re not mandating the vaccine. You will still need to maintain distancing, no large gatherings, face coverings, plexiglass shielding. All of that stays for a long while yet.

"This is something I think security may have an advantage with," she continues. "We’re used to thinking about long-term implications. The administrators I’ve talked to are looking at Fall 2021 and thinking things will be back to normal because of the vaccine. I think security can have a role in preparing leaders that whatever normalcy is, we need to plan for it to be a long way off.”