Exploring the Legal Complexities of the Federal Vaccination Mandates

Closeup of election vote button with text that says vaccine mandate

In September President Biden announced a new national strategy to combat COVID-19 that included vaccination directives affecting millions of US employees.  In designing these mandates the Biden Administration had to navigate complicated principles of federalism in order to legally extend the mandates to workers beyond those employed directly by the federal government.

Through the 10th Amendment to the US Constitution, the power to regulate public health is reserved to the States, as an element of their general “police powers.”[1] The federal government has only the powers, including the power to regulate public health, granted to it by the Constitution. Where the federal government does regulate public health, it may do so only under the terms of laws adopted by Congress, which are presumed to be constitutional unless the federal courts hold otherwise.

Within this context, the Administration chose three paths to securing widespread vaccination status across the workforce, requiring vaccination among employees of:

  1. Entities that are federal contractors, under the President’s broad statutory authority to set the terms by which the government contracts for goods and services;
  2. Entities that are health care providers participating in Medicare or Medicaid, under a combination of statutes that allow the government to conditions those providers must meet in order to be reimbursed for their services; and
  3. Certain employers covered by the federal Occupational Health and Safety Act of 1970 (“the OSH Act”), an act that directs the government to ensure that such employers provide their employees a safe working environment

Given the highly charged political atmosphere within which these mandates were issued, it is unsurprising that they soon faced legal challenges. As a result, federal courts have already issued nationwide injunctions against enforcement of all three mandates. However, in no case are these considered final orders—rather they are preliminary injunctions issued where the court has found that the plaintiffs have a considerable likelihood of success on the merits and will be irreparably harmed if enforcement is not stayed. More briefing, further orders, and appeals will ensue, and it’s not unlikely that different federal circuits will issue conflicting decisions—making it probable that one or more of the mandates will end up on the US Supreme Court docket this term. As cases proceed, some employers in some federal circuits may be required to impose employee vaccine mandates, while at the same time employers located in adjoining circuits are prohibited from doing so.

Meanwhile, some institutions of higher education (IHEs) have long since announced that they will respond to the federal initiative by requiring all employees to be vaccinated.[2] Others—particularly those covered by state laws that conflict with the vaccination mandates—have decided to wait and see how the various lawsuits play out. Ultimately, if either the OSHA or federal contractor mandates prevail,  IHEs can plan on needing to impose some sort of vaccination requirement. (The mandate for Medicare and Medicaid providers applies more narrowly and will affect many, but not all, IHEs.) In the meantime, IHEs will want to be sure that they understand what is required of them by all three mandates, any of which may ultimately be upheld by the courts.

Vaccination Mandate for IHEs and other Federal Contractors
The President ordered the Safer Federal Workforce Task Force to issue guidance requiring that entities entering into or renewing a “Covered Contract” with the federal government must require employees to vaccinate against COVID-19.  In turn, the Federal Acquisition Regulatory Council was ordered to develop standard contract language requiring covered contractors and subcontractors to adhere to all guidance issued by the Task Force. Thus, though termed “guidance,” the document published by the Task Force on September 24 is legally binding on Covered Contractors.

What Contracts are Affected?
The Task Force Guidance scope of coverage is quite broad: “Covered Contracts” include “all contracts and any subcontracts of any tier thereunder, whether negotiated or advertised, including any procurement actions, lease agreements, cooperative agreements, provider agreements, intergovernmental service agreements, service agreements, licenses, permits, or any other type of agreement.”[3]

Significantly for IHEs, the President’s order excludes grants,[4] a traditional form of funding university research, but the inclusion of contracts for services in the definition means that almost every IHE will hold a Covered Contract with the federal government.

Federal agencies began to include the vaccine requirements on October 15, 2021 in extensions of previously awarded Covered Contracts, and on November 14, 2021 in new Covered Contracts. Except for employees legally entitled to an exemption, covered employees will be required to have received vaccines against COVID-19 by January 4, 2022.[5]

Which Employees are Covered by the Contractor Vaccination Requirements?
While the type of agreement affected by President’s order is fairly clear, determining which employees of a contractor fall under the requirement is less straightforward.

The Guidance defines a “covered contractor employee” as “any full–time or part–time employee of a covered contractor working on or in connection with a covered contract or working at a covered contractor workplace.” (Guidance, pp. 3-4. Emphasis added.) As explained below, the use of the conjunction “or” widely expands the number of employees subject to the mandate, and other definitions included in the Guidance add more complexities. First, the phrase, “working ‘in connection with’ ” a Covered Contract is given a very expansive meaning. According to FAQs issued in conjunction with the Guidance, employees are deemed to be working “in connection with” a Covered Contract if they “perform duties necessary to the performance of the covered contract, such as human resources, billing, and legal review.” (Guidance, p. 13.) It is irrelevant that such employees may be assigned to work in separate buildings from the area where the contract is actually being performed. They must be vaccinated, and such is the case even if they work from home. [6]

And even employees who don’t work on or in connection with a Covered Contract must be vaccinated if they work in a covered contractor workplace, defined as “a location controlled by a covered contractor at which any employee of a covered contractor working on or in connection with a covered contract is likely to be present during the period of performance for a covered contract.” (Guidance, p. 4.) Based on the FAQS, an entire IHE campus would presumptively be a covered contractor workplace unless the IHE can affirmatively establish that those employees who do work on or in connection with a covered contract could not come in contact with other employees in areas such as “lobbies, security clearance areas, elevators, stairwells, meeting rooms, kitchens, dining areas and parking garages.” (Guidance, pp. 10–11.)

Whether or not the scope of coverage built into the Guidance was intentionally designed to make it difficult for Covered Contractors to avoid organization–wide vaccine mandates, that result seems to be the likely effect. Few campuses provide or desire such insularity for their employees—both convention and business necessity dictate that IHEs provide communal cafeterias, bus stops, onsite convenience stores, libraries, etc. Moreover, requiring employees who do work on or in connection with a Covered Contract to sequester in assigned work areas and forego trips to the campus food court or student stores in order to avoid a campus–wide mandate would result in inequities, morale problems and probable employee grievances.

Mask Mandates for Federal Contractors
The Guidance does not stop at mandating vaccines and also includes provisions that contractors must comply with CDC COVID-19 guidelines, as those guidelines evolve. Currently that means that Covered Contractors will need to require all persons in the workplace, including visitors, to comply with CDC recommendations on masking and social distancing. The Guidance notes that the CDC recommendations are pegged to the level of community transmission in the area of the Covered Contractor’s workplace, and that contractors will need to check the CDC COVID-19 Data Tracker County View website at least weekly to be sure that their workplace safety protocols are appropriate for the community transmission level in the area of the workplace.[7] Of note, the injunctions issued against enforcement of the vaccine mandate for federal contractors does not apply to masking and social distancing requirements, and IHEs should continue to comply with them pending further legal developments.

Vaccine Mandates for Health Care Workers
On November 5, the US Department of Health and Human Services Centers for Medicare and Medicaid Services (“CMS”) issued a rule that requires most Medicare– and Medicaid–certified providers to ensure that their staffs are vaccinated against COVID-19.[8] Personnel covered by the rule must have had their initial dose of a two–dose vaccine or a single–dose vaccine by December 4, and must be fully vaccinated by January 4, 2022. Significantly for IHEs, the health care providers covered by the CMS rule include those that IHEs commonly operate or with which they are closely affiliated, such as hospitals.[9] In addition, the rule applies to all employees, whether or not they are engaged in direct patient care, and to students, trainees, and volunteers.

As with the federal contractor requirements, personnel entitled to a medical or religious exemption from vaccination must be provided with reasonable accommodations. While no process is spelled out for reviewing exemption requests, facilities are required to document and evaluate both religious and medical exemptions in accordance with federal law. Facilities must also develop a process for implementing precautions for unvaccinated staff, to mitigate transmission and spread of COVID-19. While such precautions are not specified in the regulation, the requirement that employers minimize the risk of transmission to at–risk individuals will likely be interpreted to mean that unvaccinated personnel must be masked and practice social distancing in the workplace. (For helpful guidance on the health care worker vaccination mandate, see the FAQs issued by CMS at https://www.cms.gov/files/document/cms-omnibus-staff-vax-requirements-2021.pdf .)

OSHA Vaccine Regulations
Unlike the mandates for federal contractors and health care personnel, the OSHA standards allow employers to opt either to require employees to be vaccinated or to submit to weekly COVID-19 testing. As directed by the President, OSHA issued an Emergency Temporary Standard (ETS) on November 4 defining the mandate, which affects employers with 100 or more employees. The ETS does not apply to employees who are already covered by either the federal contractor or health care worker regulations.

Scope of the ETS
The federal Occupational Health and Safety Act of 1970 (the “OSH Act”) regulates the acts of private employers, and not of state or local governments in their capacity as employers. Thus, the ETS applies to any private employer, including an IHE, that employees more than 100 employees. However, the OSH Act allows states and territories to opt out of the federal act and follow their own plans, which must be at least as effective as the federal act and must cover state and local government employers as well as private employers. Twenty–two states or territories have adopted such plans, and in those states it is likely that both public and private universities will be required to meet the OSHA vaccinate–or–test mandate.[10]

Many states, by statute or executive order, prohibit public and in some cases private employers from requiring employees to be vaccinated. Other states may, under state law, accommodate philosophical objections to vaccination, whereas under federal employment and disability laws, only employees with bona fide religious or medical reasons may be object to a vaccination requirement. OSHA takes the position that the ETS, grounded in federal law, preempts state law provisions to the contrary. Though for the time being, enforcement of the ETS has been stayed by a federal court, the White House has urged employers to continue to prepare to comply with the ETS requirements, including the December 6 deadline for employers to determine which employees are vaccinated and to begin enforcing a mask mandate.

Application to Students
Students who are also employees may be swept into either the federal contractor or the OSHA requirements. In addition, students who train in health care facilities are expressly required by the CMS rule to be vaccinated, unless entitled to a religious or medical exemption. Aside from direct legal mandates to require students to immunize, institutions that are required to mandate employee vaccines but choose not to require students to vaccinate may face substantial resistance from employees. While employees cannot sue their employers directly for violations of the OSH Act (or state plans), they may well be allowed to lodge complaints with OSHA that by exposing employees to students not known to have been vaccinated, their employers are creating unsafe workplace conditions in violation of the OSH Act. On the other hand, IHEs located in states that prohibit vaccine mandates may find it challenging to expand mandates required under federal law to cover students as well as employees, except for those students who are employees or must train in health care facilities.


  • Because it is anyone’s guess which of the three types of mandates may be upheld by the courts, IHEs need to understand them and be poised to implement any of them that may be applicable—on a tight timeline. IHEs that have not begun planning to implement some sort of mandate need to be prepared to be nimble and to act swiftly—not always easy accomplishments in a decentralized university organization.
  • Most IHEs will be required to comply with the stricter vaccine mandates imposed on covered federal contractors and (where applicable) health care entities—if they are upheld.
  • Amid the controversy surrounding mandated vaccinations, many have overlooked the requirement that federal contractors comply with CDC guidance on preventing COVID-19 transmission. As noted, currently that guidance imposes masking and social distancing requirements, and the mandate that federal contractors impose those requirements has not been stayed. Given that the CDC guidance has evolved over the course of the pandemic and that the level of intervention required is pegged to the transmission rate in an IHE’s geographic area, IHEs will need to assure that they have procedures in place to stay current on CDC guidance, promptly communicate changes to campus constituents, and enforce these public health requirements.
  • As IHEs gear up to meet deadlines for federal contractor employee vaccinations, those that have already developed solid procedures to verify vaccination status, process religious or medical exemption requests, or to conduct or verify testing will be at an advantage.
  • Given the charged political and social climate surrounding vaccine mandates, arbitrary or ad hoc processing of medical or religious exemption requests will no doubt result in costly and time–consuming litigation in addition to eroding employee morale. For tips on how to handle exemption requests, see Vaccine Requirements in Higher Education: Managing Vaccine Proof and Waivers, https://infectiousdiseasecouncil.org/vaccine-requirements-in-higher-education-managing-vaccine-proof-and-waivers/ and Anticipating COVID-19 Vaccine: What Should Institutions of Higher Education and Employer Be Doing Now?, https://infectiousdiseasecouncil.org/anticipating-covid-19-vaccine-what-should-institutions-of-higher-education-and-employers-do-now/.
  • Finally, with so many legal challenges pending against all three federal vaccine mandate approaches, IHEs must stay current on legal developments and involve legal counsel in implementing changes to policies or procedures made necessary by court orders or by the government’s response to such orders.

[1] The term “police power” applies much more broadly than to the power to regulate public order through law enforcement, and includes public safety, public health, and law and order. Berman v. Parker, 348 U.S. 26 (1954).

[2] “Biden Ordered Federal Contractors to Get Employees Vaccinated. Universities Have Begun to Comply,” Chronicle of Higher Education, October 15, 2021. https://www.chronicle.com/article/biden-ordered-federal-contractors-to-get-employees-vaccinated-universities-have-begun-to-comply?utm_source=Iterable&utm_medium=email&utm_campaign=campaign_3037356_nl_Academe-Today_date_20211018&cid=at&source=ams&sourceid=

[3] COVID-19 Workplace Safety: Guidance for Federal Contractors and Subcontractors, the Safer Federal Workforce Task Force (September 24, 2021), https://www.saferfederalworkforce.gov/downloads/Draft%20contractor%20guidance%20doc_20210922.pdf . (Hereinafter, “the Guidance.”)

[4] Also excluded are contracts or subcontracts below the simplified acquisition threshold of $250,000, contracts with Indian Tribes, contracts to be performed outside the continental United States, and subcontracts solely for provision of products.

[5] A Fact Sheet issued by the White House on November 4, 2021 announced that to provide consistency among the various federal vaccine mandates, the date by which federal contractor covered employees must have received their final vaccine doses by January 4, 2022. Subsequently the Guidance was amended, on November 10, to provide that covered employees must be “fully vaccinated” by January 18, 2022. The Guidance noted that people are considered fully vaccinated against COVID-19 two weeks after they receive the second dose in a two-dose series or two weeks after receiving a single-dose vaccine. In other words, to be “fully vaccinated” by January 18, employees must have received their final vaccination dose on or before January 4.

[6] Employees working from home are exempt from additional masking requirements imposed by the Guidance. Guidance, p. 11.

[7] https://covid.cdc.gov/covid-data-tracker/#county-view

[8] 86 Federal Register 61555.

[9] The rule covers ambulatory surgical centers; hospices; psychiatric residential treatment facilities; Programs of All-Inclusive Care for the Elderly (PACE); hospitals; long term care facilities; intermediate care facilities for individuals with intellectual disabilities; home health agencies; comprehensive outpatient rehabilitation facilities (CORFs); critical access hospitals; clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services; community mental health centers; home infusion therapy suppliers; rural health clinics/federally qualified health centers (FQHCs); and end-stage renal disease facilities. Id.

[10] Those jurisdictions are Alaska, Arizona, California, Hawaii, Indiana, Iowa, Kentucky, Maryland, Michigan, Minnesota, Nevada, New Mexico, North Carolina, Oregon, Puerto Rico, South Carolina, Tennessee, Utah, Vermont, Virginia, Washington and Wyoming. In addition, six jurisdictions have state plans that cover only state and local government employers, with private employers covered by the federal OSH Act: Connecticut, Illinois, Maine, New Jersey, New York and the U.S. Virgin Islands.

written by David Parker

Leave a Comment or Ask a Question