Health policy expert Lawrence Gostin runs through the complicated legal rules around businesses asking for proof of Covid-19 vaccinations.

“Vaccine passports,” or Digital Health Passes (DHPs), have been lauded by many business leaders as way to “get back to normal.” Polling shows there is strong public support for employers requiring Covid-19 vaccination for in-person work. States like New York have wholeheartedly embraced them, but some governors have voiced strong opposition—with Florida Gov. Ron DeSantis and Texas Gov. Greg Abbott going so far as to issue executive orders banning use in their states.

How do state and federal powers intersect on implementing DHPs? And can private companies require proof of vaccination as a condition of returning to work, or even as a requirement for customers? Here is a look at some of the legal and ethical issues.

Could the Federal government mandate a vaccine passport? 

The White House has repeatedly said that is has no plans to require any sort of DHP. The president would have a hard time implementing one even if he wanted to. In the U.S., public health powers reside primarily in the states, and not the federal government. A national system would have to be implemented by congressional action, which seems unlikely. Congress, moreover, would have to demonstrate that DHPs are needed to prevent interstate transmission of Covid-19. If the DHP restricted constitutional rights, such as attending a religious service or a public demonstration, the Supreme Court could strike it down. The Supreme Court’s new conservative majority has already shown it is prepared to aggressively protect religious freedom, even in a public health emergency. 


Even if the federal government doesn’t require DHPs, it should at least offer scientific guidance and technical assistance to states and businesses. Without federal coordination, we are likely to see a patchwork of state, local, and private sector DHPs, with varying quality. Many businesses and colleges are already announcing they will require vaccinations. It’s therefore preferable to do so using sound scientific, technical, and ethical guidance, which only the federal government can provide.

States have broader powers to implement both vaccine mandates and a vaccine tracking system like a DHP, but also should be careful when restricting constitutional freedoms. New York State is currently testing a voluntary DHP called the Excelsior Pass. We may see more DHPs implemented in the coming months. If carefully designed, they are likely to be both legal and useful to help reopen portions of the economy that might otherwise remain shuttered, like concerts, sporting events, and indoor dining. Customers are more likely to frequent businesses if they trust that those surrounding them are vaccinated. 

In fact, the idea of vaccine passports in the United States isn’t new, and you probably already have one, especially if you have attended elementary school or a higher education institution. Most schools require proof of vaccination for their enrolled students, and most colleges and universities require proof of certain vaccinations for students moving into dormitories. These private vaccine requirements are legal, and the private sector is the most likely venue where we will see both vaccine requirements and the implementation of DHPs to prove vaccination status. The Equal Employment Opportunity Commission (EEOC) has already stated clearly that employers can require Covid-19 vaccinations for their employees, and some private businesses, like nursing homes and hospitals, have already implemented these requirements. Businesses have a legal and ethical obligation to provide a safe working environment.

In order to avoid infringing on civil liberties, employers must also offer exemptions to vaccine requirements for medical reasons and sincerely held religious beliefs, or offer reasonable accommodations, such as telework, for persons with disabilities. 

Can governors or state legislatures mandate or ban vaccine passports? 

Can governors ban DHPs in their state? Florida’s Ron DeSantis and Texas’ Greg Abbott have tried to do so by issuing executive orders. While this is a grey legal area, it’s unlikely that a governor acting alone has the authority to prohibit private businesses from using DHPs. Ron DeSantis’ executive order, for example, is likely invalid—that sort of regulation would need to go through the state legislature. The governor also can’t use emergency health powers to ban DHPs because proof of vaccination actually makes everyday activities safer. The EEOC has already said businesses can require vaccinations, DeSantis and other governors acting via executive order are contradicting federal oversight.

DeSantis’ executive order also interferes with Florida businesses that operate across the United States and internationally, including airlines and cruise ships, that may want to implement DHPs to safely reopen. DeSantis has also sued the Centers for Disease Control and Prevention (CDC), which has issued guidance and regulations affecting the cruise industry. Cruises, by their nature, are high-risk environments for many airborne and foodborne diseases and they have caused major super-spreader events for Covid-19. Cruise ship staff and passengers travel to different ports and destinations. When they disembark or come back home, they can expose their family, friends, and the general public to Covid-19. Given the danger that cruises could pose, the CDC has clear powers to regulate to ensure the safety of the general public.

The cruise industry has a strong economic incentive to keep their staff and passengers safe. Most people won’t join cruises if they fear contracting a dangerous disease. It is for that reason that the industry will probably look to vaccinations as a way to get back to business as usual. And they may want DHPs to help them keep track and ensure everyone is fully vaccinated. The U.S. airline industry has the same incentives to ensure safety. Foreign carriers are already planning for DHPs. Especially for international destinations, U.S. carriers may want to use proof of vaccination as a tool to fly safely. The Biden administration already requires passengers (including U.S. citizens) who board a flight to the U.S. to show proof of a recent SARS-CoV-2 negative test. It is only a matter of time that it will require vaccination.

What are some of the other limitations around vaccine passports? 

Despite their promise, DHPs still face major scientific and technical challenges. The largest challenge, though, is ethical and how DHPs intersect with vaccine inequities.

The three Covid-19 vaccines currently authorized for emergency use in the United States all have different degrees of efficacy, and the Food and Drug Administration is likely to authorize additional vaccines in the coming weeks and months. Moreover, it is still unknown how long vaccine-induced protection lasts. And while scientists believe that vaccines significantly diminish risks of spreading SARS-CoV-2, we can’t be sure how much transmission will still occur. Any DHP or vaccine mandate would need to be updated as more information comes to light about vaccines and the protection they afford. New Covid-19 variants may also have different impacts for vaccinated people. In future, we will likely all need booster shots to be sure our immunity stays strong and is effective against new variants.

It is also important to note that mandates are more difficult while vaccines are authorized under an Emergency Use Authorization (EUA). Historically, vaccine mandates have been instituted for fully licensed vaccines, and not those used in an emergency. It would be wise for governmental entities to wait until Covid-19 vaccines are fully licensed by the FDA before instituting a mandate, except in a case of true urgency, such as vaccinations in prisons and nursing homes where the risk of transmission is extraordinarily high. The EEOC’s guidance, however, does apply to vaccines under EUA, so it remains lawful for employers to require them now. 

Verifying an individual’s vaccine status is also a major technical challenge. Unlike many developed countries, the U.S. has no national vaccine registry, and state-based systems vary widely in quality and efficiency. In order for DHPs to be reliable and trustworthy, people should not be able to falsify their vaccine status. There are private companies working to solve this problem, but they would have to win public trust to maintain private medical information. 

The opposition raised by many government leaders that vaccine passports infringe on individual freedoms, however, doesn’t hold water. None of the DHP proposals would require proof of vaccination when it comes to exercising civic rights, like voting, for example. Vaccine passports would be used to ensure the safety of workplaces, travel, and social venues. Everyone has a right to make decisions that affect only themselves. But refusing to put on a mask or get a vaccine and then congregating at work or a shop isn’t a right that people have.

The biggest ethical challenge to implementing DHPs is that vaccines have been distributed with profound inequity, both domestically and internationally. Communities of color in the U.S. have had much less access to vaccines, and many low- and middle-income countries have been unable to start vaccination campaigns at all because of lack of supply. Any DHP that is implemented before these inequities have been addressed will only exacerbate them. Equity isn’t a side issue. It has to be front and center.

The controversy swirling around vaccine passports has shown yet again that any public health measure can be politicized, like masks or vaccines. But the truth is that vaccines are not only our best way out of this pandemic; they’re our only way out of this pandemic—because it’s clear that too many of us can’t, or won’t, change our behavior.

The author would like to acknowledge Lauren Dueck and Cynthia Sun for providing expertise in preparing this article.

Full coverage and live updates on the Coronavirus