Healthcare Worker Immunization Requirements: A Complete Compliance Guide

If you run an employee immunization program, you already know the question that never has a clean answer: "Are these shots required, or just recommended?" A new nurse manager asks it. An employee who wants to decline asks it. A surveyor, eventually, asks it. The honest reply is that healthcare worker immunization requirements don't come from one rulebook — they come from three, and which answer is correct depends on which one you're looking at.

There is no single federal law that mandates most vaccines for U.S. healthcare personnel (HCP). What people call "the requirement" is really three overlapping layers — one true federal mandate covering exactly one vaccine, a set of national recommendations that carry no enforcement of their own, and a patchwork of state laws and employer policies where the real teeth are. Confuse the layers and you either over-promise a mandate that doesn't exist or, worse, miss the one obligation OSHA will actually cite you for.

Here is how the three layers stack up, starting with the only one that is genuinely federal.

Layer 1: OSHA — the one federally required vaccine, and only for exposed staff

The Bloodborne Pathogens Standard is the single place federal law reaches into your vaccination program, and it covers one shot: hepatitis B. Under 29 CFR 1910.1030, employers must make the hepatitis B vaccination series available within 10 working days of initial assignment to every employee with reasonably anticipated occupational exposure to blood or other potentially infectious material (OPIM).

Read that carefully, because two things narrow it sharply. It's an offer obligation, not an employee mandate. And it reaches only employees with occupational exposure — not every person who badges into the building. A billing clerk with no blood contact falls outside the standard's scope; a phlebotomist, a nurse, or an EVS worker who handles regulated waste does not. Calling hepatitis B "the only federally required HCP vaccine" is accurate only with that scope attached.

The offer comes with strings that are easy to get wrong:

• Free of charge. The vaccine and all related medical evaluations must be provided at no cost to the employee (1910.1030(f)(1)(ii)(A)). No cost-sharing, no "we'll reimburse you later."
• Performed by a licensed professional and following the U.S. Public Health Service recommendations current at the time (1910.1030). You don't get to freeze your protocol in 2005.
• Declination is allowed — but only in writing, verbatim. An employee who turns down the offer must sign the exact declination statement in Appendix A of the standard. Don't paraphrase it. The language ("I understand that due to my occupational exposure… I may be at risk…") is prescribed, and a reworded form is a finding waiting to happen. The same employee can change their mind and request the vaccine later, still at no cost.

Getting the hepatitis B offer, documentation, and declination process right matters in dollars, not just principle. After January 15, 2026, OSHA's maximum civil penalties run to $16,550 per serious violation and up to $165,514 for a willful or repeated one, plus $16,550 per day for failure to abate (OSHA penalties). A drawer of missing declination forms is not an abstract risk.

Layer 2: CDC / ACIP — the national recommendations

The CDC's Advisory Committee on Immunization Practices (ACIP) publishes what a complete HCP immunization program should look like. This is guidance, not law — ACIP recommends, facilities adopt. The core set for healthcare personnel is hepatitis B, annual influenza, MMR, varicella, and Tdap, with meningococcal added only in specific situations (CDC MMWR RR6007).

Here is what "up to date" means for each, and where the details trip people up:

• Hepatitis B — the same series OSHA requires you to offer, documented with post-vaccination serology where indicated.
• Influenza — one dose every season, every year. This is the workhorse of most HCP programs.
• MMR — for personnel born in 1957 or later, one or two doses depending on the indication (CDC adult schedule notes). One change to flag for anyone still working off old checklists: for healthcare personnel, a history of measles or mumps disease is no longer accepted as presumptive evidence of immunity. You need documented vaccination or laboratory confirmation (CDC MMWR RR6007).
• Varicella — two doses for personnel born in 1980 or later without other evidence of immunity (CDC adult schedule notes).
• Tdap — one dose regardless of when the last Td was given, then a Td or Tdap booster every 10 years (CDC adult schedule notes).
• Meningococcal — situational, not a blanket HCP recommendation. It's generally limited to microbiologists routinely exposed to N. meningitidis, or personnel with personal risk factors like asplenia (CDC MMWR RR6007). If you're checking meningococcal status on every med-surg nurse, you're doing more than ACIP asks.

Recommendations and reality don't match, and that gap is the whole reason employee health programs exist. For the 2024–25 respiratory virus season, ACIP recommended both influenza and COVID-19 vaccination for all healthcare personnel (CDC MMWR). Actual coverage that season, from a CDC survey conducted March–April 2025, came in at 76.3% for influenza and 40.2% for COVID-19 (CDC MMWR). A national recommendation moved roughly three in four workers on flu and fewer than half on COVID. Policy, tracking, and follow-up are what close that distance.

One caution on COVID specifically: ACIP's composition and its COVID-19 recommendations have been in flux through 2025–2026. Date any COVID-19 policy you write and re-verify it against current ACIP guidance rather than treating last season's statement as permanent.

Layer 3: CMS and state law — where the mandates actually live

This is the layer that trips up the most people right now, so let's be blunt about it.

The CMS COVID-19 staff vaccination mandate is gone. CMS withdrew its Omnibus COVID-19 Health Care Staff Vaccination requirement in a final rule published in the Federal Register on June 5, 2023 (Federal Register 2023-11449). CMS has confirmed the requirement is expired and no longer applicable, with surveyors no longer assessing compliance following the end of the public health emergency on May 11, 2023 (CMS guidance). If your policy binder, your onboarding packet, or a compliance article you're reading still describes an active CMS COVID vaccine mandate for staff, it is out of date. Fix it.

With the federal COVID mandate withdrawn, the enforceable requirements beyond OSHA's hepatitis B offer now come from state law and your own employer policy — and state law is genuinely a patchwork. Many states require hospitals, long-term care, or ambulatory facilities to offer or ensure influenza vaccination; some go further and require unvaccinated personnel to mask during flu season. New York's mask-in-lieu rule for unvaccinated HCP is the best-known example, and like most state schemes it comes with medical and religious exemptions (CDC Public Health Law Program).

The practical consequences run in two directions. First, "mandatory" is a state-and-employer question, not a federal one — the same nurse can face a hard flu requirement in one state and a mask-or-vaccinate option across the border, which means your hospital vaccination policy has to be written to the state you actually operate in, not to a national template. Second, these laws change often. Don't hardcode a state-by-state list into a policy and forget it. Use the CDC Public Health Law Program's vaccination-law menus as a starting map, then confirm current text with your state health department and your counsel before you write anything binding.

The recordkeeping backbone

If you take one operational thing from this guide, make it this: the compliance case is won or lost on records, and hepatitis B is where OSHA sets the bar highest.

Under the Bloodborne Pathogens Standard, each employee's hepatitis B vaccination status and vaccination dates are a medical record. The standard's own retention clause, 1910.1030(h)(1)(iv), folds in the general medical-records rule of 29 CFR 1910.1020 — which requires keeping the record for the duration of employment plus 30 years. That is not a typo. An employee who leaves after two years still generates a record you hold for three decades after they walk out the door (a 2028 hire who leaves in 2030 stays on file until roughly 2060 — an illustration, not a rule you'll find printed anywhere). Paper folders in a filing cabinet do not survive that timeline gracefully.

Three documents form the hepatitis B core:

1. Vaccination status and dates — each dose, or the reason the series wasn't completed.
2. The signed Appendix A declination for anyone who turned the offer down.
3. The evaluating healthcare professional's written opinion, which you must obtain and provide a copy of to the employee within 15 days of completing the evaluation (29 CFR 1910.1030).

Beyond hepatitis B, keep dated records of every ACIP-recommended vaccine and every acceptable immunity document — the MMR serology, the varicella titer, the Tdap date — because presumptive-immunity shortcuts (like a self-reported history of measles) no longer count for HCP. When a state requires influenza vaccination or masking, you'll also need to show, per season, who was vaccinated, who was exempted and why, and who was masked instead.

This is the layer where a purpose-built system earns its keep. An employee health platform like carefoundryESC tracks doses, series completion, declination status, and expiring immunity in one place — which matters when the retention clock runs 30 years past termination and a surveyor wants the whole cohort on a Tuesday afternoon. But the obligation exists whether you track it in software, a spreadsheet, or paper; "we vaccinated them, we just can't find the form" has never been a defense.

Putting it into a policy

A defensible employee immunization program does four things, in this order:

• Offer hepatitis B correctly to every employee with occupational exposure — within 10 working days, free, with the verbatim declination on file and the written opinion delivered in 15 days.
• Adopt the ACIP set (hep B, annual flu, MMR, varicella, Tdap; meningococcal only where indicated) as facility policy, with clear acceptable-evidence standards and documented immunity where required.
• Check your state's actual requirements for flu and any masking rule, build in medical and religious exemptions, and re-verify annually because these change.
• Keep the records to the OSHA standard — employment plus 30 years for hepatitis B — and make them retrievable, not just retained.

FAQ

Are healthcare worker vaccines mandatory? Only one is federally required to be offered: hepatitis B, under OSHA's Bloodborne Pathogens Standard, for employees with occupational blood exposure (29 CFR 1910.1030) — and employees may decline it in writing. Everything else depends on state law and your employer policy. The former federal CMS COVID-19 staff vaccine mandate was withdrawn in June 2023 and is not in effect (Federal Register).

Which vaccines does the CDC recommend for healthcare personnel? Hepatitis B, annual influenza, MMR, varicella, and Tdap, plus meningococcal for those with routine lab exposure to N. meningitidis or personal risk (CDC MMWR RR6007). These are recommendations; facilities adopt them into policy.

How long must we keep hepatitis B vaccination records? For the duration of employment plus 30 years. The retention duration comes from 29 CFR 1910.1020, which 1910.1030 incorporates for hepatitis B records — along with signed declinations and the healthcare professional's written opinion.

How do CDC and state requirements differ? CDC/ACIP provides a uniform national recommendation with no enforcement of its own. State law is the enforceable, variable layer — some states require offering or ensuring flu vaccination, some require masking unvaccinated staff, and exemption rules differ. Confirm current requirements with your state health department (CDC Public Health Law Program).

The three layers aren't going to collapse into one neat mandate anytime soon, so the working skill is keeping them straight and keeping the paperwork airtight. If your immunization tracking currently lives across spreadsheets, EHR fields, and a filing cabinet that has to outlast the employee by three decades, run one test: could you produce the complete hepatitis B record — dates, declination, written opinion — for any past hire, on demand? The answer tells you whether your program is compliant or just hopeful.