Labor and Employment

Can Public Facing Businesses Deny Entry Based on Vaccination Status?

August 11, 2021

MAY I DENY A CUSTOMER OR CLIENT ENTRANCE TO MY BUSINESS?

YES BUT. Business owners concerned about customers or clients entering their place of business without proof of a COVID-19 vaccine should be mindful of their obligations under Title III of the Americans with Disabilities Act. Specifically, Title III prohibits discrimination on the basis of disability in the activities of places of public accommodations (businesses that are generally open to the public and that fall into one of 12 categories listed in the ADA, such as restaurants, movie theaters, schools, day care facilities, recreation facilities, and doctors’ offices) and requires newly constructed or altered places of public accommodation—as well as commercial facilities (privately owned, nonresidential facilities such as factories, warehouses, or office buildings)—to comply with the ADA Standards. 42 U.S. Code § 12182 et seq.

While Title III has general restrictions that businesses have to abide by when they choose to deny accommodations, a business may deny goods or services to individuals if their participation would result in a “direct threat” to the health and safety of others, but only when this threat cannot be eliminated through an alteration of policies, practices, procedures, or providing auxiliary aids and services. See 42 U.S.C.A. § 12182 (b)(3).

Unsurprisingly, there is no precedent applying the law of public accommodations to an individual’s inoculation status. And though no court has yet said that the “direct threat” provision of Title III will be an affirmative defense to public accommodation discrimination, the analogous “direct threat” provision of Title I of the ADA, concerning employment discrimination, has been held to be an affirmative defense. Chevron U.S.A. Inc. v. Echazabal, 536 U.S. 73, 78 (2002) (interpreting 42 U.S.C. § 12113(b)); see also Bragdon v. Abbott, 524 U.S. 624, 649 (1998) (§§ 12113(b) and 12132(b)(3), of Titles I and III, are “parallel provisions”). Still the Equal Employment Opportunity Commission, analyzing the analogous provisions under Title I, has said that under the ADA, a “direct threat requirement is a high standard.” See What You Should Know About COVID-19 and the ADA, the Rehabilitation Act, and Other EEO Laws, EEOC Guidance, available at https://www.eeoc.gov/es/node/131879.

WHAT IF A CUSTOMER REFERENCES HIPPA?

HIPAA does not prohibit businesses or employers from requestinghealth information, including information about vaccination status. Rather, HIPPA protects the disclosure of such by the provider.

Here is why:

HIPPA applies to the following:

  • Health plans

  • Health care clearinghouses

  • Health care providers who conduct certain financial and administrative transactions electronically. These electronic transactions are those for which standards have been adopted by the Secretary under HIPAA, such as electronic billing and fund transfers.

WHAT ARE MY OBLIGATIONS BEFORE DENYING A CUSTOMER OR CLIENT ENTRANCE TO MY BUSINESS?

Businesses would be wise to apply the same three step review of their policies and procedures that they would with their customers and clients under Title III, as they would with their employees under Title I.

First, businesses should make an individual assessment before turning away a customer or client. In determining whether a customer or client poses a direct threat to the health or safety of others, a business must make an individualized assessment, based on reasonable judgment, that relies on current medical knowledge or on the best available objective evidence, to ascertain:

STEP 1: The business must identify the specific risk posed by the individual.

Here, the inquiry is whether the unvaccinated customer or client will expose others to COVID-19.

STEP 2: Once the risk is determined, then the business must look at the four factors of whether the “direct threat” actually exists:

  1. Duration of the risk;

  2. Nature and severity of the potential harm;

  3. Likelihood that the potential harm will occur; and

  4. The imminence of the potential harm.

28 C.F.R. § 36.208(b). Businesses should consult with counsel when conducting this four-pronged assessment.

Second, businesses should balance these factors before turning away a customer or client. When balancing factors relevant to determine whether the risk to health or safety of others is significant, each factor does not need to be significant on its own; rather, the gravity of one factor might compensate for the relative slightness of another. See 42 U.S.C. § 12182(a), (b)(3); See also Montalvo v. Radcliffe, 167 F.3d 873, 878 (4th Cir. 1999).

Third, businesses should recognize that just as they do under Title I, they maintain a duty to try an accommodation first (before finding a direct threat). If the business determines that the customers and client would pose a significant risk to the health and safety of others, then it must determine “whether reasonable modifications of policies, practices, or procedures will mitigate the risk,” 28 C.F.R. § 36.208(c), to the point of “eliminat[ing]” it as a “significant risk.” 42 U.S.C. § 12182(b)(3).

Under the ADA, a failure to make a reasonable modification is itself an act of discrimination unless the business can demonstrate that implementing the modification would fundamentally alter the nature of their business. See 42 U.S.C. § 12182(b)(2)(A)(ii).

BOTTOM LINE:

  • Businesses can deny customers and clients entrance to their businesses if they are unvaccinated.

  • Businesses must make individualized assessment and balance those factors before denying unvaccinated customers and clients entrance to their business.

  • Businesses are required to try an accommodation if it would not alter the nature of their business before denying unvaccinated customers and clients entrance to their business.

Again, businesses should consult with counsel on issues relating to vaccination of customers and clients. This is a nuanced issue and additional guidance and rules are anticipated.

Related Services

  • Overview
  • People
  • Labor and Employment Law Blog
  • Publications & News
  • Events

Firm Highlights

  • Events
    The 2026 Economic, Tax, and Accounting Updates
    We are looking forward to the Mid-Atlantic CFO Roundtable's next event on November 13, 2026. This is a program with topics built for Finance Executives. We are extremely fortunate to have three excellent speakers: Dr. Daraius Irani, Vice President of Business and Public Engagement at Towson University; Mike Stankus, Tax Office Managing Principal at BDO; and Daniel Wahlberg, Managing Partner of Acclare Solutions. The economy is rapidly changing with various factors driving it. The November 3rd midterm elections may also have an impact. Our three expert presenters will discuss the ramifications of the election, and the current year updates to GAAP financial reporting and Federal and State income taxes. Please join us for what will surely be an informative and timely discussion. Meet Our Speakers: Daraius Irani, Ph.D. • Towson University Vice President, Business & Public Engagement Dr. Daraius Irani serves as Vice President of Business and Public Engagement at Towson University as well as the chief economist for the Regional Economic Studies Institute (RESI) at Towson University, a policy group providing economic, fiscal impact, and policy analysis to public and private entities.  Dr. Irani is often called upon to provide economic presentations to organizations across Maryland. He has appeared on numerous television programs and in local and regional print media. Dr. Irani holds a Ph.D. in economics from University of California, Santa Barbara. Dan Wahlberg • Acclare Solutions Managing Partner With over 28 years of experience, Dan Wahlberg is a recognized leader in audit and assurance for the Mid-Atlantic’s middle market business community. As a licensed CPA in Maryland and Virginia, Dan has led assurance practices at top regional firms, including serving as Baltimore Audit Managing Partner and Assurance Practice Leader at BDO USA in Baltimore and as Partner and member of the Management Committee at Hertzbach & Company P.A which merged into BDO in 2020. His expertise centers on delivering clarity, strategic guidance, and proactive solutions to middle-market businesses across Baltimore and beyond. His entrepreneurial spirit has led him to begin a new CPA firm this year with four other CPAs serving the business community. Dan holds a Bachelor of Science in Accounting from Rutgers University and began his career at PWC in New York. He is also deeply engaged in the community, previously serving as President of ACG Maryland and current Board member and as Audit Committee Member for The Associated: Jewish Federation of Baltimore.  Mike Stankus • BDO USA LLP Tax Office Managing Principal Mike Stankus is the Tax Office Managing Principal for the firm’s Baltimore office. He has more than 16 years of experience providing tax planning and preparation and management advisory services for his clients. Mike focuses on advising privately held businesses and their owners on effective growth and tax strategies. He also performs various engagements for mergers and acquisitions and complex cost accounting projects and projections. In addition, he represents various government contracting clients before the DCAA and assists with FAR compliance. Mike’s areas of concentration include working with government contractors, professional service firms, construction companies, and homebuilders.
  • Events
    AIA Tri-State Conference
    Princeton will serve as the backdrop for three days of connection, learning, and design leadership. From keynotes to tours to the Tri-State Design Awards, this year’s conference is designed to go far beyond education sessions. Kick off the week with pre-conference intensives and individual state component Design Award celebrations, followed by three days of education, inspiration, networking, and design excellence at the 2026 AIA Tri-State Conference—featuring pre-conference intensives, three keynote speakers, 25 education sessions, curated tours, an expo, spec academies, and the AIA Tri-State Design Awards—bringing together architects and design professionals from New Jersey, New York, and Pennsylvania to connect, learn, and celebrate the best of the profession. G2. Designing Secure Practices: Cybersecurity, Data Privacy, Contractual Provisions, and Insurance Risks for Architects (4:00 PM - 5:30 PM) Architects and design professionals increasingly rely on cloud platforms, BIM software, and digital tools to manage sensitive data, creating cybersecurity and privacy risks. A single incident can trigger liability claims, regulatory obligations, reputational harm, and insurance challenges. Yet many firms underestimate how contracts, insurance, and internal practices intersect during a breach. This program offers legal and insurance perspectives on cyber risk in architecture, examining liability exposure, risky contract provisions, and mitigation strategies. A cyber insurance expert will explain policy responses, coverage gaps, coordination with professional liability, and best practices for aligning insurance with contractual risk and protecting firms from evolving cyber threats. Learning Objectives: Identify key cybersecurity and data privacy risks faced by architecture firms and explain how these risks can impact professional liability and project outcomes. Analyze common contractual provisions to determine which clauses may increase exposure to cyber incidents and propose strategies to mitigate these risks. Evaluate the scope and limitations of cyber insurance policies, including coordination with professional liability coverage, to determine how a policy would respond in a breach scenario. Develop actionable risk management strategies by integrating legal, contractual, and insurance considerations to protect sensitive client and project data.