That is an excellent question.The answer is probably yes if:
1. The client has and can document that it has a compelling safety need, based on a specific COVID hazard assessment at that particular site. You should ask the client about this and get its reason for requiring disclosure.
2. The records contain only the personal health information needed to verify status, i.e., the fact that the person has been or hasn’t been vaccinated. Try to avoid listing names or identifying info, if possible. And by no means include any more medical details.
3. Employees are aware of and consent to the disclosure. They might have provided their vaxx info believing and subject to the condition that you wouldn’t disclose it to third parties.
4. Make accommodations for employees who can’t get vaccinated due to disabilities, documented and sincere religious beliefs or other grounds protected from discrimination by human rights laws.
Finally, note there was a case from Quebec involving a situation somewhat similar to yours. It involved a company that provides housekeeping services on a contract basis. When clients banned contractor workers from entering their buildings without proof of vaccination, the company imposed a mandatory vaccination policy on its own employees. The companies and unions asked the court for a declaration of whether the vaccination verification policies were legal. While conceding that the policies infringed on Charter privacy rights, the Québec court concluded that the policies were valid given the current COVID public health order [Union des employés et employés de service, Local 800 c Services ménagers Roy ltée., 2021 CanLII 114756 (QC SAT), November 15, 2021].
Caveat: The case isn’t exactly the same but involves similar principles. I suggest you give it a look. Hope this helps. Glenn
