Correct. Just as long as you can show your policy is a necessary safety measure for YOUR workplace, based on a hazard assessment and that you ask for no more medical info than you need to verify vaccination status. There’s a pretty good piece in HRI on verifying vaccination status.