Under AB 144, you must cover all COVID‑19 preventive services—vaccines, boosters, tests, and treatment—without cost‑sharing or limits. Med‑Cal employers must add these vaccines to benefit designs, giving zero copays per AB 144. Coverage must align with USPSTF and ACIP recommendations. In addition, you’ll need to comply with ABA and CDPH guidance, and keep records until February 3 2026. Neglecting these rules exposes you to penalties and frontline harm; further steps, if you pursue, enhance your compliance and employee safety.

Key Takeaways

• AB 144 requires health plans to cover COVID‑19 preventive services, including latest vaccines, with zero copays and no utilization limits effective Jan 1 2025, per USPSTF/ACIP.
• Med‑Cal employers must add COVID vaccines to benefit designs, enforcing zero cost‑sharing under AB 144 and align with ABA and CDPH guidance.
• Employers must keep COVID‑coverage documentation until Feb 3 2026 per Title 8 §3205(j); integrate updates into the IIPP and distribute via HR/IT channels.
• Respirator and testing protocols must comply with Title 8, CDC guidelines, and OSHA ADA standards, requiring fit‑testing, training, and disciplined isolation criteria.
• Maintain separate, encrypted vaccination records under FEHA and ADA confidentiality rules, limit access to authorized personnel, and audit compliance annually.

California COVID‑Coverage Mandates After February 2025

Although the COVID‑19 Prevention Non‑Emergency Standards expired on February 3, 2025, California employers still face a clear set of ongoing duties. Your benefit design must anticipate coverage mandates that now extend beyond the pandemic to include immunization, testing, and post‑exposure protocols. Under Assembly Bill 144, every health plan you contract with you is required to cover preventive care services—including COVID‑19 shots—without cost‑sharing or utilization limits. These coverage mandates apply to recommendations from the U.S. Preventive Services Task Force and the Advisory Committee on Immunization Practices, as defined by law starting January 1, 2025, and are further reinforced by California Department of Public Health guidance. Your plan must also cover the latest COVID‑19 vaccine formulations without copays for most participants, safeguarding diverse workforce health while keeping costs predictable. Medi‑Cal employers receive specific directives that they must include COVID‑19 vaccines in their benefit design, ensuring that low‑income and disabled personnel are protected under state mandates. Under AB 144, all health plans must cover COVID‑19 vaccination with zero cost‑sharing.

Update Your IIPP for Post‑Sunset COVID Hazard Controls

Because the COVID‑19 Prevention Non‑Emergency Standards have expired, you’ll need to weave COVID‑19 identification and mitigation into your existing IIPP so that it aligns with Title 8 Sections 1509 and 3203 and meets Cal/OSHA’s ongoing record‑keeping mandates through February 3, 2026.

You must embed a hazard assessment cadence, use risk analytics to map exposure trends, and update corrective strategies as operations shift.

Your policy audit should confirm that records capture incidents, trend data, and worker communications, ensuring that the IIPP stays defensible and inclusive.

All COVID‑19 case records must be retained until until Feb 3 2026 to satisfy Title 8 §3205(j).

1. Identify COVID‑19 as a workplace hazard whenever conditions demand a review.
2. Deploy risk analytics to quantify exposure intensity and prioritize control tiers.
3. Perform a policy audit to confirm that the documentation, corrective actions, and employee access meet Title 8 accountability standards.

Drafting a COVID‑Friendly IIPP: Step‑by‑Step Guide

When you begin updating your IIPP, you’ll weave COVID‑19 controls into every existing safety process. Start by assigning a dedicated authority—either the plant manager or the owner—who will lead the draft and oversee collaboration across departments. Next, conduct hazard mapping that identifies airborne, surface, and contact risks specific to your layouts. Build a communication strategy that delivers clear, accessible instructions to all staff, including contractors, via posters, digital alerts, and briefings. The virus remains infectious even when people feel fine, due to asymptomatic infectiousness, underscoring the need for thorough preventive controls. The table below shows a concise action framework:

Finally, embed training deliverables, enforce compliance, and monitor performance with annual appraisals to meet Cal/OSHA requirements. Keep records of revisions communicate updates to workers compliance.

Testing & Return‑to‑Work Protocols for Positive Employees

Building on the IIPP revisions you’ve already drafted, you must now articulate clear testing and return‑to‑work protocols for employees who test positive. Start by integrating CDC‑aligned isolation protocols that protect the workforce, and update your quarantine rules with the latest local guidance. Next, establish a tri‑phase testing schedule: initial screening, repeat testing, and a final negative confirmation before re‑entry. This layered approach keeps exposure low and reinforces employee confidence. In immunocompromised staff, return clearance requires two consecutive negative NAATs, spaced 48 hours apart.

1. Conduct an at‑work antigen test on day 1 of symptom onset, then a repeat test on day 5; if negative, allow masked work until day 10.
2. For asymptomatic positives, require a negative viral test on day 7; if documented, return on day 8, otherwise extend isolation until day 10.
3. During outbreaks, enforce weekly testing for exposed staff and exclude untested individuals until they clear isolation, ensuring compliance with OSHA and ADA standards.

You’ll maintain safety, transparency, and compliance while fostering overall trust.

Maintaining Accurate COVID Case Records Until February 2026

According to California OSHA’s Subsection 3205(j), you must document every COVID‑19 case through February 3, 2026. You should capture name, role, location, last workplace day, and test or diagnosis date. Your retention policy keeps each record for two years from its creation. That means a January 2026 case stays active until January 2028. Keep sensitive data encrypted—Record Encryption protects privacy while you satisfy legal notice requirements. When a record reaches its two‑year lifespan, you perform Data Deletion to comply with both OSHA and privacy laws. Even after Feb 3, 2026, you should monitor rulemaking and keep your Injury and Illness Prevention Program ready. Providing timely data to CDPH, NIOSH, and local health departments remains essential. The new 2026 policy, known as the OSHA Enforcement Policy, allows employers to reduce COVID‑19 log requirements without penalty. This disciplined approach guarantees compliance, protects employees, and supports a resilient workplace.

Below, a concise retention snapshot clarifies action steps.

Require Vaccinations Under FEHA While Protecting Confidentiality

Because FEHA lets you mandate FDA‑approved COVID‑19 vaccines, you can require employees to provide proof—but you must treat those records as confidential medical information under ADA and CMIA, keeping them separate from personnel files and limiting access to only staff.

Draft a vaccination policy that aligns with FEHA’s non‑discrimination and role‑specific mandates.

Inquire only for proof, not for unrelated medical conditions.

Collect CDC or state vaccination cards to limit extraneous data.

Verification should focus solely on name, vaccine type, dates to keep records concise.

Store the cards in a lock‑topped drawer or encrypted digital folder separate from HR folders.

Schedule periodic audits to verify that access stays restricted to authorized safety or HR personnel.

Use data redaction techniques to strip vaccination fields before sharing metrics with regulators.

Keep record lineage documented for audit.

1. Maintain a secure, separate storage server for immunization records.
2. Restrict data access to safety and compliance teams only.
3. Document and audit any data redaction done on shared reports.

Review policies yearly and adjust as rules change.

Build a Non‑Retaliatory Face‑Covering & Respirator Policy

By proactively aligning with OSHA, state mandates, and workers’ rights, you can build a transparent, non‑retaliatory face‑covering and respirator policy that protects everyone in your workplace. The General Duty Clause obligates you to keep the workplace free from hazards like COVID‑19, so you must decide whether cloth coverings suffice or respirators are required based on exposure. Cloth masks are source control; they’re non‑PPE, but respirators need NIOSH approval, fit testing, and training under 29 CFR 1910.134. Under OSHA’s 1910.134, employers must conduct a written hazard assessment before mandating respirator use. When you mandate respirators—whether for actual hazards or a COVID policy—provide no‑cost equipment, complete fit testing, and medical evaluations by licensed professionals. Employees may bring personal cloth coverings that meet criteria, but they cannot use respirators unless you run a full respiratory protection program. Your written program should segment roles by risk, list required gear, outline fit‑test schedules, and include training that champions Employee advocacy while enforcing Zero retaliation and protect full compliance.

Frequently Asked Questions

What if a Non‑Consenting Employee Refuses Vaccination for Non‑Religious Reasons?

If a non‑consenting employee refuses vaccination for non‑religious reasons, you’ll enforce your policy without an interactive process. First, educate the employee about the health risks and workplace standards. Then you’ll offer alternative accommodations—like periodic testing or remote work—if that meets safety goals. If accommodations fail, you’ll enforce the mandate, and, if necessary, proceed with termination while documenting all steps. Remember to consult legal counsel and maintain equitable treatment for staff.

How to Handle Contractor’s COVID Policy Versus Company Policy?

You’re in a position to pursue Contractor Harmonization and Policy Synchronization, aligning your company policy with contractor mandates. First, map overlapping requirements and disagreements, then engage in joint workshops to draft a unified protocol. Prioritize transparency, provide communication channels, and embed flexibility for remote staff. Finally, enforce compliance through shared metrics and regular audits, ensuring every employee, regardless of subcontractor status, upholds consistent safety standards and reinforce ongoing reviews periodically.

Are Telecommuters Still Subject to Workplace COVID Reporting?

Like a single thread woven through a digital tapestry, you’ll keep every workplace COVID thread visible. Yes—telecommuters stay in the reporting net if their exposure ties back to work. When a remote worker needs treatment or takes time off, you’ll log them on OSHA Forms 300, 300A, and 301. Balance data privacy with remote compliance, preserving confidentiality while staying strategically aligned with inclusive workplace policies for all staff members today.

How Long After an Outbreak Must I Refine an IIPP Risk Assessment?

After an outbreak, you must refine your IIPP risk assessment promptly—ideally within 48 hours of completing the outbreak review. This refinement timing guarantees you address new hazards, update controls, and stay compliant. By setting clear deadlines, you demonstrate proactive policy, honor an inclusive safety culture, and align with state and federal standards. Document the update, communicate changes, and schedule follow‑up reviews to sustain ongoing protection for all employees, supervisors, and contractors.

Can a Company Bill Employees for COVID Testing Expenses?

Yes, you can bill employees for COVID‑test expenses, but if your Billing Guidelines are clear and you’ve secured Employee Consent. Keep your policy listing all eligible tests, payment limits, and documentation. Create a concise consent form that explains why the test is job‑required, how the cost will be covered, and the employee’s rights to dispute or request reimbursement. Update guidelines to reflect evolving federal and state and health and laws.

Conclusion

By weaving thoughtful COVID‑coverage strands into your IIPP, you knit a resilient safety tapestry that thrives even after the pandemic’s sunset. You’re championing inclusive protections, balancing FEHA vaccination demands with confidentiality, and you calibrate testing and return‑to‑work protocols to be both precise and humane. As you craft a non‑retaliatory face‑covering policy, you turn ambiguity into clarity, turning each employee into a partner in shared, post‑COVID resilience. Across all teams, you anchor rules echoing trust, transparency.

James Bateson

Lawyer