This needs to be changed either businesses can get all private health information or they can get none.
Our private information is not a candy in the candy shop so anybody can pick whatever he likes at the moment and "consume" it.
In Europe GDPR prevents private businesses to seek and gather any private health information from employees because there are many faces of discrimination not only vaccine one.