Hint: You just destroyed, permanently, any claim to your personal medical privacy.
Some states have laws about "private facts" and the USSC has repeatedly found that such a right exists with regards to one's medical status (e.g. Roe) but to be a private fact it must be reasonably treated as private by you.
Note that for a private fact to exist it must be private. There is an exception in the law for things that are newsworthy and of legitimate public concern but absent that medical status is one of the areas where this law is routinely upheld.
If you make known to others without a legal duty of confidentiality that you are HIV+, for example, you cannot sue if someone discloses that because it's not private anymore. Once you willingly make something public by your own actions it is not possible to return that item of information to the status of a private fact.
There are things that we remove from the status of "private facts" willingly and by our own hand. Our true identity, for one. You flash a driver license to prove you're 21 at a bar, for example. Said bar has zero duty of confidentiality to you. There are all manner of places where such is requested and we willingly comply. By doing so we waive the private fact nature of that information since we willingly and intentionally display it in public.
If you go to a professional conference, for example, and flash a vax card or a digital app QR code at the door to "attest" that you had a Covid-19 vaccination you have released that information to people who have no duty in law or by contract to keep that information private. Said app developer and owner has no legal stricture requiring said privacy either. Further, by definition your mere presence in such a place, if such a pass is required for entry, voluntarily discloses your medical status to thousands of others!
Again: Your mere presence in a business -- any business -- that requires such at the door waives your private fact protection.
I remind you that anyone can photograph you from or in a public place. Never mind that damn near everywhere such is happening all the time in public anyway; there's a camera behind the bar in the restaurant, three more in the dining area, etc. If you're walking down the street these days your next door neighbor probably has a camera on their doorbell and you were in a public place, namely, the street.
The minute you consent to a requirement for your medical status in some regard to be in a place open to the public you have, by definition and your own hand, destroyed any claim now or in the future that such is a private fact.
Thus you have now consented to your employer requiring you to document same since you already have made your Covid vaccination status available to the public on an unrestricted basis. If and when something related to that (e.g. whether you have taken the sixth booster two years from now) is required of you you have already consented to that disclosure and discrimination because you, by your own hand, voluntarily gave up all right of privacy in that regard and consented to be discriminated against.
Note that prior to Covid-19 there was exactly zero such attempt made. Oh, people say, but the schools required vaccinations for kids. Ah, but said entities were government agencies and had strict protocols for medical privacy. Further, there were plenty of kids who didn't have all those shots in the school -- but nobody knew who they were. If you had an exemption on whatever basis that was nobody else's business and exactly nobody had access to those records. Finally, I attended college briefly in the 1980s (and took some classes while in High School too at a different college) and was never asked for a single bit of medical documentation before or while doing so. All they were interested in was money.
Never mind that exactly zero parents were ever required to show anything about themselves to come through said door and pick up or drop off their kid, nor go to a parent-teacher conference, attend a basketball game or similar. The entire time from the mid 1990s forward I was on school campuses every now and then for various purposes as my daughter was attending there. Never once was I asked for a single piece of medical information.
Nor have I ever been so much as requested to document what I might have had (or been vaccinated against) to report for work anywhere, and I've been doing various jobs for more than forty years.
You didn't think about any of this, did you?
Well then you were really ****ing stupid to flash that card or show a QR code that instead of forcing said restaurant, conference, show or EMPLOYER to shove their demands up their ass -- and go out of business.
These abuses only stop when you make them stop by whatever means are necessary. The time to do that was when they were first proposed and if you don't do it now the very first time you present such a "credential" you have given consent and thus you cannot have your privacy rights violated as you willingly gave that information up to the public at-large.