Do we have a duty to disclose that some of our staff are not vaccinated?
You are legally not authorized to disclose individual employee's medical information. This means that if a patient asks you whether individual employees are vaccinated you cannot answer that question. However, as HIPAA prevents health-care providers from sharing protected health information, but not patients from sharing their own information, same here for employees - they can disclose directly if they wish to do so.
My recommendation on a going forward basis to answer whether or not employees are vaccinated is to point to your policies and procedures, which you should have on file regarding the practice's approach to vaccination. if you haven't settled on an approach yet, we can discuss based on your size and staffing model.
Hope this helps.