Employer are allowed to do a great many things, but what you have described is on the questionable side of what is and is not legal. As a flu shot is a medical procedure, there is an argument that HIPAA medical privacy rights apply. However contrary to popular belief there are very limited personal enforcement rights under HIPAA. So, I recommend that you and other staff so affected meet with relevant management staff to work out how this situation should be addressed. First, the sign should come down. Second, if there is an issue of having management staff know who should or should not be wearing a mask, then there are less public ways of making that information known to those staff who need to have such information.
You and other staff should consult with a labor law attorney in your community about this as soon as possible.
This is not a substitute for a consultation with an attorney in your community with a background in health employee law.
This is a very common practice in large-scale medical facilities. My view is that a roster of who has yet to submit proof of shot (and is not yet excused from masking) is not unlawful, not a disclosure of any personal medical info, and fulfills a necessary business and patient-care related purpose. There are arguments to the contrary, of course, but someone has to make the call and determine the better position.
Where facility employees are unionized, the union will usually make the objection and determine whether there is merit to pressing the issue.
My responses to questions on Avvo are never intended as legal advice and must not be relied upon as legal advice. I give legal advice only in the course of an attorney-client relationship. Exchange of information through Avvo's Questions forum does not establish an attorney-client relationship with me. That relationship is established only by individual consultation and execution of a written agreement for legal services.