At the direction of the Biden administration, the Centers for Medicare & Medicaid Services (CMS) issued an interim final rule (CMS Rule) on November 5, 2021, requiring COVID-19 vaccinations for workers in most health care settings, including hospitals and health systems, that are certified to participate in the Medicare and Medicaid programs. The CMS Rule took effect on November 5 and provides that all covered workers must receive their first vaccine dose by December 6, 2021, and be fully vaccinated by January 4, 2022. CMS also provided answers to certain frequently asked questions (CMS Q&A), which can be found here.

The CMS Rule is one of three federal vaccine mandates. The Occupational Safety and Health Administration’s emergency temporary standard (ETS), which was also published on November 5, requires all employees at private businesses with 100 or more workers to be vaccinated by January 4 or get tested weekly for COVID-19. Our alert on the OSHA ETS can be found here. The Executive Order on Ensuring Adequate COVID Safety Protocols for Federal Contractors, which was issued on September 9, 2021, requires federal contractors and subcontractors to comply with the guidance of the Safer Federal Workforce Task Force by way of a contract clause. Our alerts on the federal contractor rule can be found here. In addition to preempting state and local law, CMS asserts that its rule takes priority over other federal vaccination requirements, so health care entities that are covered by the CMS Rule generally are not subject to the OSHA ETS or the federal contractor vaccine mandate.

Covered Facilities

Only “facilities” that are certified Medicare and Medicaid providers and suppliers are covered by the CMS Rule, which means they are already subject to the Medicare health and safety standards known as Conditions of Participation (CoPs), Conditions for Coverage (CfCs), or Requirements. The CMS Rule specifically applies to the following Medicare- and Medicaid-certified provider and supplier types:

The CMS Rule does not apply directly to physician practice groups and other providers that are not regulated by Medicare, but the rules may apply to such providers if they practice at covered facilities.

Facilities NOT Covered

The CMS Rule does not apply to religious nonmedical health care institutions, organ procurement organizations, or portable x-ray suppliers. However, the staff of these types of entities may be covered staff through the entities’ service arrangements with covered facilities. The CMS Rule does not apply to home- and community-based services because providers of these services are not subject to the CMS health and safety regulations. Additionally, CMS does not have regulatory authority over assisted living facilities or group homes.

Covered Staff

The CMS Rule applies to all staff working at a facility that participates in the Medicare and Medicaid programs, regardless of clinical responsibility or patient contact. This includes all staff who provide any care, treatment, or other services for the facility and/or its patients, such as employees, licensed practitioners, students, trainees, volunteers, and individuals who provide care, treatment, or other services for the facility and/or its patients under contract or other arrangements. A nonemployee physician with admitting privileges for a hospital will also be subject to the CMS Rule.

Individuals who provide services remotely and who do not have any direct contact with patients and other staff, such as fully remote telehealth or payroll services, do not have to be vaccinated.

Vaccination Requirement The CMS Rule requires covered facilities to implement policies and procedures to ensure that staff who are not granted an exemption are fully vaccinated in two phases:

• Phase 1: By December 6, 2021, covered staff must have received their first dose of a two-shot series or a single dose of a one-shot vaccine. Covered staff must complete this step before they can provide any care, treatment, or other services for the facility and/or its patients on or after December 6.
• Phase 2: By January 4, 2022, covered staff must have received the second shot of a two-shot series.

Although CMS defines “fully vaccinated” to mean two weeks or more after an individual completes a primary vaccination series for COVID-19, staff who complete their primary vaccination series by the Phase 2 date will be considered fully vaccinated even if they have yet to complete the two-week waiting period. In addition to the three vaccines currently approved in the U.S. (Pfizer, Moderna, and Johnson & Johnson), staff who received other COVID-19 vaccines listed by the World Health Organization for emergency use will also be deemed fully vaccinated. The vaccination requirement applies only to the primary series and does not include booster shots, but covered facilities must have a process to track and document boosters recommended by the CDC in addition to tracking and documenting primary doses.

Exemptions

The CMS Rule recognizes that exemptions may be provided to staff with medical conditions or disabilities for which vaccines are contraindicated, as provided by the Americans with Disabilities Act, or to staff with sincerely held religious beliefs, as provided by Title VII of the Civil Rights Act of 1964. In addition, vaccines may be temporarily delayed due to clinical precautions and considerations. The CMS Rule requires facilities to develop additional processes for unvaccinated staff to mitigate the spread and transmission of COVID-19.

Preemption and Primacy

According to the CMS Q&A, in a situation where a state law, regulation, or executive order prohibits the implementation of a vaccine mandate, the CMS Rule preempts any authority that is contrary to the federal requirement. The CMS Rule also takes primacy over the OSHA ETS and the Executive Order on Ensuring Adequate COVID Safety Protocols for Federal Contractors. CMS recognizes in the Q&A that there will be “rare situations” where unvaccinated staff of covered facilities may also be subject to the OSHA ETS or the Federal Contractor Executive Order, but it does not explain what those situations are.

Enforcement

The CMS Q&A indicates that state survey agencies will assess facilities for compliance with the CMS Rule during annual recertification surveys and complaint surveys. If a facility is deemed to be noncompliant with the CMS Rule, CMS has a number of enforcement tools at its disposal. For home health agencies, nursing homes, and hospice, CMS can enforce civil monetary penalties, deny payments, and, as a last resort, terminate providers from the Medicare and Medicaid program. For hospitals, health systems, and certain other acute and continuing care providers, noncompliance with the CMS Rule can also lead to termination; however, CMS has expressed its intent to work with noncompliant health care facilities to bring them into compliance.

What Should Health Care Entities Do Now?

First, health care entities that are certified to participate in the Medicare and Medicaid program must first determine whether they are covered facilities subject to the CMS Rule. Second, if covered, they must develop policies to comply with CMS’s vaccine mandate, with only limited time available to comply with the December 6 Phase 1 deadline for covered staff. As part of this process, facilities must take measures to determine and record current vaccination levels among staff and notify unvaccinated staff of the December 6 deadline. Finally, health care entities that have 100 or more employees and do not participate in the Medicare and Medicaid programs or qualify as facilities under the CMS Rule are still covered by the OSHA ETS and should be mindful of its requirements. Other entities may be subject to the federal contractor or state or local vaccine requirements.

[View source.]