On November 4, 2021, the Centers for Medicare and Medicaid Services (CMS) released an Interim Final Rule (the “CMS Rule”) that requires certain Medicare- and Medicaid-certified providers and suppliers to ensure that their staff members are fully vaccinated for COVID-19. The CMS Rule was effective on November 5, 2021, and CMS states in commentary that the rule in intended to preempt inconsistent state and local laws as applied to these providers and suppliers. Although an “interim final rule,” the CMS Rule is final as it stands now and in effect. CMS is accepting public comments until January 4, 2021, and may after that time amend or replace the rule.

I. To which providers and suppliers does the CMS Rule apply?

The CMS Rule specifically regulates the following providers and suppliers:

• Ambulatory Surgical Centers (ASCs);
• Hospices;
• Psychiatric Residential Treatment Facilities (PRTFs);
• Programs of All-Inclusive Care for the Elderly (PACE);
• Hospitals (acute care hospitals, psychiatric hospitals, hospital swing beds, long term care hospitals, children’s hospitals, transplant centers, cancer hospitals, and rehabilitation hospitals/inpatient rehabilitation facilities);
• Long Term Care (LTC) Facilities, including Skilled Nursing Facilities (SNFs) and Nursing Facilities (NFs);
• Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICFs-IID);
• Home Health Agencies (HHAs);
• Comprehensive Outpatient Rehabilitation Facilities (CORFs);
• Critical Access Hospitals (CAHs);
• Clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services;
• Community Mental Health Centers (CMHCs);
• Home Infusion Therapy (HIT) suppliers;
• Rural Health Clinics (RHCs)/Federally Qualified Health Centers (FQHCs); and
• End-Stage Renal Disease (ESRD) Facilities (each a “Covered Provider”).

The CMS Rule only applies to the Covered Providers listed above. It does not directly apply to other healthcare entities, such as physician offices, that are not regulated by CMS. However, physicians on staff at hospitals or other Covered Providers will be required to comply. The CMS Rule also does not apply to assisted living facilities or group homes because they are not subject to CMS health and safety regulations. In addition, the CMS Rule does not apply to independent DMEPOS suppliers, free-standing sleep lab providers, portable x-ray suppliers, independent laboratories, pharmacies, and physical therapists/occupational therapists in private practice that are not in a CMS-regulated clinic or rehabilitation agency.

II. Who must be vaccinated?

Covered Providers are required to develop and implement policies and procedures under which all staff are vaccinated for COVID-19. A Covered Provider’s COVID-19 vaccination policies and procedures must apply to the following staff, regardless of clinical responsibility or patient contact, and include all current staff as well as any new staff who provide any care, treatment, or other services for the Covered Provider and/or its patients:

• Facility employees;
• Licensed practitioners;
• Students, trainees, and volunteers; and
• Individuals who provide care, treatment or other services for the facility and/or its patients under contract or other arrangement.

In other words, any individual that performs their duties at any site of care, or has the potential to have contact with anyone at the site of care, including staff or patients, must be fully vaccinated for COVID-19.

CMS considers a staff member “fully vaccinated” if it has been two or more weeks since the staff member has completed a primary vaccination series for COVID-19. Completing a primary vaccination series means the individual has received a single-dose vaccine or all doses of a multi-dose vaccine. The CMS Rule does not require booster doses or additional (third) doses; however, the CMS Rule does require Covered Providers to have a process for tracking and securely documenting the COVID-19 vaccination status of any staff member who has obtained booster doses as recommended by the CDC.

Individuals who provide services 100% remotely, such as fully remote telehealth or payroll services, are not subject to the vaccination requirements. However, CMS encourages Covered Providers to identify and monitor these individuals as a part of implementing the policies and procedures of the CMS Rule, documenting, and tracking overall vaccination status. In addition, staff who provide support services for a Covered Provider that are performed exclusively outside of the Covered Provider’s facilities and who do not have any direct contact with patients and/or other covered staff are not subject to the vaccination requirements. The CMS Rule also does not apply to staff who have requested and/or been granted an exemption and staff whose vaccination must be temporarily delayed due to clinical precautions recommended by the CDC, including but not limited to those with acute illness secondary to COVID-19 and individuals who received monoclonal antibodies or convalescent plasma for COVID-19 treatment.

III. Does the CMS Rule apply to vendors?

The CMS Rule does apply to vendors, but Covered Providers are not required to ensure the vaccination of individuals who infrequently provide ad hoc non-health care services (for example, an annual elevator inspection), or services that are performed exclusively off-site, not at or adjacent to any site of patient care. Other examples of individuals who may infrequently enter a facility or site of care for specific limited purposes and for a limited amount of time, but do not provide services by contract or under arrangement, may include delivery and repair personnel.

When determining whether to require COVID-19 vaccination of an individual who does not fall into the categories established by the CMS Rule, Covered Providers should consider frequency of presence, services provided, and proximity to patients and staff. For example, a plumber who makes an emergency repair in an empty restroom or service area and correctly wears a mask for the entirety of the visit may not be an appropriate candidate for mandatory vaccination. On the other hand, a crew working on a construction project whose members use shared facilities (including restrooms, cafeteria, and break rooms) during their breaks would be subject to these requirements due to the fact that they are using the same common areas used by staff, patients, and visitors.

IV. How should a Covered Provider document vaccination status?

Covered Providers are required to track and securely document the following:

• Vaccination status of staff members, including booster doses recommended by the CDC. Examples of acceptable forms of proof of vaccination include: CDC COVID-19 vaccination record care (or a legible photo of the care), documentation of vaccination from a health care provider or electronic health record, or state immunization information system record.
• Information provided by staff who have requested and/or received an exemption from the vaccination.
• Vaccination status of staff for whom the COVID-19 vaccination must be temporarily delayed per CDC recommendations.

The CMS Rule gives Covered Providers the flexibility to use the appropriate tracking tools of their choice.

V. Are there any exemptions?

The CMS Rule requires Covered Providers to establish and implement a process by which staff may request an exemption from COVID-19 vaccination requirements based on applicable federal anti-discrimination and civil rights law, including the Americans with Disabilities Act, Section 504 of the Rehabilitation Act, Title VII of the Civil Rights Act, the Pregnancy Discrimination Act, and the Genetic Information Nondiscrimination Act. These laws generally allow covered staff to request exemptions from vaccinations for disability, medical conditions, or sincerely held religious beliefs.

Covered Providers must have a process for collecting and evaluating such requests, including tracking and securing documentation of information provided by those staff who have requested exemption, the facility’s decision on the request, and any accommodations that are provided.

Requests for exemptions based on applicable federal anti-discrimination and civil rights laws must be documented and evaluated in accordance with the applicable federal law and each Covered Provider’s policies and procedures.

For staff members who request a medical exemption from vaccination, all documentation confirming recognized clinical contraindications for COVID-19 vaccines, and which supports the staff member’s request, must be signed and dated by a licensed practitioner who is not the individual requesting the exemption and who is acting within their respective scope of practice. Such documentation must contain all information specifying which of the authorized COVID-19 vaccines are clinically contraindicated for the staff member to receive and the recognized clinical reasons for the contraindications, as well as a statement by the authenticating practitioner recommending that the staff member be exempted from the facility’s COVID-19 vaccination requirements based on the recognized clinical contraindications.

The CMS Rule requires Covered Providers to have a process for ensuring the implementation of additional precautions, intended to mitigate the transmission and spread of COVID-19, for all staff who are not fully vaccinated for COVID-19. CMS is not mandating specific COVID-19 testing requirements, but testing requirements could be included in a Covered Provider’s precautions to mitigate the transmission and spread of COVID-19.

VI. Are there requirements for contingency planning?

CMS is requiring that Covered Providers make contingency plans in consideration of staff who are not fully vaccinated to ensure that they will soon be vaccinated and will not provide care, treatment, or other services for the provider or its patients until such time as such staff have completed the primary vaccination series for COVID-19 and are considered fully vaccinated, or, at a minimum, have received a single-dose COVID-19 vaccine, or the first dose of the primary vaccination series for a multi-dose COVID-19 vaccine.

This planning should also address the safe provision of services by individuals who have requested an exemption from vaccination while their request is being considered and by those staff for whom COVID-19 vaccination must be temporarily delayed, as recommended by the CDC, due to clinical precautions and considerations.

VII. What are the deadlines?

By December 5, 2021, which is Phase 1, all staff must have received, at a minimum, the first dose of the primary series or a single dose COVID-19 vaccine, or requested and/or been granted a lawful exemption, prior to staff providing any care, treatment, or other services for the Covered Provider and/or its patients. Phase 1 also includes the requirements for Covered Providers to have appropriate policies and procedures developed and implemented. Phase 1 is effective on December 5, 2021.

By January 4, 2022, which is Phase 2, all staff must have completed the primary series of the COVID-19 vaccine, except for those staff who have been granted exemptions from COVID-19 vaccination or those staff for whom COVID-19 vaccination must be temporarily delayed, as recommended by the CDC, due to clinical precautions and considerations. Although an individual is not considered fully vaccinated until 14 days after the final dose, staff who have received the final dose of a primary vaccination series by the Phase 2 effective date are considered to have met the individual vaccination requirements, even if they have not yet completed the 14-day waiting period. Phase 2 is effective January 4, 2022.

VIII. How will the CMS Rule be enforced?

CMS will enforce the CMS Rule through surveys, including complaint or regular re-validation/re-certification surveys occurring approximately every three years, that are done by state agencies and accrediting bodies.

CMS states in commentary that it will issue interpretive guidelines, which will include survey procedures. The guidelines will instruct surveyors on how to determine if a Covered Provider is compliant with the requirements by reviewing the entity’s records of staff vaccinations. The guidelines will also instruct surveyors to conduct interviews of staff to verify their vaccination status. Further, the Covered Provider’s policies and procedures will be reviewed to ensure each component of the requirement has been addressed. CMS will also provide guidance on how surveyors should cite Covered Providers when noncompliance is identified.

Covered Providers that are cited for noncompliance may be subject to enforcement remedies imposed by CMS depending on the level of noncompliance and the remedies available under federal law. For nursing facilities, home health agencies and hospices, that may mean civil monetary penalties, denial of payment on new admissions, or termination of the participation agreement. For hospitals and most other facilities, remedies are more limited. CMS can terminate a hospital’s Medicare provider agreement, but it is rarely does this. CMS will closely monitor the status of staff vaccination rates, provider compliance, and any other potential risks to patient, resident, client, and program participant health and safety.

IX. What are the next steps?

Now is the time to begin developing and implementing the policies and procedures required by the CMS Rule.