Note: This CMS Rule refenced in this Insight is separate and distinct from the OSHA ETS that was issued on November 4. Thus, although the CMS Rule could also be challenged in court, the November 6 court order blocking implementation of the OSHA ETS does not limit or otherwise affect the new CMS Rule.

Following marching orders from the Biden administration’s “Path Out of the Pandemic,” the Centers for Medicare & Medicaid Services (CMS) just published its long-anticipated Rule that expands vaccine mandates to more than 17 million healthcare workers nationwide. This Rule goes well beyond the Healthcare ETS issued by OSHA in June. Specifically, CMS will require all employees of healthcare facilities participating in Medicare and Medicaid to be fully vaccinated by January 4, 2022. Being “fully vaccinated” means two weeks have elapsed after receipt of either the second of a two-dose vaccine or a single shot of the one-dose vaccine. The Rule, impacting approximately 76,000 health care facilities across the country, is part of the administration’s expansive plan to curb the deadly spread of COVID-19 and enhance patient safety in the vulnerable healthcare industry. Facilities which do not timely comply with the Rule face monetary penalties – but far more serious for most them, could also suffer termination of their Medicare and Medicaid provider status. With the compliance deadline looming right after the holiday season, what does your healthcare organization need to know to ensure compliance? Here is an overview of what you face and a five-step survival guide for employers.

Coverage and Scope

CMS establishes and oversees health and safety standards, known as “Conditions” or “Requirements for Coverage,” for 21 types of healthcare organizations receiving federal funding through Medicare or Medicaid (“Participants”). Specifically, the new Rule directly regulates the following healthcare facilities as listed in the Code of Federal Regulation (CFR):

• Ambulatory Surgical Centers (ASCs)
• Hospices
• Psychiatric residential treatment facilities
• Hospitals
• Long Term Care Facilities, including Skilled Nursing Facilities and Nursing Facilities, generally referred to as “nursing homes”
• Immediate Care Facilities for Individuals with Intellectual Disabilities
• Home Health Agencies
• Comprehensive Outpatient Rehabilitation Facilities
• Critical Access Hospitals
• Clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services
• Community Mental Health Centers
• Home Infusion Therapy suppliers
• Rural Health Clinics/Federally Qualified Health Centers
• End-Stage Renal Disease facilities

The Rule does not apply to physician offices, assisted living facilities, group homes, and community-based services or entities that do not provide services pursuant to contracts regulated by CMS. If you are not a covered entity, it is still critical to assess whether you may be subject to another vaccine mandate, either issued by OSHA or the subject to requirements for federal contractors.

Covered healthcare organizations are required to follow the CMS Rule and could fall within the scope of alternate federal vaccine regulations. For example, although OSHA’s broad ETS does not apply to covered healthcare organizations (who were already covered by Healthcare ETS issue in June 2021), covered entities could be subject to vaccine mandates that are applicable to federal contractors and subcontractors.

The CMS Rule requires all workers of covered entities to be fully vaccinated by the January 4, 2022 deadline. “All workers” includes every employee regardless of position, thereby encompassing all clinical (including doctors, nurses, therapists, etc.) and non-clinical positions, plus students, trainees, and volunteers. The Rule encompasses employees who provide treatment or other services for the facility. Thus, individuals who provide services outside the covered facility’s location, but in the presence of patients, clients, or other workers, are covered by the Rule. This means everyone who interacts with other staff, patients, residents, clients, or PACE program participants beyond the defined on-site clinical setting, including but not limited to home health, clinics, other sites of care, administrative offices, and off-site meetings, must also be vaccinated. Individuals who provide services 100% remotely, a standard that will be applied strictly, are not subject to the vaccination requirement.

Basic Requirements and Deadlines

The Rule requires all covered facilities to create and implement a plan and process for compliance. Specifically, at a basic level, covered entities must vaccinate all eligible employees (without the weekly testing option that is permitted under the new OSHA ETS). This sets the basic CMS Rule apart – with no alternate testing option, all employees must receive the vaccination. 

Employers still have the duty, however, to provide reasonable medical and religious accommodations as required by federal law. The Rule emphasizes that in providing certain accommodations, employers must impose additional safety precautions to minimize risk of transmission to patients, thereby maintaining the priority of protecting the health and safety of patients. The process for requesting exemptions or accommodations, and additional safety precautions that may be applicable for those who receive exemptions, must all be spelled out in policies, which must be promulgated.

Finally, the Rule requires employers to track vaccination status by maintaining a list of all staff for review by onsite compliance surveyors. The Rule’s recordkeeping requirements and enforcement procedures are discussion in detail below.

The Rule took effect on November 5, providing a narrow window in which to comply. All employees of covered entities must be fully vaccinated by January 4, 2022, unless those employees have been granted appropriate exemptions. All staff must, however, have received a single-dose vaccine or the initial dose of a primary series by December 5. There is currently no requirement for boosters.

Preemption

In promulgating its Rule, CMS worked with OSHA in an attempt to ensure congruence in both regulations. Nonetheless, for covered entities this Rule takes priority over other federal vaccine mandates.

CMS states and intends that this Rule preempts state laws that are inconsistent with its requirements.

Requests for Medical and Religious Exemptions

CMS expects employers to continue to follow the ADA and Title VII in evaluating disability and religious exemptions. In fact, the Rule encourages employers to review the EEOC’s website for guidance about what situations warrant accommodation(s). Accordingly, only individuals who cannot be vaccinated because of medical contraindications or sincerely held religious beliefs should be allowed accommodation, but only as required. It will therefore be critical that facilities document their evaluation and handling of all requests for exemptions. CMS will not recognize prior COVID-19 infection as a basis for outright exemption from the vaccination requirement.

Recordkeeping Requirements

In tracking employee vaccination status, the Rule establishes recordkeeping requirements as follows:

• Document all employees’ vaccination status as you implement the vaccine mandate. Vaccine documentation must be treated as strictly confidential and maintained separately from the employer’s personnel files.
• While employers have the flexibility to use appropriate tracking tools of their preference, the Rule refers to the CDC's tracking tools, which are available to the general public, as an exemplar.
• In assessing each employees’ vaccine status, acceptable forms of proof of vaccination, include but are not limited to the Center for Disease Control and Prevention (CDC) COVID-19 vaccination record card or legible photo of the card; documentation of vaccination from and by healthcare providers; and confirmation from a state immunization information system. CMS does not appear to address whether employers must collect one of these forms from employees previously confirmed to be vaccinated using other forms of proof. Accordingly, unless additional guidance is issued on this question, the safest practice would be to review already vaccinated employees and ensure that your documentation evidences an acceptable form of proof for each of them. For example, an employee’s previous self-attestation of fully-vaccinated status may now be insufficient to meet CMS requirements.

Enforcement

The Rule empowers CMS, within its discretion, to enforce the following penalties for noncompliance:

• Monetary penalties;
• Denial of payment/reimbursement; and/or
• Termination of Medicare and Medicaid certification and participation.

CMS surveyors will conduct onsite reviews to assess compliance with the Rule.

What Should You Do? 5-Step Survival Guide

If you are a Medicare or Medicaid Provider and have not already done so, move quickly yet prudently to implement a process to ensure compliance with the Rule. First and foremost, confirm which rules apply to you, whether it is the CMS Rule, OSHA’s ETS for large employers, federal contractor requirements, or if you are not a Medicare or Medicaid provider, OSHA’s Healthcare ETS.

If you are indeed covered by the CMS Rule, the following five steps, described in further detail here, are critical parts of a successful plan:

1. Adopt systems and procedures to determine and safeguard all information regarding employees’ vaccination status;
2. Communicate applicable policies and procedures to everyone who may work on-site, including but not limited the particulars of your vaccine requirement and the process for requesting exemptions;
3. Develop a non-discriminatory, streamlined process to handle vaccine accommodation requests;
4. Review and confirm additional COVID-19 precautions that will be applicable to individuals who are granted accommodations; and
5. Prepare to respond to some inevitable pushback and complaints, as well as likely on-site CMS inspections, by communicating clearly and maintaining detailed records of your processes.

If you have already implemented a mandatory vaccine policy, ensure it aligns with the requirements discussed herein; if so, certainly continue to follow, using available resources such as employee education and clinics, to ensure vaccination of all employees.