On Nov. 4, the Centers for Medicare & Medicaid Services (“CMS”) released its highly anticipated Omnibus COVID-19 Health Care Staff Vaccination Interim Final Rule, which upon publication in the Federal Register will mandate COVID-19 vaccination for all employees of healthcare facilities regulated by CMS.

Summary

The rule requires covered healthcare providers and suppliers to ensure staff are fully vaccinated for COVID-19 unless individuals are exempt. CMS considers staff to be fully vaccinated once two or more weeks have passed since they completed a primary vaccination series.  In turn, a primary vaccination series is defined as having received a single-dose vaccine or all doses of a multi-dose vaccine. Consistent with current CDC guidance, for purposes of this rule, CMS is not currently requiring healthcare staff to receive additional (third) doses or booster doses.  Unlike the OSHA Emergency Temporary Standard also released today, which impacts all employers with more than 100 employees in all industries nationwide, the CMS Interim Final Rule does not allow for a testing option in lieu of vaccination. CMS estimates that some 2.4 million healthcare workers will need to be vaccinated or replaced in the first year, most in the first two months after the rule is published.

Covered Providers

The rule applies directly to the following Medicare- and Medicaid-certified providers: Ambulatory Surgical Centers (ASCs); Hospices; Psychiatric Residential Treatment Facilities (PRTFs); Programs of All-Inclusive Care for the Elderly (PACE); Hospitals (acute care hospitals, psychiatric hospitals, hospital swing beds, long term care hospitals, children’s hospitals, transplant centers, cancer hospitals, and rehabilitation hospitals/inpatient rehabilitation facilities); Long Term Care (LTC) Facilities, including Skilled Nursing Facilities (SNFs) and Nursing Facilities (NFs), generally referred to as nursing homes; Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICFs-IID); Home Health Agencies (HHAs); Comprehensive Outpatient Rehabilitation Facilities (CORFs); Critical Access Hospitals (CAHs); Clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services; Community Mental Health Centers (CMHCs); Home Infusion Therapy (HIT) suppliers; Rural Health Clinics (RHCs)/Federally Qualified Health Centers (FQHCs); and End-Stage Renal Disease (ESRD) Facilities.  At this time the rule has not been written to directly apply to other health care facilities that are not regulated by CMS health and safety standards, such as physician offices.

Covered Healthcare Staff

The categories of individual workers covered by the rule are also broad and include not only licensed practitioners, but students, volunteers, trainees, administrative staff, leadership, and any other individuals providing care, treatment, or other services, regardless of clinical responsibility, relationship to patient care, or work location. The only exception is for individuals who work 100% remotely or provide one-off non-healthcare-related services.

Covered Vaccines

CMS expects most healthcare staff will receive in the United States one of the three vaccines currently authorized for emergency use by the U.S. Food and Drug Administration (FDA): Pfizer-BioNTech (interchangeable with the licensed Comirnaty vaccine made by Pfizer for BioNTech), Moderna, and Janssen (Johnson & Johnson) COVID-19 vaccines. The rule does contemplate some possible alternative scenarios such as receipt of an FDA authorized vaccine outside the U.S., administration of a vaccine not authorized by the FDA but listed by the World Health Organization (WHO) for emergency use, or vaccinations that are part of clinical trials in the United States. For those possible alternate scenarios, CMS directs employers to this CDC website.

Conflicting State and Local Requirements

Recognizing that healthcare providers are regulated at the federal, state, and local level, and sometimes those requirements are in tension or even conflict, CMS made clear that for purposes of this rule, it intends the requirements to take precedence over conflicting state and local requirements. Specifically, CMS said:

We understand that some states and localities have established laws that would seem to prevent Medicare- and Medicaid-certified providers and suppliers from complying with the requirements of this IFC. We intend, consistent with the Supremacy Clause of the United States Constitution, that this nationwide regulation preempts inconsistent State and local laws as applied to Medicare- and Medicaid-certified providers and suppliers.

Effective Date, Compliance Dates, and Comment Deadlines

Effective and Compliance Dates. The rule is currently only posted for public inspection by the Federal Register, but it is expected to be published in the Federal Register on Nov. 5 or shortly thereafter, and the deadlines for compliance will begin to run at that time.

While the rule is effective once officially published (which will likely be on Nov. 5), there are two “phases” for compliance. Within 30 days, or likely by Dec. 5, covered healthcare employers must require workers to receive their first dose (or the single dose vaccine) prior to providing care and services to patients. Covered health care employers must also put into place their policies and procedures requiring vaccination against COVID-19 within 30 days. Within 60 days, or likely by Jan. 4, 2022, healthcare workers must be fully vaccinated, which means having received the final dose plus two weeks. However, CMS has indicated that health care facilities will be considered in compliance with the rule if health care workers have at least received the final dose in a two-dose series.”

Comment Deadline. Once the rule is published, covered healthcare providers and other stakeholders will have 60 days to provide comments on the regulation to CMS. Thereafter, CMS may revise the rule to account for questions, concerns, data, or other issues that have arisen during the first 60 days of implementation. Healthcare facilities and others should strongly consider providing responses to inform CMS’s further development and management of the rule.

CMS will accept comments on all aspects of the rule, and it has specifically requested comment on a range of issues such as whether and how it may impact staffing retention, how small rural hospitals might increase vaccination rates, whether the compliance deadline should be extended for an additional month, and whether CMS should require daily or weekly testing of unvaccinated individuals. Given the overlap and conflict with some state and local requirements, CMS has also specifically invited State and local comments on the rule. CMS has also invited comments on new information obligations created by the rule, including on the need for the collections, the burdens associated with them, the clarity and utility of the collections, and any recommendations to minimize the burdens imposed by the collections.

Penalties

The standards established by the rule are new conditions of participation in Medicare and Medicaid, which means violation of the standards could jeopardize future participation and trigger a range of penalties and enforcement actions up to and including exclusion, although CMS has said the goal is to obtain compliance.  To date, potential fines have not been published.