CMS Issues Sweeping Vaccine Mandate for Health Care Providers

Alongside the new OSHA Emergency Temporary Standard (ETS) on vaccination and testing, CMS has released its companion rule requiring vaccination for certified Medicare and Medicaid providers and suppliers. The Interim Final Rule with comment period (“IFR”), which was released on November 4, 2021, will be officially published on November 5, 2021 in the Federal Register.

Because of CMS’ existing regulatory reach over Medicare- and Medicaid-certified facilities, the mechanism for mandating the vaccination and testing requirements is a fairly straightforward approach. The IFR is made up of separate but nearly identical amendments to conditions of coverage, conditions of participation or other grant funding regulations for the certified providers and suppliers covered by the IFR. Because of this existing regulatory structure and CMS’ broad authority to regulate entities that participate in Medicare and Medicaid, any legal challenge to the IFR has a much more difficult path. Notably, the regulations are effective immediately upon publication. Facilities covered by the rule must ensure all covered staff have received the first dose of a two-dose vaccine or a one dose vaccine prior to providing any services by December 5, and to be fully vaccinated by January 4, 2022. While the IFR takes effect immediately when published on November 4, there is a 60 day comment period for stakeholders to submit formal comments on the emergency regulation.

Which Health Care Entities are Covered by the IFR?

The IFR applies only to the following Medicare- and Medicaid- certified providers and suppliers listed below:

Ambulatory Surgical Centers (ASCs) (§ 416.51)
Hospices (§ 418.60)
Psychiatric residential treatment facilities (PRTFs) (§ 441.151)
Programs of All-Inclusive Care for the Elderly (PACE) (§ 460.74)
Hospitals (acute care hospitals, psychiatric hospitals, hospital swing beds, long term care hospitals, children’s hospitals, transplant centers, cancer hospitals, and rehabilitation hospitals/inpatient rehabilitation facilities) (§ 482.42)
Long Term Care (LTC) Facilities, including Skilled Nursing Facilities (SNFs) and Nursing Facilities (NFs), generally referred to as nursing homes (§ 483.80)
Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICFs-IID) (§ 483.430)
Home Health Agencies (HHAs) (§ 484.70)
Comprehensive Outpatient Rehabilitation Facilities (CORFs) (§§ 485.58 and 485.70)
Critical Access Hospitals (CAHs) (§ 485.640)
Clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services (§ 485.725)
Community Mental Health Centers (CMHCs) (§ 485.904)
Home Infusion Therapy (HIT) suppliers (§ 486.525)
Rural Health Clinics (RHCs)/Federally Qualified Health Centers (FQHCs) (§ 491.8)
End-Stage Renal Disease (ESRD) Facilities (§ 494.30)

Importantly, who is not covered by the IFR? Physician offices and other health care entities that are not regulated by CMS are not covered by the IFR. As predicted, though, the IFR is very broad in the categories of individuals that a hospital, for example, or other regulated entity must cover in their vaccine mandate. All licensed practitioners and any other “[i]ndividuals who provide care, treatment, or other services on behalf of the [organization], under contract or by other arrangement” must be fully vaccinated. This broad language would pick up physicians and APPs who may primarily provide services in a non-CMS regulated setting (e.g., a physician clinic) but who admit and attend to patients in a hospital. But for administrative and certain clinical staff of a physician clinic that do not otherwise provide services for a regulated entity, there is no coverage under the IFR. This is important as the OSHA ETS issued concurrently with the CMS IFR carves out any workplaces where employees provide healthcare services or healthcare support services when subject to the requirements of OSHA’s COVID-19 Healthcare ETS. Physician offices and other non-certified entities may need to review several sets of regulations to determine whether any reach certain members of their staff.

What Personnel are Covered by the IFR?

The IFR mandates that the regulated entity must “develop and implement policies and procedures to ensure that all staff are fully vaccinated for COVID-19.” As noted above, the IFR is very broad in the categories of individuals that must be included within a facilities policies on mandatory vaccination. The IFR notes that the requirement is regardless of clinical responsibility or patient contact, and “must apply to the following [entity] staff, who provide any care, treatment, or other services for the center and/or its patients:

[Entity] employees
Licensed practitioners;
Students, trainees, and volunteers; and
Individuals who provide care, treatment, or other services for the [entity] and/or its patients, under contract or by other arrangement.

This is an all-encompassing list for any individual that is present in the facility of the entity. Notably, there are some exceptions for individuals that will not be present in the facility. The IFR allows an entity’s policies to exclude:

Staff who exclusively provide telehealth or telemedicine services outside of the entity and who do not have direct contact with patients or staff in the facility; and
Staff who provide support services for the entity that are performed exclusive outside the facility setting and who do not have any direct contact with patients or staff in the facility

What Are the Required Components for a Vaccination Policy?

The regulated entity must maintain policies that cover the following components:

A process for ensuring all covered staff are fully vaccinated, except for staff who have been granted an exemption (as described below);
A process for implementing additional precautions to prevent the spread of COVID-19 by staff who are not vaccinated;
A process for tracking and securely documenting the vaccination status of all staff, including those receiving boosters;
A process by which staff can request an exemption from the requirement based on exemptions found in existing Federal law;
A process for tracking and documenting staff requests for exemptions;
A process for ensuring that the documentation for medical exemptions are signed and dated by a licensed practitioner (who is not the individual requesting the exemption) and that clearly indicate which of the available vaccines are contraindicated;
A process that documents when the vaccination of one or more staff should be temporarily delated based on CDC recommendations (e.g., individuals who remain ill due to prior COVID-19 infections or who have received monoclonal antibodies); and
Contingency plans for staff who are not fully vaccinated for COVID-19.

As noted above, the entity’s process must allow for exemption requests based on existing Federal law. This would include medical exemptions for those for whom a vaccine is medically contraindicated or for whom a medical necessity requires a temporary delay in vaccination; or those legally entitled to a reasonable accommodation under federal civil rights laws because they have a disability or sincerely held religious beliefs, practices or observances that conflict with the vaccination requirement.

Notably, unlike the OSHA mandate there is no opt out for individuals who wish to undergo weekly COVID-19 testing. CMS included the following FAQ and answer on its website:

Q: Does the regulation include testing requirements for unvaccinated staff?

A: No, this regulation requires staff vaccination only. While CMS considered requiring daily or weekly testing of unvaccinated individuals, scientific evidence on testing found that vaccination is a more effective infection control measure. CMS will continue to review the evidence and stakeholder feedback on this issue, however facilities may voluntarily institute testing alongside other infection prevention measures such as physical distancing and source control. Of note, CMS published an emergency regulation in September 2020 that established new requirements for Long Term Care facilities (nursing homes) to test facility residents and staff for COVID-19. CMS expects continue compliance with this requirement. Additionally, CMS encourages facilities not covered under this regulation to review the OSHA Emergency Temporary Standard for separate vaccination and testing requirements.

We note that the requirement to implement additional precautions for those who are not fully vaccinated (e.g., medical exemption granted) is the requirement by which CMS can find a facility not in compliance for not sufficiently enforcing precautions against the spread of COVID-19 for unvaccinated staff.

How Will the IFR be Enforced?

CMS notes in its press release that CMS will utilize its established survey and enforcement process to ensure compliance with the IFR. If a facility is not complying with the rules, “it will be cited by a surveyor as being non-compliant and have an opportunity to return to compliance before additional actions occur.”