The CMS Healthcare Staff Vaccination Rule takes aim at ensuring that eligible healthcare workers are soon vaccinated against COVID-19. The interim final rule requires providers and suppliers to fully implement the IFR as a condition of participation/condition of coverage in the Medicare and Medicaid programs, and to establish policies effecting “full vaccination” of staff by January 4, 2022.
The Centers for Medicare and Medicaid Services (CMS) released its long-awaited emergency regulation governing healthcare staff vaccination requirements on November 4. Published as an interim final rule (IFR), it was released by CMS concurrently with the Emergency Temporary Standard (ETS) promulgated by the Occupational Safety and Health Administration (OSHA) (read our LawFlash on the OSHA ETS). Both rules require employers to help prevent workers from contracting COVID-19 in the workplace. Lawsuits were quickly filed in federal courts challenging the OSHA ETS rule.
In addressing how the IFR works in conjunction with OSHA ETS requirements, CMS instructs providers first to look to the IFR and CMS guidelines. CMS says the IFR takes priority above other federal vaccination requirements for CMS-certified entities. In certain rare circumstances where the OSHA ETS may apply to staff not subject to the CMS rule, the OSHA ETS would apply. While the two rules are intended to work in tandem, the healthcare trade associations are seeking further clarification on this from the two agencies.
CMS Certified Providers and Suppliers
Providers and suppliers that participate in the Medicare and Medicaid programs are required to implement the IFR as a Condition of Participation/Condition of Coverage. Failure to comply with the IFR’s provisions could result in penalties, denial of payment for new admissions, and/or termination of their provider agreement with Medicare and Medicaid.
Healthcare providers and suppliers covered in the IFR directly include the following entities (the “IFR facility or facilities”):
All staff working at an IFR facility (including volunteers and students) must be vaccinated—regardless of whether they come in direct contact with patients—and this requirement extends to staff of contracted vendors. As a result, entities that may not be subject directly to this IFR may find themselves indirectly subject to the CMS rule, requiring its staff to similarly meet the IFR requirements.
[W]e believe it is necessary to require vaccination for all staff that interact with other staff, patients, residents, clients of PACE program participants in any location, beyond those that physically enter facilities or other sites of patient care.
The term “fully vaccinated” means staff that are fully vaccinated against COVID-19—defined by the IFR as two weeks or more after the completion of a “primary vaccination series.” This requirement is described in two implementation phases:
IFR facilities must track and securely document the COVID-19 vaccination status of each staff member. Significant detail regarding which vaccines and specific dosing regimens meet the definition of “primary vaccination series”—including those from other World Health Organization countries and non-FDA approved vaccines—is provided in the CMS rule.
CMS leaves it up to each IFR facility to determine how best to implement compliance with the various legal exemptions (e.g., allergies, religious exemptions) that may be applicable to the vaccine mandate and further provides that all vaccination exemption requests must be documented.
Testing for COVID-19
The IFR does not require daily or weekly testing of unvaccinated individuals because healthcare worker vaccinations are instead required: “We have reviewed scientific evidence on testing and found that vaccination is a more effective infection control measure.” However, IFR facilities may exercise testing precautions voluntarily in addition to vaccination:
… nothing in this rule removes the obligation on providers and suppliers to meet existing requirements to prevent the spread of infection, which in practice means that these entities may also conduct regular testing alongside such actions as source control and physical distancing.
CMS is also seeking stakeholder feedback on this issue.
Vaccination Policies and Procedures
CMS requires that all IFR facilities develop and implement policies and procedures for vaccinating staff for COVID-19 subject to review by state surveyors and accreditation organizations. CMS has said that it intends to issue interpretive guidelines, including state survey and staff interview procedures, for assessing a facility’s compliance.
Enforcement of the IFR will occur through onsite compliance reviews by state survey agencies and accreditation organizations. Although CMS says that it will first work to bring a facility into compliance, the agency makes clear that it will apply its standard corrective action status levels to this review, including the issuance of “immediate jeopardy” notices.
Termination would only occur after a facility has been given the opportunity to make corrections. The CMS Frequently Asked Questions (FAQs) on the IFR make a distinction regarding penalties for types of entities, indicating that for nursing homes, home health agencies, and hospice (beginning in 2022), enforcement will include civil monetary penalties, denial of payment, and then termination from the Medicare and Medicaid programs as a final measure.
CMS has said that it intends to retain the provisions of the IFR beyond the conclusion of the public health emergency (PHE), adding that it may deem these provisions permanent for CMS-certified facilities. The IFR highlights that it is not associated with or tied to the PHE declarations, nor is there a sunset clause.
The IFR is based on CMS’s authority to govern healthcare entities and certify them as safe for patients. CMS notes that the IFR is being issued pursuant to its authority established by US Congress under the Social Security Act to regulate healthcare facilities in Sections 1102 and 1871, and to publish rules and regulations. CMS further recognizes this authority does not extend to independent physicians/clinicians.
It is also clear that any pushback by states will be challenged, as CMS expects all facilities certified by the agency to fully comply with the IFR, citing its authority under the Supremacy Clause of the US Constitution that preempts state law to the contrary. We fully anticipate the federal authority component of this IFR will be challenged in court—especially given that 27 states have already filed lawsuits challenging the OSHA ETS.
While the effective date of the IFR is November 5, 2021, compliance with the “primary vaccination series” is required to be implemented by January 4, 2022. To be assured consideration, comments must be received by CMS no later than 5 pm on January 4, 2021.
If you have any questions or would like more information on the issues discussed in this LawFlash, please contact any of the following Morgan Lewis lawyers:
Michele L. Buenafe
Sharon Perley Masling
Scott A. Memmott
Albert W. Shay
Howard J. Young
Kaiser H. Chowdhry
Alana F. Genderson
Jacob J. Harper
Tesch Leigh West
Joyce A. Cowan, Senior Advisor
Mark B. Stein
Lauren Z. Groebe
W. Reece Hirsch