CMS Omnibus COVID-19 Healthcare Staff Vaccination Rule –
A First Look

November 08, 2021

The CMS Healthcare Staff Vaccination Rule takes aim at ensuring that eligible healthcare workers are soon vaccinated against COVID-19. The interim final rule requires providers and suppliers to fully implement the IFR as a condition of participation/condition of coverage in the Medicare and Medicaid programs, and to establish policies effecting “full vaccination” of staff by January 4, 2022.

The Centers for Medicare and Medicaid Services (CMS) released its long-awaited emergency regulation governing healthcare staff vaccination requirements on November 4. Published as an interim final rule (IFR), it was released by CMS concurrently with the Emergency Temporary Standard (ETS) promulgated by the Occupational Safety and Health Administration (OSHA) (read our LawFlash on the OSHA ETS). Both rules require employers to help prevent workers from contracting COVID-19 in the workplace. Lawsuits were quickly filed in federal courts challenging the OSHA ETS rule.

In addressing how the IFR works in conjunction with OSHA ETS requirements, CMS instructs providers first to look to the IFR and CMS guidelines. CMS says the IFR takes priority above other federal vaccination requirements for CMS-certified entities. In certain rare circumstances where the OSHA ETS may apply to staff not subject to the CMS rule, the OSHA ETS would apply. While the two rules are intended to work in tandem, the healthcare trade associations are seeking further clarification on this from the two agencies.

Who Is Covered by the CMS Rule?

CMS Certified Providers and Suppliers

Providers and suppliers that participate in the Medicare and Medicaid programs are required to implement the IFR as a Condition of Participation/Condition of Coverage. Failure to comply with the IFR’s provisions could result in penalties, denial of payment for new admissions, and/or termination of their provider agreement with Medicare and Medicaid.

Healthcare providers and suppliers covered in the IFR directly include the following entities (the “IFR facility or facilities”):

  • Hospitals—all categories
  • Ambulatory Surgical Centers (ASCs)
  • Home Health Agencies (HHAs)
  • Hospices
  • End Stage Renal Disease (ESRD) Facilities
  • Home Infusion Therapy (HIT) Suppliers
  • Long Term Care (LTC) Facilities
  • Rural Health Clinics (RHCs) and Federally Qualified Health Centers (FQHCs)
  • Critical Access Hospitals (CAHs)
  • Programs for All-Inclusive Care for the Elderly (PACE)
  • Comprehensive Outpatient Rehabilitation Facilities (CORFs)
  • Clinics, Rehabilitation Agencies, and Public Health Agencies as Providers of Outpatient Physical Therapy and Speech-Language Pathology Services
  • Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICFs-IID)
  • Psychiatric Residential Treatment Facilities (PRTFs)
  • Community Mental Health Centers (CMHCs)


All staff working at an IFR facility (including volunteers and students) must be vaccinated—regardless of whether they come in direct contact with patients—and this requirement extends to staff of contracted vendors. As a result, entities that may not be subject directly to this IFR may find themselves indirectly subject to the CMS rule, requiring its staff to similarly meet the IFR requirements.


  • Physicians: Although the IFR does not apply to individual physician offices, medical staff and scientists who work in facilities subject to the IFR must be vaccinated.
  • Home Based Care: The CMS rule also extends the vaccination requirement to providers and suppliers that routinely care for patients and clients outside of an IFR facility (e.g., home health, infusion therapy, hospice, or other therapy providers).
  • Remote Staff: Remote staff that provide services 100% via telework are generally not subject to the vaccination requirements. However, remote workers who occasionally encounter fellow staff as part of their job responsibilities may be bound by the IFR’s provisions, if the services provided are within the purview of the designated providers who must comply with the IFR.
  • Staff Who Do Not Provide Direct Patient Care: CMS makes clear that persons who do not provide direct patient care (e.g., administrators, back-office personnel, cafeteria workers, housekeepers) must be vaccinated because they may come in contact with individuals who treat patients:

    [W]e believe it is necessary to require vaccination for all staff that interact with other staff, patients, residents, clients of PACE program participants in any location, beyond those that physically enter facilities or other sites of patient care.

  • Contracted Vendors: Contracted vendors including food service providers, laundry and janitorial services, or other suppliers should seek counsel to determine if their staff are subject to the IFR, including how the CMS and OSHA ETS rules would work in tandem.

When Are Staff Considered Fully Vaccinated?

“Fully Vaccinated”

The term “fully vaccinated” means staff that are fully vaccinated against COVID-19—defined by the IFR as two weeks or more after the completion of a “primary vaccination series.” This requirement is described in two implementation phases:

  • Phase I: Must be completed within the first 30 days of publication of the IFR in the Federal Register, which equates to a deadline of December 5, 2021. All IFR facility staff must have received, at a minimum, the first dose of a primary series or single-dose COVID-19 vaccine prior to providing any care, treatment, or other services to patients, or have been granted an exemption to the vaccination requirements in accordance with the IFR.
  • Phase II: Requires that all applicable staff are fully vaccinated by a vaccination against COVID-19 fully approved at this phase, unless granted an exemption. Staff that have completed a primary vaccination series by this date are considered to have met these requirements, even if they have yet to complete the 14-day waiting period required for full vaccination. Phase II is effective 60 days after the publication of the IFR in the Federal Register, which equates to a deadline of January 4, 2022.  

IFR facilities must track and securely document the COVID-19 vaccination status of each staff member. Significant detail regarding which vaccines and specific dosing regimens meet the definition of “primary vaccination series”—including those from other World Health Organization countries and non-FDA approved vaccines—is provided in the CMS rule.


CMS leaves it up to each IFR facility to determine how best to implement compliance with the various legal exemptions (e.g., allergies, religious exemptions) that may be applicable to the vaccine mandate and further provides that all vaccination exemption requests must be documented.

Enforcement and Compliance

Testing for COVID-19

The IFR does not require daily or weekly testing of unvaccinated individuals because healthcare worker vaccinations are instead required: “We have reviewed scientific evidence on testing and found that vaccination is a more effective infection control measure.” However, IFR facilities may exercise testing precautions voluntarily in addition to vaccination:

… nothing in this rule removes the obligation on providers and suppliers to meet existing requirements to prevent the spread of infection, which in practice means that these entities may also conduct regular testing alongside such actions as source control and physical distancing.

CMS is also seeking stakeholder feedback on this issue.

Vaccination Policies and Procedures

CMS requires that all IFR facilities develop and implement policies and procedures for vaccinating staff for COVID-19 subject to review by state surveyors and accreditation organizations. CMS has said that it intends to issue interpretive guidelines, including state survey and staff interview procedures, for assessing a facility’s compliance.

Enforcement Mechanisms

Enforcement of the IFR will occur through onsite compliance reviews by state survey agencies and accreditation organizations. Although CMS says that it will first work to bring a facility into compliance, the agency makes clear that it will apply its standard corrective action status levels to this review, including the issuance of “immediate jeopardy” notices.

Termination would only occur after a facility has been given the opportunity to make corrections. The CMS Frequently Asked Questions (FAQs) on the IFR make a distinction regarding penalties for types of entities, indicating that for nursing homes, home health agencies, and hospice (beginning in 2022), enforcement will include civil monetary penalties, denial of payment, and then termination from the Medicare and Medicaid programs as a final measure.

Duration, Legal Authority, and Challenges by States

CMS has said that it intends to retain the provisions of the IFR beyond the conclusion of the public health emergency (PHE), adding that it may deem these provisions permanent for CMS-certified facilities. The IFR highlights that it is not associated with or tied to the PHE declarations, nor is there a sunset clause.

The IFR is based on CMS’s authority to govern healthcare entities and certify them as safe for patients. CMS notes that the IFR is being issued pursuant to its authority established by US Congress under the Social Security Act to regulate healthcare facilities in Sections 1102 and 1871, and to publish rules and regulations. CMS further recognizes this authority does not extend to independent physicians/clinicians.

It is also clear that any pushback by states will be challenged, as CMS expects all facilities certified by the agency to fully comply with the IFR, citing its authority under the Supremacy Clause of the US Constitution that preempts state law to the contrary. We fully anticipate the federal authority component of this IFR will be challenged in court—especially given that 27 states have already filed lawsuits challenging the OSHA ETS.

Effective Dates

While the effective date of the IFR is November 5, 2021, compliance with the “primary vaccination series” is required to be implemented by January 4, 2022. To be assured consideration, comments must be received by CMS no later than 5 pm on January 4, 2021.


If you have any questions or would like more information on the issues discussed in this LawFlash, please contact any of the following Morgan Lewis lawyers:

Gregory N. Etzel
B. Scott McBride
Banee Pachuca
Sydney Reed Swanson

Washington, DC
Michele L. Buenafe
Sharon Perley Masling
Kathleen McDermott
Scott A. Memmott
Albert W. Shay
Jonathan Snare
Howard J. Young
Kaiser H. Chowdhry
Alana F. Genderson
Jacob J. Harper
Tesch Leigh West
Jonathan York

Mark B. Stein

Los Angeles 
Jennifer Zargarof

New York
Daniel Kadish

San Francisco
W. Reece Hirsch