CMS Issues Vaccine Mandate Rule for Health Care Providers

On September 9, 2021, President Biden issued a 6-step COVID Action Plan, and one step directed the Centers for Medicare and Medicaid Services (CMS) and Department of Health and Human Services (HHS) to mandate COVID-19 vaccination of all staff of most health care facilities accepting Medicare/Medicaid.

On November 4, 2021, CMS & HHS announced they have completed a 214-page interim final rule with public comment (IFC) as directed by the President, and it’s published in the Federal Register on Friday, November 5, 2021.


Health care providers and suppliers subject to this mandate must ensure all staff covered by the mandate:

  • Submit their documentation of a first dose of vaccine, sole dose of a 1-dose vaccine, or accommodation request within 30 days (since that falls on a Sunday, the deadline for this measure is Monday, December 6, 2021), and
  • Submit documentation of the second dose in a 2-dose primary series within 60 days (i.e., Tuesday, January 4, 2022).
Health Care Employers Subject to Mandatory Vaccination Rule
  • The vaccine mandate applies to the following entities accepting Medicare/Medicaid funds (in numerical order of the relevant Code of Federal Regulation sections being revised in this rule):
    • Ambulatory Surgical Centers (ASCs) (§ 416.51)
    • Hospices (§ 418.60)
    • Psychiatric residential treatment facilities (PRTFs) (§ 441.151)
    • Programs of All-Inclusive Care for the Elderly (PACE) (§ 460.74)
    • Hospitals (acute care hospitals, psychiatric hospitals, hospital swing beds, long term care hospitals, children’s hospitals, transplant centers, cancer hospitals, and rehabilitation hospitals/inpatient rehabilitation facilities) (§ 482.42)
    • Long Term Care (LTC) Facilities, including Skilled Nursing Facilities (SNFs) and Nursing Facilities (NFs), generally referred to as nursing homes (§ 483.80)
    • Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICFs-IID) (§ 483.430)
    • Home Health Agencies (HHAs) (§ 484.70)
    • Comprehensive Outpatient Rehabilitation Facilities (CORFs) (§§ 485.58 and 485.70)
    • Critical Access Hospitals (CAHs) (§ 485.640)
    • Clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services (§ 485.725)
    • Community Mental Health Centers (CMHCs) (§ 485.904)
    • Home Infusion Therapy (HIT) suppliers (§ 486.525)
    • Rural Health Clinics (RHCs)/Federally Qualified Health Centers (FQHCs) (§ 491.8)
    • End-Stage Renal Disease (ESRD) Facilities (§ 494.30)
  • This means the following are exempt:
    • “It does not directly apply to other health care entities, such as physician offices, that are not regulated by CMS.”
      • “Most states have separate licensing requirements for health care staff and health care providers that would be applicable to physician office staff and other staff in small health care entities that are not subject to vaccination requirements under this IFC.”
    • “We have not included requirements for Organ Procurement Organizations or Portable X-Ray suppliers.”
    • “We note that entities not covered by this rule may still be subject to other State or Federal COVID-19 vaccination requirements, such as those issued by Occupational Safety and Health Administration (OSHA) for certain employers.”
  • “Providers and suppliers may be covered by both the OSHA ETS and our interim final rule. Although the requirements and purpose of each regulation text are different, they are complementary.”
    • For example, those with 100+ employees under OSHA’s jurisdiction would need to ensure they provide the paid time off required under the OSHA ETS for getting vaccinated and recovering from vaccine side effects, require staff to promptly report a positive COVID-19 test/diagnosis, and remove staff with COVID-19 from the workplace as necessary.
Non-Excepted Employees Must Provide Proof or Submit Accommodation Request
  • “We believe it is necessary to require vaccination for all staff that interact with other staff, patients, residents, clients, or PACE program participants in any location, beyond those that physically enter facilities, clinics, homes, or other sites of care.”
    • “COVID-19 vaccination policies and procedures must apply to the following facility staff, regardless of clinical responsibility or patient contact and including all current staff as well as any new staff, who provide any care, treatment, or other services for the facility and/or its patients:
      • facility employees;
      • licensed practitioners;
      • students, trainees, and volunteers; and
      • individuals who provide care, treatment, or other services for the facility and/or its patients, under contract or other arrangement.
    • “In addition to facility-employed staff, many facilities have services provided directly, on a regular basis, by individuals under contract or arrangement, including hospice and dialysis staff, physical therapists, occupational therapists, mental health professionals, social workers, and portable x-ray suppliers. Any of these individuals who provide such health care services at a facility would be included in “staff” for whom COVID-19 vaccination is now required as a condition for continued provision of those services for the facility and/or its patients.”
    • “We are not limiting the vaccination requirements of this IFC to individuals who are present in the facility or at the physical site of patient care based upon frequency.”
    • Essentially, “any individual that performs their duties at any site of care, or has the potential to have contact with anyone at the site of care, including staff or patients, must be fully vaccinated to reduce the risks of transmission of SARS-CoV-2 and spread of COVID-19.”  This applies even to those “under contract or other arrangement” such as “board members, housekeeping and food services, and others.”
    • “Providers and suppliers are not required to ensure the vaccination of individuals who infrequently provide ad hoc non-health care services (such as annual elevator inspection [or delivery and repair personnel]), or services that are performed exclusively off-site, not at or adjacent to any site of patient care (such as accounting services).”
      • However, “we strongly encourage facilities, when the opportunity exists and resources allow, to facilitate the vaccination of all individuals who provide services infrequently.”
    • “Individuals who provide services 100 percent remotely, such as fully remote telehealth or payroll services, are not subject to the vaccination requirements of this IFC.”
  • “Consistent with CDC guidance, we consider staff fully vaccinated if it has been 2 or more weeks since they completed a primary vaccination series for COVID-19. We define completion of a primary vaccination series as having received a single-dose vaccine or all doses of a multi-dose vaccine. Currently, CDC guidance does not include either the additional (third) dose of an mRNA COVID-19 vaccine for individuals with moderately or severely immunosuppression or the booster dose for certain individuals who received the Pfizer-BioNTech Vaccine in their definition of fully vaccinated. Therefore, for purposes of this IFC, neither additional (third) doses nor booster doses are required.”
    • This can include the US vaccines, WHO’s list of authorized vaccines, and some clinical trial vaccines.
  • “In order to ensure that providers and suppliers are complying with the vaccination requirements of this IFC, we are requiring that they track and securely document the vaccination status of each staff member, including those for whom there is a temporary delay in vaccination, such as recent receipt of monoclonal antibodies or convalescent plasma. Vaccine exemption requests and outcomes must also be documented.”
  • “Examples of acceptable forms of proof of vaccination include:
    • CDC COVID-19 vaccination record card (or a legible photo of the card),
    • Documentation of vaccination from a health care provider or electronic health record, or
    • State immunization information system record.
    • If vaccinated outside of the U.S., a reasonable equivalent of any of the previous examples would suffice.”
  • “All medical records, including vaccine documentation, must be kept confidential and stored separately from an employer’s personnel files.”
  • “We require that providers and suppliers included in this IFC establish and implement a process by which staff may request an exemption from COVID-19 vaccination requirements based on an applicable Federal law. Certain allergies, recognized medical conditions, or religious beliefs, observances, or practices, may provide grounds for exemption.”
    • “With regard to recognized clinical contraindications to receiving a COVID-19 vaccine, facilities should refer to the CDC informational document, Summary Document for Interim Clinical Considerations for Use of COVID-19 Vaccines Currently Authorized in the United States, accessed at​vaccines/​covid-19/​downloads/​summary-interim-clinical-considerations.pdf .”
      • “For staff members who request a medical exemption from vaccination, all documentation confirming recognized clinical contraindications to COVID-19 vaccines, and which supports the staff member’s request, must be signed and dated by a licensed practitioner, who is not the individual requesting the exemption, and who is acting within their respective scope of practice as defined by, and in accordance with, all applicable State and local laws. Such documentation must contain all information specifying which of the authorized COVID-19 vaccines are clinically contraindicated for the staff member to receive and the recognized clinical reasons for the contraindications; and a statement by the authenticating practitioner recommending that the staff member be exempted from the facility’s COVID-19 vaccination requirements based on the recognized clinical contraindications.”
    • “We also direct providers and suppliers to the Equal Employment Opportunity Commission (EEOC) Compliance Manual on Religious Discrimination for information on evaluating and responding to such requests. While employers have the flexibility to establish their own processes and procedures, including forms, we point to The Safer Federal Workforce Task Force’s “request for a religious exception to the COVID-19 vaccination requirement” template as an example. This template can be viewed at​downloads/​RELIGIOUS%20REQUEST%20FORM%20-%2020211004%20-%20MH508.pdf .”
    • “In granting such exemptions or accommodations, employers must ensure that they minimize the risk of transmission of COVID-19 to at-risk individuals, in keeping with their obligation to protect the health and safety of patients. Employers must also follow Federal laws protecting employees from retaliation for requesting an exemption on account of religious belief or disability status.”
Written Policy
  • Applicable employers are required to either update or newly “develop and implement policies and procedures to ensure their staff are vaccinated for COVID-19 and track and [securely] maintain documentation of their vaccination status” in accordance with this IFC.
  • “We require through this IFC that all applicable providers and suppliers have a process for ensuring the implementation of additional precautions, intended to mitigate the transmission and spread of COVID-19, for all staff who are not fully vaccinated for COVID-19.”
    • This is particularly important for “PRTFs, RHCs/FQHCs, and HIT suppliers” who do not currently have infection prevention and control requirements imposed on them.
  • “Due to likely unforeseen circumstances, we require that providers and suppliers make contingency plans in consideration of staff that are not fully vaccinated to ensure that they will soon be vaccinated and will not provide care, treatment, or other services for the provider or its patients until such time as such staff have completed the primary vaccination series for COVID-19 and are considered fully vaccinated, or, at a minimum, have received a single-dose COVID-19 vaccine, or the first dose of the primary vaccination series for a multi-dose COVID-19 vaccine. This planning should also address the safe provision of services by individuals who have requested an exemption from vaccination while their request is being considered and by those staff for whom COVID-19 vaccination must be temporarily delayed, as recommended by the CDC, due to clinical precautions and considerations.”
    • “Contingency planning may extend beyond the specific requirements of this rule to address topics such as staffing agencies that can supply vaccinated staff if some of the facility’s staff are unable to work. Contingency plans might also address special precautions to be taken when, for example, there is a regional or local emergency declaration, such as for a hurricane or flooding, which necessitates the temporary utilization of unvaccinated staff, in order to assure the safety of patients. For example, expedient evacuation of a flooding LTC facility may require assistance from local community members of unknown vaccination status.”
Authority and Considerations
  • CMS & HHS acknowledge while this is a first-of-its-kind vaccine mandate from them, it’s common to have such mandates locally.
    • “We have not previously required any vaccinations, but we recognize that many health care workers already comply with employer or State government vaccination requirements (for example, influenza, and hepatitis B virus (HBV)) and invasive employer or State government-required screening procedures (such as tuberculosis screening).”
    • “Further, most of these individuals met State and local vaccination requirements in order to attend school to complete the necessary education to qualify for health care positions.”
  • “We understand that some states and localities have established laws that would seem to prevent Medicare- and Medicaid-certified providers and suppliers from complying with the requirements of this IFC. We intend, consistent with the Supremacy Clause of the United States Constitution, that this nationwide regulation preempts inconsistent State and local laws as applied to Medicare- and Medicaid-certified providers and suppliers.”
  • “In addition to preventing morbidity and mortality associated with COVID-19, the vaccines also appear to be effective against asymptomatic SARS-CoV-2 infection. A recent study of health care workers in 8 states found that, between December 14, 2020, through August 14, 2021, full vaccination with COVID-19 vaccines was 80 percent effective in preventing RT-PCR-confirmed SARS-CoV-2 infection among frontline workers.[218Emerging evidence also suggests that vaccinated people who become infected with Delta have potential to be less infectious than infected unvaccinated people, thus decreasing transmission risk.[219For example, in a study of breakthrough infections among health care workers in the Netherlands, SARS-CoV-2 infectious virus shedding was lower among vaccinated individuals with breakthrough infections than among unvaccinated individuals with primary infections.”[220]
  • “We also considered whether it would be appropriate to limit COVID-19 vaccination requirements to staff who have not previously been infected by SARS-CoV-2. There remain many uncertainties about as to the strength and length of this immunity compared to people who are vaccinated, and—in recognizing that—the CDC recommends that previously infected individuals get vaccinated. Exempting previously infected individuals would have potentially reduced benefits while reducing costs, both roughly in proportion to the number affected. It would have also, complicated administration and likely require standards that do not now exist for reliably measuring the declining levels of antibodies over time in relation to risk of reinfection. Because of current CDC guidance and understanding of relevant scientific findings, we found that it was not warranted to exempt previously infected individuals.”
  • “We further note that CMS already has and uses discretion in enforcement when inspectors find a violation. Termination of provider status is not normally an immediate consequence, as entities are typically given the opportunity to correct deficiencies.”
  • “We considered what standards to apply regarding proof of compliance with exemptions requests base on medical contraindications and religious objections. We decided to establish minimal compliance burdens for both categories of exemptions. This decision on the evidentiary standards could be revisited should an abuse problem arise on a significant scale. This may open the door to forged documents or false statements, and therefore validation of such claims raises administrative costs. Accordingly, we have allowed for relatively relaxed standards for verification in our administrative provisions and cost estimates but may reconsider in the future.”
  • “Finally, we considered requiring daily or weekly testing of unvaccinated individuals. We have reviewed scientific evidence on testing and found that vaccination is a more effective infection control measure. As such, we chose not to require such testing for now but welcome comment.”
  • “Depending on the future nature of the COVID-19 pandemic, we may retain these provisions as a permanent requirement for facilities, regardless of whether the Secretary continues the ongoing PHE [public health emergency] declarations. Therefore, this rulemaking’s effectiveness is not associated with or tied to the PHE declarations, nor is there a sunset clause. Pursuant to section 1871(a)(3) of the Act, Medicare interim final rules expire 3 years after issuance unless finalized. We expect to make a determination based on public comments, incidence, disease outcomes, and other factors regarding whether it will be necessary to conduct final rulemaking and make this rule permanent.”
  • “We will advise and train State surveyors on how to assess compliance with the new requirements among providers and suppliers…We will also provide guidance on how surveyors should cite providers and suppliers when noncompliance is identified. Lastly, providers and suppliers that are cited for noncompliance may be subject to enforcement remedies imposed by CMS depending on the level of noncompliance and the remedies available under Federal law (for example, civil money penalties, denial of payment for new admissions, or termination of the Medicare/Medicaid provider agreement).”

IMA will continue to monitor regulator guidance and offer meaningful, practical, timely information.

This material should not be considered as a substitute for legal, tax and/or actuarial advice. Contact the appropriate professional counsel for such matters. These materials are not exhaustive and are subject to possible changes in applicable laws, rules, and regulations and their interpretations.