CMS finalizes vaccination requirements for hospitals and most other healthcare settings

• Vaccination requirements for healthcare staff apply to hospitals and most other settings but not to physician practices.
• In cases of substantial noncompliance, a provider may be terminated from the Medicare and Medicaid programs.
• Enforcement will take place through the existing network of state survey agencies.

If hospital staff aren’t fully vaccinated by Jan. 4, their organization will be deemed noncompliant with Medicare and Medicaid regulations, according to a new rule handed down Thursday by CMS.

For staff receiving a two-dose vaccination, the first dose must be received by Dec. 6. Boosters and any doses beyond a primary vaccination series are not part of the requirements. Dec. 6 also is the deadline for facilities to install processes for vaccinating staff, tracking vaccinations and providing exemptions.

CMS said the requirements will apply to about 76,000 providers and cover over 17 million healthcare workers. Many municipalities and hospitals already have implemented their own set of comprehensive vaccine requirements, but the new rule is designed to ensure those requirements apply nationwide.

“The regulation will create a consistent standard within Medicare and Medicaid while giving patients assurance of the vaccination status of those delivering care,” the agency stated in a news release.

The American Hospital Association (AHA), which has expressed support for hospitals that choose to mandate vaccination of staff, seemed to back the new rule.

“Today’s vaccine-mandate regulations set clear expectations and streamline and simplify compliance requirements for healthcare providers,” Rick Pollack, AHA president and CEO, said in a written statement.

Described as a set of “emergency regulations,” the rule technically is an interim final rule with a 60-day comment period. However, the requirements take effect immediately, with any feedback to be considered in future rulemaking.

The gist of the rule was announced Sept. 9 as part of a sweeping set of vaccine mandates issued by the Biden administration. Thursday’s announcement provides details on how the policy will be implemented and enforced.

“We want to make sure that folks have time to understand the rules, that they have time to comply,” Jon Blum, CMS’s principal deputy administrator and COO, said during a stakeholder call. “We fully understand that this is brand new to some in the industry.”

Who’s covered by the rule

The requirements apply not only to onsite clinicians but also to nonclinical staff and any offsite staff who interact with patients, other staff members, residents, clients or Programs of All-Inclusive Care for the Elderly (PACE) participants. Full-time teleworkers are not covered by the rule as long as they don’t interact in person with patients or coworkers.

Covered facilities include most types of providers but not physician practices, which aren’t subject to CMS health and safety requirements. However, physicians with admitting privileges in a hospital must be vaccinated to ensure the facility is compliant.

Medical and religious exemptions for staff may be applicable under, respectively, the Americans with Disabilities Act and Title VII of the Civil Rights Act of 1964. CMS says exemptions should be granted only based on those statutes and not to anyone merely seeking “to evade vaccination.” Processes for documenting and evaluating exemptions should be in place at all facilities in accordance with federal law.

Proof of prior COVID-19 infection is not grounds for an exemption, the agency stated. In addition, there is no option to for staff to undergo regular testing as an alternative to getting vaccinated, with CMS citing “scientific evidence … that vaccination is a more effective infection control measure.”

CMS was vague in the rule about accommodations that a facility should implement for anyone who qualifies for a valid exemption. Additional precautions should be installed to mitigate the transmission and spread of the coronavirus, the agency stated, with the specifics left to the facility’s discretion.

Lee Fleisher, MD, chief medical officer with CMS and director of the agency’s Center for Clinical Standards & Quality, said accommodations could include testing, physical distancing, source control (e.g., clinically recommended masks or respirators) or assigning staff to non-patient-care areas where the exposure risk to patients is low.

Enforcement of the rule

The most severe penalty for noncompliance will be termination from the Medicare and Medicaid program, but CMS notes that such a penalty would apply only after the facility has a chance to make corrections.

If a provider receives an “Immediate Jeopardy” citation, indicating “a serious scope of noncompliance, failure of the provider to address deficiencies and close interaction with patients of unvaccinated staff,” termination would occur within 23 days if the problems are not immediately addressed.

Even in the case of serious breaches, more likely penalties include civil monetary charges or denial of payment.

“We want to work with facilities to bring them back into compliance as quickly as possible so that every person benefits from safe and quality care,” Fleisher said. “Termination is the absolute last resort. It is important to note, however, that we will not hesitate to use our full enforcement authority to protect the health and safety of patients when requirements are not met.”

CMS will coordinate enforcement with state survey agencies, which will conduct onsite compliance reviews during recertification and complaint surveys.

“While onsite, surveyors will review the facility’s COVID-19 vaccination policies and procedures, the number of resident and staff COVID-19 cases over the last four weeks and a list of all staff and their vaccination status,” CMS stated. “This information, in addition to interviews and observations, will be used to determine the compliance of the provider or supplier with these requirements.”

CMS clarified that although participation in mandatory Medicare pay-for-reporting programs already requires providers to report COVID-19 vaccination rates among healthcare personnel, the new regulations will be enforced through the established survey process. The new rule does not impose additional data-reporting requirements on providers beyond those that already were in place through previous emergency regulations.

Interaction with other rules

CMS stated that if a state law bars vaccine mandates, the new federal rule preempts any such prohibition based on the Supremacy Clause of the U.S. Constitution.

“Given the emergency situation with respect to the delta variant,” CMS wrote, “time did not permit usual consultation procedures with the States, and such consultation would therefore be impracticable. We are, however, inviting state and local comments on the substance as well as legal issues presented by this rule, and on how we can fulfill the statutory requirements for health and safety protections of patients if we were to exempt any providers or suppliers based on state or local opposition to this rule.”

A rule handed down Thursday by the Occupational Safety and Health Administration (OSHA) requires private employers with 100 or more employees to ensure all workers either get fully vaccinated or undergo weekly testing. CMS clarified that provisions in the healthcare-specific rule take precedence for any facilities that are subject to Medicare and Medicaid conditions of participation (meaning testing won’t be an alternative to vaccination).

The AHA commended the explanation “that hospitals will need to comply only with the CMS rule, eliminating unnecessary complexity in implementing vaccine mandates.”

An emergency temporary standard (ETS) previously issued by OSHA requires implementation of various protocols to prevent COVID-19 transmission in healthcare settings. The standard also requires employers to offer reasonable time off — and paid leave — for employees to get vaccinated and recover from side effects.

The new CMS rule and the previous ETS are meant to be complementary, CMS stated, with the latter more specifically focused on working conditions.