On Nov. 5, 2021, the Centers for Medicare & Medicaid Services (CMS) issued an interim final rule with comment period (IFC), requiring Medicare and Medicaid-certified providers and suppliers to establish COVID-19 vaccination requirements for all covered staff.

Part of the Biden-Harris Administration’s path out of the pandemic, the IFC applies to more than 17 million workers at approximately 76,000 health care facilities, including hospitals and long-term care facilities.

This article provides an overview of the IFC’s provisions, including the rationale and basis for the IFC, the facilities that are covered, the types of staff that are covered, any exemptions, and applicable dates and penalties.

IFC: Rationale and Basis

Broad statutory authority exists for the CMS health and safety regulations.

Sections 1102 and 1871 of the Social Security Act provide CMS with broad statutory authority to establish health and safety regulations for Medicare and Medicaid-certified providers and suppliers. These regulations are known as Conditions of Participation, Conditions for Coverage, or Requirements for Participation.¹

Vaccination is critical in the health care setting and ensures equitable outcomes.

CMS emphasizes that the IFC is justified in order to combat the ongoing public health emergency. Vaccination is the most effective method to stop the spread of COVID-19 in the health care setting, where breakthrough infections are most common.

To protect front line health care workers, reduce the risk of outbreaks of the disease, and to ensure adequate and equitable access to health care by the public, the IFC prioritizes staff vaccination. In particular, with COVID-19 having a disproportionate burden on Black and Latino Americans, equitable access to health care services and outcomes is advanced under the IFC’s vaccine requirements.

Vaccination is widely supported by the relevant health care community stakeholders.

The IFC is further warranted in response to stakeholder demand. Numerous national health care stakeholders have called for all health care employers and facilities to require that all their staff be vaccinated against COVID-19, including the American Medical Association, the American Nurses Association, the American Academy of Pediatrics, the Association of American Medical Colleges, and the National Association for Home Care and Hospice.²

Large nonprofit organizations, such as the AARP, have also publicly called for vaccine mandates. In addition, numerous health systems and health care employers nationwide have already implemented vaccine mandates, further demonstrating stakeholder need for the IFC.

Scope of Coverage: Facilities

Coverage is limited to Medicare and Medicare-regulated facilities.

Scope of coverage is facility-specific. The IFC applies only to Medicare and Medicaid-certified providers and suppliers that are regulated under Conditions of Participation, Conditions for Coverage, or, Requirements for Participation.

It does not apply to other health care entities, such as physician offices, that are not regulated by CMS. The IFC groups coverage into the following four categories:

• resident congregate care living facilities;

• acute care settings;​
  

• outpatient clinical care and services; and

• home-based care.

Covered facilities are specifically enumerated in the IFC.

The following providers and suppliers are covered:

• ambulatory surgical centers;

• hospices;

• psychiatric resident treatment facilities;

• programs of all-inclusive care for the elderly;

• hospitals (acute care hospitals, psychiatric hospitals, hospital swing beds, long-term care hospitals, children’s hospitals, transplant centers, cancer hospitals, and rehabilitation hospitals/inpatient rehabilitation facilities);

• long-term care facilities (including skilled nursing facilities and nursing facilities, generally referred to as nursing homes);

• intermediate care facilities for individuals with intellectual disabilities;

• home health agencies;

• comprehensive outpatient rehabilitation facilities;

• critical access hospitals, clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services;

• community mental health centers, home infusion therapy suppliers, rural health clinics and federally qualified health centers; and

• end-stage renal disease facilities.

Scope of Coverage: Individuals

Coverage broadly applies to all staff of a covered facility, even when staff works off-site.

If a facility is CMS regulated, the IFC broadly extends coverage to all current and new staff of the covered facility, regardless of frequency of patient contact or clinical responsibility.

This includes all facility employees, licensed practitioners, students, trainees, volunteers, and individuals who provide care, treatment, or other services for the facility, and/or its patients under contract or other arrangement. Administrative staff, facility leadership, volunteer or other fiduciary board members, housekeeping, and food services are also included.

Coverage is not limited to staff working in a formal clinical setting. All off-site staff are covered, such as those providing services in home or community settings, to ensure maximum patient protection. However, staff are not covered who telework full time – that is, staff who provide 100 percent of their services remotely and who do have any direct contact with patients or other staff.

While no 'de minimis' rule applies, covered facilities are not required to ensure vaccination of all 'one-off' third-party visitors.

In order to avoid confusion, the IFC specifically rejects a “de minimis” contact rule, such as individual staff members who may be present less frequently than once per week. As such, any individual who performs duties at a site of care or who has the potential to have contact with anyone at a site of care – including staff or patients – is subject to the IFC’s vaccine requirements.

While all staff are generally covered regardless of frequency of contact with individuals at the site of care, the IFC recognizes that it would be overly burdensome to require each provider and supplier to ensure vaccination of all individuals who enter the facility. As a result, “one-off” vendors, volunteers, and professionals providing “ad hoc non-health care services” are not included within the IFC’s required covered.

In making this assessment, facilities are to consider the frequency of presence, services provided, and proximity to patients and staff.

However, facilities are free to exceed the IFC’s coverage requirements and require vaccination of all individuals who enter the facility.

Minimum Requirements for Policies and Procedures

Certain covered staff may be subject to a medical or religious exemption.

Under the IFC, each facility must “develop and implement policies and procedures to ensure that all staff are fully vaccinated for COVID-19” unless subject to an exemption.

Generally under federal law, staff may be eligible for an exemption under equal employment opportunity statutes that prohibit discrimination. Therefore, individuals with a qualifying disability or medical contraindication may be exempt, as well as sincerely-held religious beliefs, customs, or practices that prevent the individual from receiving the vaccine.

Certain staff may also be eligible for delay in vaccination where indicated by the CDC, such as individuals with acute secondary illnesses, or individuals who receive monoclonal antibodies or convalescent plasma for COVID-19 treatment.

Full-vaccination status is defined as two weeks or more since receipt of the final vaccine.

Full vaccination is defined as two weeks or more since completion of a primary vaccination series for COVID-19 – either administration of a single-dose vaccine, or administration of all required doses of a multiple-dose vaccine.

Booster doses are not required to obtain full-vaccination status, but tracking and documenting staff who obtain boosters is required. FDA-licensed or authorized vaccines, such as the Pfizer, Moderna, and Janssen vaccines qualify, as well as any vaccine listed by the World Health Organization (WHO), although not FDA-approved. Both FDA-approved and WHO-listed vaccines qualify even if received outside of the United States.

Minimum requirements for policies and procedures include tracking and documentation.

Policies and procedures must also provide for tracking and securely documenting COVID-19 vaccination status, including booster doses. Policies and procedures must also provide a process by which staff may request an exemption.

These requests must be tracked and documented, as well as any accommodations granted. A process for ensuring implementation of additional infection control cautions must be included for all staff not fully vaccinated.

Where an exemption is requested as a clinical contraindication, the policies and procedures require that all supporting documentation be provided. The documentation must be signed and dated by a licensed practitioner acting within the scope of their practice. In addition, the documentation must specify the clinically contraindicated vaccine, the recognized clinical reasons for the contraindication, as well as a statement by the authenticating practitioner recommending exemption based on the recognized clinical contraindications.

Implementation Dates for Compliance and Penalties

Implementation consists of a two-phased approach.

As vaccination requires time, a two-phase implementation process is adopted.

Under phase 1, nearly all provisions of the IFC become effective 30 days after publication – Dec. 6, 2021.³ At a minimum, all staff must receive the first dose of the primary series or single-dose COVID-19 vaccine, or request a lawful exemption, prior to providing any care, treatment or other services for the facility and/or its patients.

Phase 2 is effective 60 days from publication – Jan. 4, 2022. By this date, all covered staff must either receive the final dose of a primary vaccination series or obtain an exemption or delay. While full vaccination is defined as 14 following the final dose, for Phase 2 compliance purposes, receipt of the final dose by Jan. 4, 2022 is sufficient.

Penalties for noncompliance include civil monetary penalties and termination of funding.

CMS will utilize state surveys agencies to conduct on-site compliance reviews. The goal of these reviews is to bring health care facilities into compliance.

Facilities will be cited for noncompliance using a three-level classification system, based on severity of deficiency. Health care facilities failing to return to compliance can face civil monetary penalties, denial of payment, or even termination from the Medicare and Medicaid program as a final measure.

This article was originally published on the State Bar of Wisconsin’s Health Law Blog. Visit the State Bar sections or the Health Law Section webpages to learn more about the benefits of section membership.

Endnotes

¹ The IFC is widely considered to be valid, but like other components of Biden-Harris administration’s vaccine-mandate, the IFC is subject to legal challenge. However, the IFC has not, as of this writing, been subject to any court-ordered stay of enforcement.

² See Major Health Care Professional Organizations Call for COVID-19 Vaccine Mandates for All Health Workers, American Society of Hematology, July 26, 2021.

³ CMS has confirmed that phase 1 compliance is not required until Monday, Dec. 6, as opposed to Sunday, Dec. 5.