UPDATE:

On November 16, 2021, 12 additional states – Montana, Alabama, Arizona, Georgia, Idaho, Indiana, Louisiana, Mississippi, Oklahoma, South Carolina, Utah and West Virginia – filed a complaint in the US District Court for the Western District of Louisiana (November 16 Complaint) requesting that the Interim Final Rule with comment period (IFR) that put in place the vaccination mandate applicable to certain covered health care facilities and staff (the CMS Mandate) be declared arbitrary and capricious, contrary to law and in excess of CMS’ statutory authority.

The November 16 Complaint sets forth many of the same principles as the prior opposition in the Eastern District of Missouri, specifically, the November 16 Complaint requests for the CMS Mandate to be set aside because it:

1. exceeds CMS’ statutory authority under the Administrative Procedure Act;

2. violates Title 18 of the Social Security Act, by authorizing CMS to exercise “supervision and control” over healthcare institutions’ employment, administration, and operational practices.

3. failed to proceed through notice and comment rulemaking;

4. failed to be presented to Congress to provide an opportunity to pass a resolution disapproving the rule and to allow the Government Accountability Office to issue a report;

5. represents an arbitrary and capricious agency action that fails to examine all relevant factors, including but not limited to how mandating vaccines may harm patients by exacerbating staff shortages and failing to consider alternative solutions;

6. violates 42 U.S.C. § 1395z, which requires consultation with State agencies and other organizations in order to develop conditions of participation for providers of services;

7. violates 42 U.S.C. § 1302 by failing to establish a rule that impacts a substantial number of small rural hospitals without first submitting the proposed rule for public comment and a regulatory impact analysis;

8. places an unconstitutional condition on states’ receipt of federal funds by jeopardizing Medicare and Medicaid reimbursements;

9. commandeers State officers to administer federal law; and

10. usurps States’ rights in violation of the Tenth Amendment to the U.S. Constitution

Requested Relief

The twelve states request a preliminary and permanent injunction and for the compliance period to be tolled until judicial review can be granted.

Next Steps

Unless and until an injunction is granted, the December 6, 2021, Phase I compliance date identified in the IFR is rapidly approaching. Health care providers and suppliers affected by the CMS Mandate should continue to prepare for implementation while watching for any actions in relation to this suit that may result in a delay of the anticipated compliance timeline.

UPDATE:

On November 10, 2021, ten states — Missouri, Nebraska, Arkansas, Kansas, Iowa, Wyoming, Alaska, South Dakota, North Dakota and New Hampshire (the Plaintiff States) filed a complaint in the US District Court for the Eastern District of Missouri requesting that the Interim Final Rule with comment period (IFR) that put in place the vaccination mandate applicable to certain covered health care facilities and staff (the CMS Mandate) be set aside as an “unlawful agency action under the Administrative Procedure Act” (APA), 5 USC §§ 701–706. This challenge comes on the heels of a similar action by attorneys general against the OSHA Emergency Temporary Standard, which mandates vaccination or testing for employees of companies with 100+ employees (OSHA ETS).

Both the IFR and the OSHA ETS were released on November 5, 2021, as part of the Biden Administration’s multi-prong, “whole of government” approach to combatting the COVID-19 pandemic.

The Complaint

The nine-count complaint filed by the attorneys general representing each of the Plaintiff States alleges procedural and substantive violations that the government’s issuance of the IFR and the imposition of the CMS Mandate results in:

1. substantive violation of the APA resulting in an arbitrary and capricious action not in accordance with law;

2. substantive violation of the APA resulting in an action in excess of authority and not in accordance with law;

3. procedural violations of the APA regarding notice and comment;

4. procedural violations of the Social Security Act regarding notice and comment;

5. violation of 42 U.S.C. § 1395z, which requires consultation with State agencies and other organizations in order to develop conditions of participation for providers of services;

6. violation of 42 U.S.C. § 1302, which requires preparation of a regulatory impact analysis for rulemaking;

7. unconstitutional exercise of federal spending powers by imposing a condition on the grant of federal funds;

8. violation of the “Anti-Commandeering Doctrine,” which provides that Congress cannot directly compel state political branches to perform regulatory functions on the federal government’s behalf; and

9. violations of the 10th Amendment of the U.S. Constitution and “federalism”.

Requested Relief

The Plaintiff States seek to have the CMS Mandate set aside, via preliminary and permanent injunction and to further preliminarily and permanently enjoin CMS from issuing a similar mandate without complying with notice and comment procedures under the APA and Social Security Act.

Next Steps

Given the short time until the December 6, 2021, Phase I compliance date identified in the IFR, health care providers and suppliers affected by the CMS Mandate should continue to prepare for implementation while watching for any actions in relation to this suit that may result in a delay of the anticipated compliance timeline.

The Centers for Medicare and Medicaid Services (CMS) published an interim final rule with comment period (IFR) on November 5, 2021, that implements the Biden administration’s previously announced vaccine mandate for healthcare facilities. The expansive IFR applies to more than a dozen types of healthcare providers and suppliers (facilities), affects more than 10 million healthcare staff (defined broadly), and carries an anticipated potential price tag in excess of $1.3 billion dollars for the first year of implementation.

IN DEPTH

Overview

The IFR focuses on facilities’ implementation of three key requirements, namely a process or plan to vaccinate all eligible staff, account for federally recognized exemptions from vaccination, and track and document staff vaccination. By December 5, 2021 (30 days after publication of the IFR), these processes and plans must be in place, and all eligible staff at covered Facilities must have received their first vaccine dose (for two-dose vaccines, or single dose of a one-dose vaccine) or have requested or been granted an exemption, and implemented the policies, procedures and recordkeeping controls required by the IFR. No later than January 4, 2022 (60 days after publication of the IFR), such staff must be “fully vaccinated”, obtained an exemption, or have a CDC-approved reason to temporarily delay vaccine administration. For purposes of the 60-day requirement, individuals that have received their second vaccine dose (or a single dose of a one-dose vaccine) will be considered compliant.

• Federally recognized exemptions from vaccination (i.e., medical contraindications or religious beliefs) are permissible.

• State-specific exemptions are not permissible. CMS states that its federal regulatory changes preempt contradictory state laws.

• Prior infection with SARS-CoV2 and/or the presence of antibodies indicating prior infection with SARS-CoV2 (sometimes referred to as infection-conferred immunity), is not recognized as a basis for exemption from the vaccination requirement.

• There is no “testing option” available as an alternative to vaccination.

• Facilities must implement mitigations that accommodate staff who remain unvaccinated (i.e., staff that receive a federally recognized exemption) while reducing the risk of COVID-19 transmission.

Facilities must also track and document evidence of staff vaccination in a manner that preserves the information’s privacy and security.

Healthcare providers and suppliers must understand the answers to three key questions in order to assess the impact of the IFR on their operations and compliance:

• What types of providers and suppliers are subject to compliance with the IFR?

• What does the IFR require of facilities?

• How will the IFR will be implemented and enforced?

Providers and Suppliers Subject to the IFR

CMS has broad authority to impose health and safety regulations as part of the Conditions of Participation, Conditions for Coverage or Requirements for Participation applicable to certain providers and suppliers enrolled in Medicare and/or Medicaid. Provider and supplier types that are subject to the IFR include the following:

1. Ambulatory surgical centers

2. Hospices

3. Psychiatric residential treatment facilities

4. Programs of All-Inclusive Care for the Elderly organizations

5. Hospitals (acute care hospitals, psychiatric hospitals, hospital swing beds, long term care hospitals, children’s hospitals, transplant centers, cancer hospitals and rehabilitation hospitals/inpatient rehabilitation facilities)

6. Long term care facilities, including skilled nursing facilities and nursing facilities

7. Intermediate care facilities for individuals with intellectual disabilities

8. Home health agencies

9. Comprehensive outpatient rehabilitation facilities

10. Critical access hospitals

11. Clinics, rehabilitation agencies and public health agencies as providers of outpatient physical therapy and speech-language pathology services

12. Community mental health centers

13. Home infusion therapy suppliers

14. Rural health clinics/federally qualified health centers

15. End-stage renal disease facilities.

Provider and Supplier Types Not Covered by the IFR

Other types of providers or suppliers of healthcare services are not directly covered by the IFR, generally because they are not subject to CMS regulations that impose health and safety requirements. However, as noted below, there may be an indirect application to individual providers who provide services to a covered Facility.

• Religious Nonmedical Healthcare Institutions. These providers do not provide medical items and services to patients, and any non-medical services provided to patients are not reimbursable by Medicare or Medicaid, placing them outside CMS regulatory authority.

• Organ Procurement Organizations (OPOs). Because OPOs routinely provide services to hospitals without any in-person interaction with patients or staff, they are exempt from the requirement. However, if OPO personnel do interact in person with hospital patients and staff, the IFR vaccine requirement would apply to such individuals. Any additional contractual requirements imposed by hospitals on OPOs as contractors would be outside of the purview of the IFR.

• Portable X-Ray Suppliers. Portable x-ray suppliers are not directly subject to the IFR. As with OPOs, however, if an arrangement with an entity subject to the IFR obligates that portable X-ray supplier personnel be vaccinated, then such requirement would be a matter of contract outside the purview of the IFR.

• Physician Offices. Physician offices are not subject to CMS health and safety regulations. However, physicians and other licensed independent providers who have admitting or treating privileges at a hospital or other facility subject to the IFR will need to comply with the vaccination requirements in order for the facility to comply with the IFR.

• Assisted Living Facilities, Group Homes and Similar Settings. Because CMS has no regulatory authority over these types of facilities, the IFR does not apply.

Other components of the federal COVID-19 vaccine mandates may apply (i.e., the Occupational Safety and Health Administration’s COVID-19 vaccination and testing emergency temporary standard (OSHA ETS) or federal contractor requirements), see recent OTS here.

Requirements for Covered Providers and Suppliers

Who Are “Staff”?

The IFR requires that covered facilities develop and implement policies and procedures under which all staff are vaccinated against COVID-19, including any individuals that perform their duties at any site of care or have the potential to contact anyone at the site of care (patients or other staff). “Staff” is defined broadly to include many categories of individuals, regardless of clinical responsibility, frequency of patient contact, whether services are provided in home or community settings, the duration of an individual’s tenure, or whether an individual has a contract or agreement with the covered facility. Specifically, the IFR identifies the following individuals as comprising “staff”:

• Facility employees

• Administrative staff

• Facility leadership

• Volunteer or other fiduciary board members

• Housekeeping and food services

• Licensed practitioners

• Students and trainees

• Volunteers

• Individuals who provide care, treatment or other services for the facility and/or its patients under contract or other arrangement (including hospice and dialysis staff, physical therapists, occupational therapists, mental health professionals, social workers and portable x-ray suppliers).

Limited exceptions to “staff” classification described in the IFR include:

• Individuals performing 100% telework (i.e., individuals who do not come to the facility or interact with facility staff or patients)

• “One-off” non-healthcare vendors, volunteers and professionals (e.g., annual elevator inspectors)

• Individuals performing services exclusively off-site (e.g., accounting or auditing firms)

• Individuals who infrequently enter a facility or site of care for limited, specific purposes and for a limited amount of time (e.g., delivery or repair personnel).

Facilities are encouraged to extend the vaccination requirement beyond this list as they deem appropriate. Accordingly, a facility could elect to extend the vaccination requirement to the categories CMS has acknowledged as exceptions.

Vaccination Requirement

By December 5, 2021 (30 days after the IFR is published), all eligible staff at covered facilities must have received their first vaccine dose (for two-dose vaccines, or single dose of a one-dose vaccine) or requested an exemption, and implemented the policies, procedures and recordkeeping controls required by the IFR. No later than January 4, 2022 (60 days after publication of the IFR), such staff must be “fully vaccinated”, meaning for purposes of the IFR that they have received their second vaccine dose (or a single dose of a one-dose vaccine) obtained an exemption, or have a CDC-approved reason to temporarily delay vaccine administration. Federally recognized exemptions from vaccination (medical or religious exemptions) are permitted, but facilities are cautioned to evaluate exemption requests with care and within the boundaries of the federal requirements for exemptions. The IFR does not provide the option for facility staff to undergo COVID-19 testing in lieu of vaccination, and does not recognize infection-conferred immunity (i.e., evidence of past COVID-19 infection or the presence of antibodies to SARS-CoV-2) as an alternative to vaccination.

Policies and Procedures

By December 5, 2021 (30 days after the IFR is published), facilities must also have in place policies and procedures that address several infection control components, including:

• A process to ensure that applicable staff are fully vaccinated in accordance with the IFR

• Implementation of appropriate precautions to mitigate the spread of COVID-19 for any staff who are not required to be fully vaccinated

• A plan for how the facility will track the vaccination status of staff, including any boosters or staff for whom vaccinations must be delayed

• A plan for how the facility will track which staff are clinically contraindicated against obtaining a particular COVID-19 vaccine and a provider’s signed explanation for the contraindication

• Contingency plans for staff who are not fully vaccinated.

Enforcement of the IFR Requirements

The requirements for facilities as set forth in the IFR will be subject to enforcement through the survey and certification process applicable to the facilities. State agencies (i.e., departments of health) acting as agents of CMS routinely survey facilities in response to complaints or during recertification surveys. Such surveys will now include compliance with vaccination policies and procedures, an assessment of COVID-19 cases over the preceding four weeks, and a list of staff vaccination status. Accrediting organizations such as The Joint Commission and the Accreditation Association for Ambulatory Health Care also will be required to include compliance with the requirements in their accreditation standards.

Surveys that identify noncompliance will place the involved facility in a survey cycle that will require corrective action and, for some facility types, the threat of civil monetary penalties and denials of payment as already exist under applicable federal regulations. Timelines for coming into compliance will vary depending upon the severity of the noncompliance identified. The most significant “immediate jeopardy” findings that indicate serious noncompliance and significant risk to patients will result in a 23-day track for termination of the facility’s provider agreement. Other less severe findings (i.e., at a minor noncompliance “standard” or more substantial “condition” level) will provide a longer termination track and more time to come into compliance.

CMS has stated that it views facility termination as a last resort and that it anticipates providing facilities with opportunities to come into compliance before termination.

Policy Considerations

CMS issued these requirements as an IFR rather than through its normal notice and comment rulemaking process, meaning that it came into effect without the need for further modification or changes. CMS primarily justifies this action based on the public health emergency and the agency’s use of IFRs to implement numerous other COVID-19 policies.

Given that the IFR requirements impact many policy issues, specifically healthcare workforce shortages, and carry potentially significant enforcement penalties for certain providers, stakeholders are already questioning CMS’s process and the approach taken in the IFR. Some providers and suppliers have conveyed that CMS’ approach is dismissive of “real world” concerns, especially around staffing in an already-stressed staffing environment. In particular, stakeholders are concerned about the ways in which the broad scope and enforcement mechanisms, and the unknown impacts, may affect their operations.

Broad Scope and Enforcement Mechanisms

Initially, the Biden administration issued vaccine requirements only for nursing homes, finding that this care setting had a large number of COVID-19 infections and high mortality rates. The administration quickly pivoted to implementing vaccine mandates more broadly, however, with the new CMS rule applying to a wide range of Medicare and Medicaid certified healthcare facilities. Despite the significant shift, the IFR generally takes a one-size-fits-all approach and does not differentiate based on facility type, size or resources. This approach conflicts with most CMS policy, which normally tailors requirements to the site of care and provides exceptions or alternatives for small or rural entities.

CMS acknowledges that it did not have to include termination of Medicare and Medicaid privileges, one of the strongest levers the agency could employ, as an enforcement mechanism. In the IFR, CMS outlines alternative approaches that it considered, such as reduced reimbursement rates, instead of threatening overall Medicare or Medicaid payment. Although CMS states that it does not intend to use this extreme measure in most cases and will allow for corrective action and time to remedy compliance, the agency is clearly sending a message that enforcement of the requirements will be taken seriously.

Unknown Impacts

Throughout the IFR, CMS assures facilities that the requirements should not impose significant additional burden. The agency points to the fact that it has already required reporting on vaccinations for healthcare providers in previous quality reporting measures and that it assumes that providers already have much of the policy infrastructure in place to track vaccination rates. The burden estimate, however, does not account for broader concerns that many stakeholders have about the mandate’s tie to healthcare workforce shortages, and the potential to worsen staff turnover rates.

CMS pushes back against this concern, pointing out that the mandate should level vaccine requirements across most healthcare employers. Although CMS seems skeptical that the IFR will increase shortages, CMS recognizes that quantifying staffing impacts is challenging, and that its estimates may ultimately fail to capture the total number of lost staff and the overall effects the IFR could have on the healthcare workforce. The IFR also does not address how the mandate’s phases will interact with potential staffing and other challenges facing the healthcare industry.

Key Takeaways

Healthcare providers and suppliers should promptly determine if they are a covered facility under the IFR. If they are a covered facility, they must identify what personnel are “staff” that would be required to evidence or initiate vaccination or obtain a federally recognized exemption in advance of the 30-day deadline. If they are not a covered facility, they should determine if one of the other components of the federal vaccine mandate, such as the federal contractor mandate or the OSHA ETS, apply to them.

Facilities covered by the IFR must also have implementing policies and procedures in place, and must establish mechanisms to document and track staff vaccination status. Such information must be tracked even for those staff exempt from vaccination (such as 100% telework staff).

Individuals who are “staff” but who may not have previously been viewed as part of a facility vaccination plan (such as volunteers, trainees and board members) will require education and outreach to ensure compliance.

Planning for enforcement activity by including the IFR components in survey readiness programs is advisable.

Stakeholders are anticipated to provide comments during the comment period, and may also seek changes to the IFR to account for policy considerations.

McDermott Will & Emery law clerk Kelsey Reinhardt also contributed to this article.