Earlier this month, on the same day the Department of Labor’s Occupational Safety and Health Administration (OSHA) issued its COVID-19 Vaccination and Testing Emergency Temporary Standard (ETS), the Centers for Medicare & Medicaid Services (CMS) issued its Interim Final Rule (the CMS Rule) regarding its new COVID-19 vaccination requirements. For a more detailed analysis of the CMS Rule, see our recent blog.
While OSHA’s ETS has stolen the thunder in recent L&E news (see here and here), employers should take note that the CMS Rule goes much further than the ETS in that, among other items detailed herein, it is a vaccine mandate, versus a vaccine or testing mandate. Health care companies that are subject to the CMS Rule, and which would otherwise be subject to the ETS, may not also be required to comply with OSHA’s ETS. However, comments from CMS, that the two rules are meant to be complementary, calls into question whether health care companies regulated by the CMS Rule (but otherwise subject to the ETS) should consider the OSHA ETS as a floor of compliance when the CMS Rule is silent, rather than as entirely inapplicable. For those directly or indirectly regulated by the CMS Rule, it contains several noteworthy differences detailed herein, including the aforementioned vaccine mandate with no option for testing in lieu of vaccination. This article addresses the requirements for health care employers covered by the CMS Rule.
Applicability of the CMS Rule
-
The CMS Rule applies to certain Medicare- and Medicaid-certified providers subject to conditions of participation, conditions of coverage, and/or requirements for participation, including hospitals, ambulatory surgery centers, hospices, psychiatric residential treatment facilities, PACE programs, long-term and intermediate care facilities, home health agencies, comprehensive outpatient rehabilitation facilities, critical access hospitals, clinics, rehabilitation agencies, public health agencies as providers of certain therapy services, community mental health centers, home infusion therapy suppliers, rural health clinics, federally qualified health centers, and end-stage renal disease facilities, regardless of the number of employees.
-
Coverage of the CMS Rule is expansive. It includes not only employees but students, people in training, volunteers, contract workers/vendors (such as housekeepers and food service providers), and physicians with hospital privileges, among others, regardless of clinical responsibility or patient contact. Vaccination is required even for offsite workers who come in contact with another worker who goes onsite. Thus, even if not directly subject to the CMS Rule, to avoid interruptions in work employers with workers onsite at a regulated facility may need to determine how they will ensure compliance among their workers.
-
The CMS Rule does not apply to individuals who provide remote services full time (that is, 100% of their time must be remote from sites of patient care and remote from other staff who travel to, or work at, sites of care) such as fully remote telehealth or payroll services.
-
Health care employers not subject to Medicare survey and certification, such as physician group practices, private practice physical therapy groups, pharmacies, and laboratories, among many others, are not covered by the CMS Rule but may still be subject to other state or federal COVID-19 vaccination requirements, such as those issued by OSHA, and may still be indirectly impacted by the CMS Rule if any of their workers go onsite at facilities regulated by the CMS Rule.
Requirements
-
The CMS Rule requires covered employers to develop and implement policies and procedures under which all employees (and non-employees, as mentioned above) are vaccinated for COVID-19 by December 6, 2021.
-
There is no option for employers to allow eligible and covered workers to undergo regular testing in lieu of vaccination.
-
All vaccine documentation must be kept confidential and stored separately from an employer’s personnel files, pursuant to the Americans with Disabilities Act (ADA) and the Rehabilitation Act.
-
The CMS Rule preempts any inconsistent state or local laws that ban or limit an employer’s ability to require vaccination, masks, or testing.
Timeline
-
Phase 1 - By December 6, 2021:
-
Develop a process or plan for (1) vaccinating workers, (2) evaluating accommodation requests, and (3) tracking and securely documenting primary vaccinations, boosters, and requests for accommodation, the decision on each request, and any accommodations provided.
-
All covered workers must receive at least a first dose of the primary vaccination series for a multi-dose COVID-19 vaccine or must have requested or been granted an accommodation to the vaccination requirement.
-
-
Phase 2 – By January 4, 2022:
-
All covered workers, except those who have been granted an accommodation, must have completed the primary series for the vaccine (i.e., they must have received the Johnson & Johnson vaccine or the first and second doses of the Pfizer or Moderna vaccine). However, they need not have completed the entire 14-day waiting period required for full vaccination by this deadline.
-
Medical and Religious Accommodation Requests
Under the ADA and Title VII, workers who cannot be vaccinated or tested because of an ADA disability, medical condition, or because of sincerely held religious beliefs, practices, or observances may in some circumstances be granted an exemption under the CMS Rule. The EEOC recently updated its guidance on workplace vaccine issues in advance of these mandatory vaccination rules. Here are the takeaways under the CMS Rule:
-
Employers must consider medical and religious accommodation requests. In doing so, employers must ensure that they minimize the risk of transmission of COVID-19 to at-risk individuals, in keeping with their obligation to protect the health and safety of patients. Neither the rule nor its FAQs provide examples of specific steps that employers can take to meet this requirement of minimizing risk of transmission and protecting patients, such as whether it would be sufficient to require accommodated/unvaccinated staff to undergo regular testing before coming onsite, wear masks, and socially distance themselves.
-
Medical accommodation requests must be supported by documentation signed and dated by a licensed practitioner (who is not the individual requesting the accommodation and who is acting within their respective scope of practice).
-
With respect to evaluating and responding to religious accommodation requests, the CMS Rule directs covered employers to the EEOC Compliance Manual on Religious Discrimination, as well as The Safer Federal Workforce Task Force's “request for a religious exception to the COVID-19 vaccination requirement” template, as an example.
Consequences for Noncompliance
-
The rule provides that CMS will issue interpretive guidelines, including survey procedures, and will advise and train state surveyors on how to assess a covered employer’s compliance with the new rule.
-
Covered entities that are cited for noncompliance may be subject to a variety of established enforcement remedies, depending on the severity of deficiency, including civil money penalties, denial of payment for new admissions, and even termination from the Medicare/Medicaid program. However, CMS’s list of FAQs provides that termination would generally occur only after providing a facility with an opportunity to make corrections and come into compliance.
How to Submit Comments on the Proposed Rule
While those affected by the CMS Rule have 60 days to submit comments, the CMS Rule took effect immediately under an expedited process due to the exigent circumstances of the pandemic, and covered entities are expected to take action to comply before the 60-day comment period expires.
For those wishing to submit comments, CMS is soliciting comments until 5:00 p.m. on January 5, 2022. Anyone may submit comments – anonymously or otherwise – via electronic submission at this link. When commenting, refer to file code CMS-3415-IFC in your submission. Alternatively, commenters may submit comments by mail to:
-
Regular Mail: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-3415-IFC, P.O. Box 8016, Baltimore, MD 21244-8016.
-
Express Overnight Mail: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-3415-IFC, Mail Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850
If submitting via mail, please be sure to allow adequate mailing time before the date comments are due to CMS.
The legal landscape and interpretations of these new vaccine requirements are developing rapidly, including outright court challenges to both the CMS Rule and ETS. Also, several states, including Florida, have indicated plans to take legislative action that could create conflict between state and federal laws, leaving health care companies in the middle to determine how best to comply with potentially conflicting laws or face penalties. The outcome of the litigation and legislative efforts remains uncertain. Thus, health care providers should assume for the time being that the CMS Rule and ETS will remain in place and take steps to comply. Foley attorneys are closely monitoring development and will be available as questions arise. Employers should contact counsel to make sure they are prepared to implement applicable requirements and avoid potential future penalties.
© 2025 Foley & Lardner LLP