Update: CMS and OSHA Release Federal Vaccine Mandates

On January 14, 2022, in response to the Court’s decision, CMS issued additional guidance for states where the mandate was previously blocked.  And, on January 20, 2022, CMS issued further guidance for Texas specifically, following the dismissal of the state’s pending legal challenge.  This guidance reiterates the prior guidance that CMS issued on December 28 for the states where the mandate was not previously blocked, except for revised compliance timelines.  CMS has also provided a state-by-state compliance timeline.

Regarding OSHA’s Occupational Exposure to COVID-19 ETS, 86 Fed. Reg. 32,376 (June 21, 2021) (the “Healthcare ETS”), on December 27, 2021, OSHA issued a statement, withdrawing the non-recordkeeping portions of the healthcare ETS.  However, the COVID-19 log and reporting provisions, 29 CFR sections 1910.502(q)(2)(ii), (q)(3)(ii)-(iv), and (r), remain in effect.  In addition, OSHA also noted that it will continue to enforce its General Duty Clause and standards and that “[c]ontinued adherence to the terms of the healthcare ETS is the simplest way for employers in healthcare settings to protect their employees’ health and ensure compliance with their OSH Act obligations.”

November 9, 2021: Consistent with the Biden Administration’s emphasis on the use of employer mandates to support COVID-19 vaccination efforts, on Friday, November 5, 2021, the Centers for Medicare & Medicaid Services (“CMS”) and the Occupational Safety and Health Administration (“OSHA”) instituted Federal vaccine mandates impacting roughly 100 million workers across the country.  CMS’s Omnibus COVID-19 Health Care Staff Vaccination Interim Final Rule, 86 Fed. Reg. 61,555 (“CMS Vaccination Rule”) and OSHA’s COVID-19 Vaccination and Testing Emergency Temporary Standard, 86 Fed. Reg. 61,402 (“Vaccination & Testing ETS”) are both immediately effective, but the implementation dates for each are phased in starting on December 6, 2021.  Most healthcare providers will be subject to the CMS Vaccination Rule, which modifies conditions of participation (“CoPs”), Conditions for Coverage (“CfCs”), and requirements for participation for 21 types of health care providers and suppliers.  In addition, many healthcare providers (including some not subject to the CMS Vaccination Rule) are subject to OSHA’s previously issued Healthcare ETS, 86 Fed. Reg. 32,376 (June 21, 2021).  Those providers and other employers that are exempt from OSHA’s Healthcare ETS but have more than 100 employees are subject to OSHA’s Vaccination & Testing ETS.  Because most providers are subject to both the CMS Vaccination Rule and OSHA’s earlier Healthcare ETS, we focus here on the CMS Vaccination Rule rather than the OSHA Vaccination & Testing ETS.

Interaction with State Laws and Legal Challenges.  Many healthcare providers are subject to State laws that either mandate vaccination and testing of healthcare workers (e.g., California and Massachusetts) or ban or limit certain workplace vaccination policies (e.g., Texas, Montana, and Arkansas).  Providers subject to State or local vaccination requirements that may be more stringent than but do not conflict with the Federal requirements, will be subject to both Federal and State requirements.

The CMS Vaccination Rule and OSHA Vaccination & Testing ETS, however, preempt inconsistent State and local laws, so a State prohibition on vaccination and testing mandates will not excuse non-compliance with applicable Federal requirements.  After the OSHA Vaccination & Testing ETS was released, challenges were immediately filed by some states, businesses, religious groups, and others before the Fifth Circuit and the Eighth Circuit.  On Saturday, November 6, 2021, a panel of the Fifth Circuit temporarily stayed the ETS, citing the potential for “grave statutory and constitutional issues with the mandate.”

Who’s Covered—Facilities.  The CMS Vaccination Rule amends CoPs, CfCs, and requirements for participation for following Medicare- and Medicaid-certified provider and supplier types:

• Ambulatory Surgical Centers (“ASCs”) (§ 416.51)
• Hospices (§ 418.60)
• Psychiatric residential treatment facilities (“PRTFs”) (§ 441.151)
• Programs of All-Inclusive Care for the Elderly (“PACE”) (§ 460.74)
• Hospitals (acute care hospitals, psychiatric hospitals, hospital swing beds, long term care hospitals, children’s hospitals, transplant centers, cancer hospitals, and rehabilitation hospitals/inpatient rehabilitation facilities) (§ 482.42)
• Long Term Care (“LTC”) Facilities, including Skilled Nursing Facilities (“SNFs”) and Nursing Facilities (“NFs”), generally referred to as nursing homes (§ 483.80)
• Intermediate Care Facilities for Individuals with Intellectual Disabilities (“ICFs-IID”) (§ 483.430)
• Home Health Agencies (“HHAs”) (§ 484.70)
• Comprehensive Outpatient Rehabilitation Facilities (“CORFs”) (§§ 485.58 and 485.70)
• Critical Access Hospitals (“CAHs”) (§ 485.640)
• Clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services (§ 485.725)
• Community Mental Health Centers (“CMHCs”) (§ 485.904)
• Home Infusion Therapy (“HIT”) suppliers (§ 486.525)
• Rural Health Clinics (“RHCs”)/Federally Qualified Health Centers (“FQHCs”) (§ 491.8)
• End-Stage Renal Disease (“ESRD”) Facilities (§ 494.30)

Other healthcare settings, including physician’s offices, assisted living facilities, group homes, religious nonmedical healthcare institutions, organ procurement organizations (“OPOs”), and portable x-ray suppliers are not subject to the CMS Vaccination Rule’s requirements.

Who’s Covered—Staff & Credentialing.  The Medicare- and Medicaid-certified providers and suppliers that are subject to the CMS Vaccine Rule (collectively “facilities”) must develop and implement COVID-19 vaccination policies and procedures for all covered staff, regardless of clinical responsibility or patient contact.  Covered staff includes all facility employees, licensed physicians and other providers, students, trainees, and volunteers, and all individuals who provide care, treatment, or other services for the facility and/or its patients, including those providing services under contract or other arrangements.  Individuals that provide telehealth or support services exclusively on a remote basis and who do not have direct contact with patients and other staff (e.g., fully remote telehealth or payroll services) are not subject to the rule’s vaccination requirements.

Notably, facility compliance with the CMS Vaccination Rule necessitates the vaccination (or appropriate exemption) of each physician and independent licensed practitioner that admits or treats patients in-person within the facility.  As such, medical staff credentialing functions may be impacted by the CMS Vaccination Rule.

What’s Required—Policies, Procedures, and Documentation for Vaccinations and Exemptions. The CMS Vaccination Rule directs facilities to develop and implement policies and procedures to ensure that their employees, licensed practitioners, students, trainees, and volunteers, and others that provide any care, treatment, or other services for the facility or its patients are vaccinated for COVID-19, as well as a process for requesting exemptions.  Importantly, these policies and procedures must include at least the following components:

• a process to ensure that, prior to staff providing any care, treatment, or other service for the facility, staff have received, at a minimum, a single-dose COVID-19 vaccine, or the first dose of the primary vaccination series for a multi-dose COVID-19 vaccine, except for those staff who are exempted, have a pending request for exemption, or for whom vaccination must be temporarily delayed;
• a process to ensure that all staff are fully vaccinated for COVID-19, other than exempted staff or in situations where vaccination must be temporarily delayed for clinical reasons;
• a process for staff to request a vaccination exemption based on an applicable Federal law;
• a process to ensure the implementation of additional precautions for all staff who are not fully vaccinated;
• contingency plans for staff who are not fully vaccinated for COVID-19; and
• a process to track and securely document COVID-19 vaccination information, including (1) the vaccination status of all facility staff (including booster doses), (2) the vaccination status of staff for whom vaccination must be temporarily delayed as recommended by the CDC, and (3) information provided by exempted staff.

COVID Testing is Not a Substitute.  Notably, the CMS Vaccination Rule does not allow for testing as an alternative to vaccination.  Facilities may voluntarily institute testing requirements alongside other infection prevention measures.  LTC facilities, however, must continue to comply with the COVID-19 testing requirements set forth 42 C.F.R. § 483.80(h).  In addition, when applicable, the OSHA Vaccination & Testing ETS includes testing requirements.

Vaccination Documentation.  Proof of vaccination might include a Centers for Disease Control and Prevention (“CDC”) COVID-19 vaccination record card (or legible photograph), documentation from a provider or electronic health record, a state immunization information system record, or a reasonable equivalent for individuals vaccinated outside the United States.  Facilities have the flexibility to choose appropriate tracking tools, but the CMS Vaccination Rule notes that the CDC has a staff vaccination template tool that can be used.

Exemption Information Collected.  Where staff members are exempted from vaccination for medical reasons, documentation must support the request for medical exemption and confirm recognized clinical contraindications to each authorized COVID-19 vaccine.  This documentation must be signed and dated by a licensed practitioner (other than the individual seeking exemption) acting within his or her scope of practice and must include a recommendation that the staff member be exempted from the vaccination requirements based on the recognized clinical contraindication.  The CMS Vaccination Final does not similarly identify information that must be obtained to support a religious exemption, but directs facilities to the Equal Employment Opportunity Commission’s (“EEOC”) Compliance Manual on Religious Discrimination and the Safer Federal Workforce Task Force’s template religious exemption request form.

As a reminder, HIPAA’s Privacy Rule does not apply to workforce members’ records, including vaccine documentation, held by covered entities and business associates acting in their capacity as employers. It also generally does not govern what information may be requested from workforce members as part of the terms and conditions a covered entity or business associate may impose on the workforce, including the ability to require workforce members provide vaccine documentation. (See these FAQs issued by OCR concerning “HIPAA, COVID-19 Vaccination, and the Workplace.”) However, providers are still obligated to keep all vaccine documentation records confidential and stored separately from personnel files, pursuant to the requirements of the Americans with Disabilities Act (“ADA”) and the Rehabilitation Act.

What Counts as Fully Vaccinated.  To be considered fully vaccinated, staff must have completed the primary series for the vaccine, even if they have not completed the 14-day waiting period required for full vaccination.  This would generally consist of two doses of either the Pfizer-BioNTech or Moderna COVID-19 vaccine or a single dose of the Janssen (Johnson & Johnson) COVID-19 vaccine, but not any booster doses.  Some staff may have received vaccines abroad that are not approved or authorized by the Food and Drug Administration (“FDA”) or as part of a clinical trial.  If a staff member received the primary series of vaccine listed by the World Health Organization (“WHO”) for emergency use that is not licensed or authorized for emergency use by the FDA, the individual will still qualify as fully vaccinated under the rule.  In addition, if a staff member participated in a clinical trial and received an “active” vaccine candidate (not placebo) for which efficacy has been independently confirmed, no additional doses are required.

Vaccination Exemptions & Temporary Delays. The emergency regulations require that covered healthcare providers and suppliers must have a process in place through which staff may request an exemption from the COVID-19 vaccination requirements discussed herein based on an applicable Federal law, such as the ADA and Title VII of the Civil Rights Act of 1964.  Examples of grounds for exemption include certain allergies, recognized medical conditions, or religious beliefs, observances, or practices.  In addition to providing a process for requesting exemptions, the CMS Vaccination Rule reminds providers and suppliers that employers may also be required to “provide appropriate accommodations, to the extent required by Federal law, for employees who request and receive exemption from vaccination because of a disability, medical condition, or sincerely held religious belief, practice, or observance.”  The rule also notes that providers and suppliers, while granting any such exemptions (or accommodations), must still ensure that they are minimizing the risk of transmission of COVID-19 to at-risk individuals.

For some individuals, COVID-19 vaccination may be temporarily delayed due to clinical precautions and considerations and pursuant to CDC recommendations.  These include individuals with acute illness secondary to COVID-19 and individuals who received monoclonal antibodies or convalescent plasma for COVID-19 treatment.  Vaccination of these individuals can properly be temporarily delayed as recommended by the CDC.

Enforcement—Survey & Certification.  CMS will enforce the Vaccination Rule through the state survey and certification process.  During recertification and complaint surveys, surveyors will review the facility’s plan for vaccinating, plan for providing exemptions and accommodations, and process for tracking and documenting staff vaccination status.  Surveyors will review records regarding the number of COVID-19 cases at a facility and staff vaccination status or exemptions, and will interview staff to verify their vaccination status.  CMS will issue interpretive guidelines to state survey agencies regarding survey procedures.  In addition, accrediting organizations like The Joint Commission must update their policies to assess for compliance during accreditation surveys.

Facilities not in compliance with the CMS Vaccination Rule will be cited based on the severity of the noncompliance.  Although CMS’s “goal is to bring health care providers into compliance,” CMS could impose remedies including civil monetary penalties, denial of payment, and termination from the Medicare program.

Implementation Timeline & Comments.  The CMS Vaccination Rule contains two implementation deadlines for Medicare- and Medicaid-certified providers and suppliers that are subject to the rule:

• Phase 1. By December 6, 2021, facilities must develop and implement COVID-19 vaccination policies and procedures and all covered staff must receive their at least one dose of a COVID-19 vaccine.
• Phase 2. By January 4, 2022, covered staff must be fully vaccinated against COVID-19.

As an interim final rule, the CMS Vaccination Rule will expire in three years unless CMS finalizes it after considering comments and other factors.  CMS is taking comments on the interim final rule until January 4, 2022.  The rule states that it is not limited to the current COVID-19 public health emergency and may even remain in place after it ends.

***

For further information, please contact Katrina Pagonis, Mark Reagan, Andrea Frey, or Erin Sclar in San Francisco, Alicia Macklin or Nina Marsden in Los Angeles, Catherine Wicker in San Diego, Kelly Carroll or Monica Massaro in Washington, D.C., or any other member of our Hooper, Lundy, and Bookman team.