CMS Vaccine Mandates on Participating Providers: How to Reconcile State Requirements

The rule can be found here. We provided an overview of this new rule in a separate alert, focusing on the rule’s labor and employment ramifications. 

Although the new regulation is issued as a final rule, CMS will accept comments for the next 60 days and may consider revisions to the rule based on those comments. Furthermore, CMS says it will issue interpretive guidelines for state survey agencies who will enforce the new rule.  

Essentially, CMS will require as a condition of participation that most Medicare and Medicaid certified providers and suppliers (listed below) ensure that their staff and others working at their locations or who render services to patients are fully vaccinated for COVID-19. These providers and suppliers must ensure that the necessary individuals have their first vaccine by December 6, 2021, and are fully vaccinated by January 4, 2022. CMS defines “fully vaccinated” as being two weeks or more since the completion of a primary vaccination series. This definition for fully vaccinated is consistent with the Centers for Disease Control (CDC) definition and also several states’ definitions, such as California’s. The CMS rule allows for exemptions to the vaccination requirement for religious or medical reasons. There is no provision for proof of testing in lieu of vaccination.

Many states’ health departments, such as California, have already mandated their health care entities to be fully vaccinated, unless an exemption applies. If your health care entity is in a state that has not yet imposed such a requirement, the health care entity will need to act swiftly to implement a vaccination program.

Regardless of what state a participating provider or supplier is located, it will need to take prompt actions to comply with the new rule. State health departments that already issued COVID-19 vaccination mandates for health care entities may not presently require written policies and procedures or record keeping that the new federal rule imposes. These actions include:

• Prepare or review a policy and procedure on COVID-19 vaccinations that comply with federal law and the new Infection Control condition of participation. The policy will need to describe those who are covered, the process for consideration of requests for a medical or religious exemption (including the tracking and secure documentation of the information provided by those staff who have requested an exemption, the provider’s decision on the request, and any accommodations that are provided) as well as the acceptable documentation and record keeping of vaccinations for each covered person as well as persons who subsequently join the provider.
• Collect and organize acceptable forms that document vaccination status – CDC cards, medical record documentation from licensed health care providers or Electronic Health Record (EHR), state immunization information system record, or equivalent documentation for vaccines obtained in foreign countries. 
• Determine if any staff are excluded because they work remotely and do not come into contact with any patients or other staff such as off-site telemedicine and telehealth services.

What Participating Medicare and Medicaid Providers and Suppliers Does the New Rule Cover?

• Ambulatory Surgical Centers (ASCs)
• Hospices
• Psychiatric residential treatment facilities (PRTFs) 
• Programs of All-Inclusive Care for the Elderly (PACE)
• Hospitals (acute care hospitals, psychiatric hospitals, long term care hospitals, children’s hospitals, hospital swing beds, transplant centers, cancer hospitals, and rehabilitation hospitals)
• Long Term Care (LTC) Facilities, including SNFs and NFs, generally referred to as nursing homes
• Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICFs-IID)
• Home Health Agencies (HHAs)
• Comprehensive Outpatient Rehabilitation Facilities (CORFs) 
• Critical Access Hospitals (CAHs)
• Clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services 
• Community Mental Health Centers (CMHCs)
• Home Infusion Therapy (HIT) suppliers
• Rural Health Clinics (RHCs)/Federally Qualified Health Centers (FQHCs)
• End-Stage Renal Disease (ESRD) Facilities

Why and Under What Authority Did CMS Issue This New Regulation?

In the introductory preamble of the rule, CMS goes through an exhaustive review of studies on COVID-19 and the transmission of the virus by and between staff at health care facilities and patients. Concluding that PPE alone is not as effective as vaccines in reducing transmission, CMS states that “health care staff vaccination rates remain too low in too many health care facilities and regions.”  MS also finds that “infection induced immunity is not equivalent to receiving the COVID-19 vaccine.”

All providers and suppliers who agree to participate in the Medicare and Medicaid programs also agree to comply with various Conditions of Participation set forth in federal regulations issued under statutory authority set forth in Title XVIII and Title XIX of the Social Security Act. The new rule creates an Infection Control condition of participation specific to a COVID-19 vaccination mandate. CMS considers the new rule necessary to protect patients and minimize unpredictable disruptions to operations and care when staff becomes infected with COVID-19.  

Compliance and Enforcement Concerns

Non-compliance with other CMS Conditions of Participation place the participating provider at risk for false claims act liability, civil monetary penalties, and exclusion from the Medicare program. Failure to comply with the new COVID-19 infection control rule place providers at the same risks despite the accelerated implementation date and the lack of guidance on how the new rule will be enforced.  

For example, it is possible that a participating provider may be held strictly liable for issuing a religious or medical exemption that the state surveying agency or CMS deems inappropriate. Similarly, if a provider unknowingly accepts false documentation of vaccination such as a forged CDC Vaccination Record, that provider may nevertheless be subject to sanctions. In the new rule, CMS says that one of the sanctions may be the denial of payment for new admissions. However, the denial of payment sanction does not seem to preclude false claims liability for payments already made during the period of non-compliance and possible whistleblower actions.

Takeaways and Suggestions

• Develop a plan to address how persons other than employees and volunteers will need to comply with the new requirement, including contractors providing clinical services or support, medical staff members, licensed health care professionals, and residents.
• Be prepared for an audit by the state surveying agency to verify you have a compliant policy and procedure as well as adequate records and documentation of vaccinations received by covered individuals.
• Integrate COVID-19 vaccination into your organization’s audit and compliance monitoring program.
• Consider submitting a comment to CMS regarding this interim final rule to request clarification or register concerns as it relates to implementation and enforcement.