Compliance Today - May 2022

Rulemaking process

Unlike most interim final rules, the IFC was not subject to notice of proposed rulemaking, making it effective as of the date of publication (i.e., November 5, 2021). This means that there was no opportunity for stakeholders to submit comments to CMS prior to the IFC’s implementation. Instead, CMS accepted comments after the IFC was effective but before any of the deadlines imposed by the IFC had passed. The comment period closed on January 4. CMS chose to waive the notice period prior to implementing the IFC, citing a combination of factors, including the belief that any delay caused by the standard notice of proposed rulemaking would endanger the health and safety of patients and would be contrary to the public interest.^[2]

Additionally, although the IFC was issued in response to the ongoing public health emergency, it is not tied specifically to the public health emergency declaration. As a result, the IFC does not automatically terminate when the public health emergency ends, and CMS retains the option to make the IFC permanent based on public comments, incidence, disease outcomes, and other factors.^[3]

Litigation and implementation deadlines

In response to the IFC, two groups of states—24 in total—filed separate actions challenging the final rule in two U.S. district courts (the Western District of Louisiana and the Eastern District of Missouri).^[4] In response to the actions, both district courts entered preliminary injunctions preventing CMS from enforcing the IFC in those 24 states. The federal government appealed the injunctions to the Eighth and Fifth Circuit Courts of Appeals, and those injunctions were upheld by both courts. Ultimately, the disputes ended up before the Supreme Court, and on January 13, the Supreme Court stayed the injunctions issued by the lower courts, permitting CMS to enforce the IFC in those 24 states while the actions challenging the IFC proceed.^[5]

The Supreme Court noted that one of the functions of the Department of Health & Human Services is to ensure that healthcare providers serving Medicare or Medicaid patients “protect their patients’ health and safety,” and the IFC fell within that statutory authority. The Supreme Court concluded that the U.S. Department of Health & Human Services secretary “did not exceed his statutory authority” in requiring applicable providers and suppliers to ensure that their staff are vaccinated against COVID-19 in order to remain eligible to participate in Medicare and Medicaid.

Following the Supreme Court’s decision, one preliminary injunction applicable to the State of Texas remained in effect, but in response to the Court’s holding, the Texas case was dismissed without prejudice on January 19, 2022.^[6]

The injunctions preventing CMS from enforcing the IFC have been removed, and the IFC is now being enforced in every state. However, actions challenging the IFC are still ongoing in the district courts, and any actions or decisions by those courts could apply to the following states: Alabama, Alaska, Arizona, Arkansas, Georgia, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Mississippi, Missouri, Montana, Nebraska, New Hampshire, North Dakota, Ohio, Oklahoma, South Carolina, South Dakota, Utah, West Virginia, and Wyoming (collectively, Affected States). Providers in Affected States should remain aware of the status of those cases.

To whom does the IFC apply?

Specifically, the IFC mandates apply to the following Medicare and Medicaid certified providers and suppliers:^[7]

• Ambulatory surgical centers (ASCs);

• Hospices;

• Psychiatric residential treatment facilities (PRTFs);

• Programs of All-Inclusive Care for the Elderly (PACE);

• Hospitals (e.g., acute care hospitals, psychiatric hospitals, hospital swing beds, long-term care hospitals);

• Long-term care (LTC) facilities, including skilled nursing facilities (SNFs) and nursing facilities (NFs);

• Intermediate care facilities for individuals with intellectual disabilities (ICFs-IID);

• Home health agencies (HHAs);

• Comprehensive outpatient rehabilitation facilities (CORFs);

• Critical access hospitals (CAHs);

• Clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services;

• Community mental health centers;

• Home infusion therapy (HIT) suppliers;

• Rural health clinics (RHCs)/federally qualified health centers (FQHCs); and

• End-stage renal disease (ESRD) facilities.

The IFC does not apply to other healthcare entities, such as physician offices. However, physicians providing services to covered providers and suppliers may be subject to the IFC.

Broad definition of ‘staff’

The IFC requires that applicable providers and suppliers develop and implement policies and procedures ensuring that applicable staff are fully vaccinated for COVID-19. The list of applicable staff is broad and includes all staff “who provide any care, treatment, or other services for the facility and/or its patients,” regardless of an individual’s clinical responsibility or frequency of patient contact.^[8]

Staff members specifically named in the IFC include facility employees; licensed practitioners; students, trainees, and volunteers; and individuals who provide care, treatment, or other services for the facility and/or its patients, including administrative staff, facility leadership, volunteer or other fiduciary board members, and housekeeping and food services. The IFC is applicable whether the staff provide care, treatment, or other services under contract or other arrangement. As such, vendors or other contractors may fall within the definition of staff and be subject to vaccination requirements, depending on the circumstances. Additionally, a facility’s policies and procedures implemented pursuant to the IFC must apply to both current and newly hired staff, as discussed later.

The IFC exempts applicable staff who exclusively provide remote services; however, any individual who primarily provides services remotely but occasionally interacts in person with fellow staff or who enters the healthcare facility or site of care for work purposes must still be vaccinated (or subject to an exemption).^[9] Additionally, the IFC excludes from the definition of staff those individuals who infrequently enter a facility to provide “ad hoc non-health care services” or for “specific limited purposes” (not pursuant to a services contract or arrangement), such as delivery and repair personnel.

New hires

Both current staff as well as any new staff are subject to the vaccination requirement.^[10] While guidance from CMS regarding new hires is sparse, CMS notes that there is not a separate requirement for existing versus new staff and that applicable staff “must have received, at a minimum, the first dose of a two-dose COVID-19 vaccine or a one-dose COVID-19 vaccine by the regulatory deadline, or prior to providing any care, treatment, or other services for the facility and/or its patients.” CMS plans to continue to ensure compliance with the new staff vaccination requirement through the established survey process, as discussed later. Healthcare providers subject to the vaccine mandate may wish to consult an employment attorney to ensure that, in attempting to comply with the CMS vaccine mandate when hiring new staff, the provider does not run afoul of any employment or anti-discrimination laws.

‘Fully vaccinated’ defined

The IFC’s definition of “fully vaccinated” is consistent with that of the Centers for Disease Control and Prevention (CDC).^[11] As such, staff are considered fully vaccinated two weeks or more after completion of a primary vaccination series for COVID-19, meaning either “the administration of a single-dose vaccine, or the administration of all required doses of a multi-dose vaccine.” Notably, staff who have completed a primary vaccine series by the IFC deadline are considered to have met IFC requirements, even if they have not yet completed the two-week waiting period required for full vaccination. Currently, additional doses of a COVID-19 vaccine—a “booster” shot—are not included in the IFC requirements.^[12] However, this could change in the future as the response to the public health emergency continues to evolve.

Documentation of staff vaccination

Providers and suppliers must also track and securely document the vaccination status of staff members, including those who qualify for a delay in vaccination, all exemption requests and outcomes, and any booster doses received by staff members. Acceptable forms of proof of vaccination include the CDC COVID-19 vaccine card (or photo thereof), documentation of vaccination from a healthcare provider or electronic health record, or state immunization information system record.^[13] Providers and suppliers are granted flexibility to use their choice of appropriate tracking tools, and the IFC references CDC’s Excel-based tracking tool^[14] for those providers who may want to use that free resource.^[15] Staff vaccine documentation “must be kept confidential and stored separately from an employer’s personnel files”; appropriates places for storage of vaccine documentation specifically named in the IFC include a facility’s immunization record or health information files.

Vaccine exemptions

Exemptions from the vaccine may be granted on the basis of “certain allergies, recognized medical conditions, or religious beliefs, observances, or practices,” or other “Federal laws, including the [Americans with Disabilities Act], section 504 of the Rehabilitation Act, section 1557 of the [Affordable Care Act], and Title VII of the Civil Rights Act.” The IFC preempts the application of any state or local law providing for exemptions that are broader than, or otherwise not included in, the IFC. Any staff requests for exemption based on a federal law must be evaluated in accordance with such law.

Staff members requesting a medical exemption must provide documentation that is signed and dated by a licensed practitioner (which cannot be the individual requesting the exemption) acting within their respective scope of practice. Such documentation must contain, at a minimum, “all information specifying which of the authorized COVID-19 vaccines are clinically contraindicated for the staff member to receive and the recognized clinical reasons for the contraindications; and a statement by the authenticating practitioner recommending that the staff member be exempted from the facility’s COVID-19 vaccination requirements based on the recognized clinical contraindications.” Additionally, while not an exemption, COVID-19 vaccination may be temporarily delayed due to clinical precautions and considerations, including individuals with acute illness secondary to COVID-19 and individuals who received monoclonal antibodies or convalescent plasma for COVID-19 treatment.

Notably, the IFC does not provide for an exemption based on prior infection. Instead, the IFC states, “evidence indicates…infection-induced immunity, also called ‘natural immunity,’ is not equivalent to receiving the COVID-19 vaccine.…CDC recommends that all people be vaccinated, regardless of their history of symptomatic or asymptomatic SARS-CoV-2 infection.”^[16]

If a provider or supplier grants an exemption or accommodation based on the above criteria, such exemptions or accommodations must be documented and tracked, and the accommodations must be structured so that the risk of transmission of COVID-19 to at-risk individuals is minimized.

Policies required under the IFC

Providers and suppliers must develop and implement policies and procedures to ensure that all applicable staff are fully vaccinated and to track and securely document vaccination status of all staff, including those who have received a booster dose, those who are granted an exemption, and those for whom the vaccine is delayed.

Additionally, providers and suppliers must establish and implement a process through which staff can request an exemption from the vaccination requirements based on applicable federal law and/or medical or religious exemption. Such policies and procedures should also include a method for collecting and evaluating staff requests, as well as tracking and securely documenting information provided by staff in relation to an exemption request, decisions on such requests, and any granted exemptions or accommodations. Providers and suppliers are allowed flexibility in establishing their own processes and procedures, but the IFC does provide an example policy in The Safer Federal Workforce Task Force’s “request for a religious exception to the COVID-19 vaccination requirement” template.^[17]

Finally, providers and suppliers must implement additional precautions, intended to mitigate the transmission and spread of COVID-19, for all staff who are not fully vaccinated and maintain contingency plans for such staff. Some examples of such precautions are discussed later.

Implementation and deadlines

The IFC was broken down into two phases of implementation. Phase 1 required nearly all provisions of the IFC to be implemented, including (1) that all staff either had received, at a minimum, the first dose of a primary vaccination series or a single-dose COVID-19 vaccine or had requested a lawful exemption and (2) that facilities had developed and applied all policies and procedures required by the IFC.

Phase 2 required that all applicable staff be fully vaccinated or have been granted an exemption—provided, however, that this did not apply to those staff for whom COVID-19 vaccination was temporarily delayed or those who received the final dose of a primary vaccination series by the Phase 2 effective date but had not yet completed the 14-day waiting period.

Thirty days after the Phase 2 deadline has passed, providers not maintaining 100% vaccination or policy compliance can expect to be subject to enforcement actions as part of the CMS survey process.

As a result of the legal disputes described earlier and the delays they created, CMS implemented different Phase 1 and Phase 2 deadlines in different states.^[18] As of the date of this publication, all of the original deadlines have passed, and providers and suppliers generally are now expected to maintain 100% compliance with the IFC. However, providers should consult the CMS website for any adjusted deadlines that may apply in their state.

Survey process

Depending on provider type, CMS may survey providers for compliance with the IFC as part of initial surveys, recertification or reaccreditation surveys, or surveys in response to a complaint. Not surprisingly, surveyors will obtain information through a combination of observation, interviews, and record reviews.

It is important for providers to keep in mind that surveyors will focus not only on the actual vaccination status of the provider’s staff, but also on whether the provider has appropriate vaccination policies in place, consistent with the specific requirements for that provider type found in the IFC and corresponding Code of Federal Regulations. For instance, failure to address all required policy elements can still result in standard level noncompliance, even if 100% of staff are vaccinated.

Providers can find details about what their policies need to include, as well as what CMS’s survey process will entail for their specific provider type, by reviewing CMS’s memorandum QSO-22-07-ALL and accompanying attachments.^[19] For instance, provider-specific attachments list the information providers are required to track and document, explain contingency plan requirements, and include examples of the types of additional precautions a provider might implement for staff who are not fully vaccinated or who have been granted an exemption, accommodation, or delay, such as reassigning staff to nonpatient care areas, requiring staff to wear masks, and implementing regular COVID-19 testing.

Since all provider types are now required to fully comply with the new standard, as mentioned earlier, failure to comply could subject providers to enforcement action.

Enforcement actions

For many provider types, including nursing homes, home health agencies, and hospice, CMS has three possible enforcement actions at its disposal for noncompliance with the IFC: civil monetary penalties, denial of payments, and termination of participation. For other provider types, including hospitals, CMS’s sole enforcement remedy is termination of participation in the Medicare and Medicaid programs. However, CMS has advised that its primary goal is to bring healthcare facilities into compliance with staff vaccination requirements and that it generally would pursue termination “only after providing a facility with an opportunity to make corrections and come into compliance.”^[20]

Indeed, when assessing degrees of noncompliance with the new requirement, CMS will consider whether providers are making a good faith effort to comply with the IFC. CMS defines “good faith effort” as “a provider that has taken aggressive steps toward achieving compliance with [the] staff vaccination requirement and/or the provider has no or has limited access to [a] vaccine, and has documented attempts to access…the vaccine.”^[21]

As such, providers should make every effort to comply with both the staff vaccination and policy aspects of the new requirement, keeping in mind that as long as they are genuinely making a good faith effort to comply with all requirements in a timely manner, the risk of being subjected to harsh penalties is minimal.

Conclusion

Like the COVID-19 pandemic itself, specific CMS guidance related to COVID-19 precautions may continue to fluctuate, and keeping abreast of the changing deadlines and requirements may feel challenging. Overall, it is likely that the new staff vaccination and healthcare policy requirements established by the IFC are here to stay. It is also possible that similar requirements for other types of healthcare providers not currently subject to the IFC, such as physician practices, could eventually be created. In the meantime, providers and suppliers affected by the IFC should focus on making a genuine, good faith effort to follow the IFC requirements and ensure patient safety as we collectively navigate the COVID-19 pandemic.

Takeaways

• Providers in the Affected States should stay informed about the ongoing court cases.

• The definition of staff is very broad, includes current and future staff, and may include persons not traditionally considered staff (e.g., vendors and contractors).

• Providers should consult their employment attorneys when hiring new staff to ensure compliance with the Centers for Medicare & Medicaid Services vaccine mandate and employment and anti-discrimination laws.

• Providers must develop and implement policies and procedures governing infection prevention/control, staff vaccinations, and documentation and tracking of vaccination status, exemptions, and accommodations.

• Centers for Medicare & Medicaid Services’ goal is healthcare facilities’ compliance, not simply punishment, and full compliance requires both staff vaccination and implementation of appropriate policies and procedures.