On January 14, 2022, after the decision by the U.S. Supreme Court in Biden v. Missouri, the Centers for Medicare & Medicaid Services (CMS) issued guidance in QSO-22-09-ALL (“January 14 Memo”) on application of the November 5, 2021, CMS interim final rule regarding COVID-19 vaccine immunization of staff among Medicare- and Medicaid-certified providers and suppliers (“Vaccine Rule”) in 24 states that had previously been exempt from the CMS guidance issued on December 28, 2021, in QSO-22-07-ALL (“December 28 Memo”).[1]

The January 14 Memo sets forth a schedule with a phased-in approach for enforcement—like the December 28 Memo but with different dates for the time periods that run from the date of issuance of each memorandum. Accordingly, facilities in the 25 states[2] subject to the December 28 Memo and facilities in the 24 states subject to the January 14 Memo will have to meet the same requirements but on different schedules.

The January 14 Memo and the December 28 Memo (collectively, “CMS Guidance”) both contain provider-specific attachments describing the survey process for each provider type. This Insight describes the CMS Guidance and attachment for hospitals.[3]

Phased Requirements

The CMS Guidance indicates that surveyors will begin surveying for Vaccine Rule compliance 30 days after the memo’s issuance, meaning that vaccine compliance surveys would begin on or around January 27, 2022, for the 25 states to which the December 28 Memo applies or February 14, 2022,[4] for the 24 states to which the January 14 Memo applies. Surveyors will survey for Vaccine Rule compliance through a full survey for recertification or reaccreditation, federal initial surveys, or a complaint survey. CMS expects all hospital staff to have received the appropriate number of vaccine doses by the timeframes specified in the applicable memo; those deadlines are built upon the memo’s issuance date of either December 28, 2021, or January 14, 2022.

After January 27, 2022, or February 14, 2022 (30 days after issuance of the applicable memo),[5] if a facility can demonstrate that its Vaccine Rule policies and procedures have been developed and implemented and 100 percent of staff have received at least one dose of vaccine, have a pending or granted qualifying exemption, or have been identified as having temporary vaccine delay as recommended by the CDC, that facility will be in compliance with the Vaccine Rule. If a facility has not achieved these requirements, it will receive notice through a CMS Form 2567 of its noncompliance. If the facility is above an 80 percent threshold and has a plan to achieve a 100 percent staff vaccination rate within 60 days, the facility would not be subject to additional enforcement action.

After February 26, 2022, or March 15, 2022 (60 days after issuance of the applicable memo), if a facility can demonstrate that its Vaccine Rule policies and procedures have been developed and implemented and 100 percent of staff have received the necessary doses to complete the vaccine series, have a qualifying granted exemption, or have been identified as having temporary delay as recommended by the CDC, that facility will be in compliance with the Vaccine Rule. If a facility has not achieved these requirements, it will receive notice through a CMS Form 2567 of its noncompliance. If the facility is above a 90 percent threshold and has a plan to achieve a 100 percent staff vaccination rate within 30 days, the facility would not be subject to additional enforcement action. 

Hospitals failing to maintain compliance with the 100 percent standard by March 28, 2022, or April 14 (90 days after the applicable memo date) may be subject to enforcement action.

Hospital Policies and Procedures

Hospitals must have Vaccine Rule policies and procedures implemented by January 27, 2022, or February 14, 2022 (30 days after issuance of the applicable memo).[6] Those policies and procedures must include:

  • a process for ensuring that all staff have received at least the first dose of vaccine prior to providing care, treatment, or other services for the facility or its patients;
  • a procedure for ensuring that all staff not yet fully vaccinated adhere to additional precautions intended to mitigate the spread of COVID-19; and
  • a process for tracking and documenting:
    • each staff member’s role, assigned work area, interaction with patients, and vaccination status (including the specific vaccine received, dates of doses received or scheduled, and any boosters received);
    • exemptions granted, including the type of exemption and supporting documentation;
    • staff for whom vaccination must be temporarily delayed (dates for when vaccination can be safely resumed must be included); and
    • staff who are 100 percent telework and, thus, not required to be vaccinated.

Exemptions

CMS defers to CDC guidance regarding clinical contraindications to receiving a COVID-19 vaccine. To be granted a medical exemption, a staff member must provide documentation recommending exemption that is signed and dated by a licensed practitioner (who is not the requesting staff member) and who is acting within their respective practice and in accordance with all applicable state and local laws.  The documentation must indicate which specific vaccine is contraindicated for the staff member and the recognized clinical reasons for the contraindication. To the extent a staff member has a temporary delay in receiving a vaccine, as recommended by the CDC clinical guidance, hospitals must track and secure documentation of the same.

Requests for non-medical exemptions, such as religious exemptions, must be documented and evaluated in accordance with each hospital’s policies and procedures. The CMS Guidance directs hospitals to the U.S. Equal Employment Opportunity Commission’s Compliance Manual on Religious Discrimination. CMS indicates that surveyors will not evaluate the details of a request for religious exemptions nor the rationale for the hospital’s acceptance or denial of the request. Instead, the surveyor will review to ensure the hospital has an effective process for staff to request a religious exemption for a sincerely held religious belief.  

Hospital Survey Process

The CMS Guidance provides detailed procedures for hospital surveys on the Vaccine Rule.

At the outset of the survey, at the entrance conference, the hospital will be expected to provide at the least the following documentation:

  1. Policies and procedures regarding all processes described above under “Policies and Procedures”
  2. Contingency plans for staff who are not yet vaccinated, including deadlines for staff to be vaccinated
  3. A list of all staff and their vaccine status, including the position or role of each staff member and newly hired staff (hired with the last 60 days)

Surveyors are instructed to review the documentation noted above, and perform the following survey activities:

  1. For each individual identified by the hospital as vaccinated, review hospital records to verify vaccination status.
  2. For each individual identified by the hospital as unvaccinated, (i) determine, if they have been educated and offered vaccination, (ii) determine if they have a medical contraindication or religious exemption, and (iii) observe staff providing care to determine compliance with current standards of practice with infection control and prevention.
  3. For each individual identified by the hospital as unvaccinated due to a medical contraindication, review all required documentation for such determination.

Level of Deficiency

The CMS Guidance instructs surveyors to use the following criteria to determine the level of deficiency of noncompliance.

Condition Level: A Condition Level deficiency will exist if the hospital does not meet the 100 percent staff vaccination rate standard and either (i) one or more components of the policies and procedures were not developed and implemented or (ii) 21-39 percent of staff remain unvaccinated creating a likelihood of serious harm.

Immediate Jeopardy: A Condition Level deficiency with Immediate Jeopardy finding will exist if the hospital (i) does not meet the 100 percent staff vaccination rate standard, there are observations of noncompliant infection control practices by staff (e.g., staff failed to properly don personal protective equipment), and one or more components of the policies and procedures were not developed or implemented, or (ii) 40 percent or more of the staff remain unvaccinated creating a likelihood of serious harm.

As with all CMS surveys, a Condition Level deficiency will result in penalties if there is no correction to bring the hospital into compliance. A Condition Level deficiency with Immediate Jeopardy will result in penalties on an accelerated schedule. The only penalty available to CMS for hospital surveys is termination of the hospital from the Medicare and Medicaid programs. The CMS Guidance does state, however, “CMS’s primary goal is to bring health care facilities into compliance. Termination would generally occur only after providing a facility with an opportunity to make corrections and come into compliance.”

The CMS Guidance provides that surveyors may lower the citation level and/or enforcement action if the hospital can demonstrate that prior to the survey, the hospital took aggressive steps to have all staff vaccinated—with examples given by CMS of “such as advertising for new staff, hosting vaccine clinics, etc.”

Next Steps

Hospitals should prepare for CMS survey activity, as described above, on compliance with the Vaccine Rule. Hospitals previously exempt from enforcement during the pending legal challenge should resume efforts to meet the Vaccine Rule requirements in accordance with the schedule set forth in the January 14 Memo.

***

This Insight was authored by Allen R. Killworth and Jennifer M. Nelson Carney. For additional information, please contact one of the authors or the Epstein Becker Green attorney who regularly handles your legal matters.

ENDNOTES

[1] The January 14 Memo applies to the following states: Alabama, Alaska, Arizona, Arkansas, Georgia, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Mississippi, Missouri, Montana, Nebraska, New Hampshire, North Dakota, Ohio, Oklahoma, South Carolina, South Dakota, Utah, West Virginia, and Wyoming.

[2] The December 28 Memo applies to the following states: California, Colorado, Connecticut, Delaware, Florida, Hawaii, Illinois, Maine, Maryland, Massachusetts, Michigan, Minnesota, Nevada, New Jersey, New Mexico, New York, North Carolina, Oregon, Pennsylvania, Rhode Island, Tennessee, Vermont, Virginia, Washington, and Wisconsin.

[3] The January 14 Memo’s hospital attachment is available at https://www.cms.gov/files/document/attachment-d-hospital.pdf, and the December 28 Memo’s hospital attachment is available at https://www.cms.gov/files/document/qso-22-07-all-attachment-d-hospital.pdf.

[4] Thirty days from the date of the January 14 Memo is February 13, which is a Sunday. CMS indicated that it would use enforcement discretion to initiate compliance assessments the next business day for dates falling on a weekend or holiday.

[5] Id.

[6] Id.

Jump to Page

Privacy Preference Center

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.