CMS Issues Interim Final Rules with Comment Period Mandating Vaccination of Staff of CMS Regulated Providers/Suppliers

November 5, 2021

On November 4, 2021, the Centers for Medicare & Medicaid Services (“CMS”) issued Interim Final Rules requiring many of its regulated providers and suppliers to require staff and employees to meet COVID-19 vaccination requirements.  CMS chose to mandate vaccination by revising Conditions of Participations, requirements that providers and suppliers must meet to maintain certification to receive reimbursement under the Medicare and Medicaid programs.

The new regulations make the vaccine mandate part of the compliance process of CMS regulated entities and exposes these organizations to potential penalties (including, in extreme cases of non-compliance, possible loss of certification) for failing to comply.  In effect, it gives most health care providers no choice but to require staff to become vaccinated against COVID-19.  The Interim Rules along with comments and background discussion take over 200 pages to cover the regulatory requirement, to address public comments that CMS received in response to proposed rules and to justify the need for the requirement “to help protect the health and safety of residents, clients, patients, PACE participants, and staff, and reflect lessons learned to date as a result of the COVID-19 public health emergency.”

CMS’ initial release of the Interim Final Rules can be found at and are set to be officially published in the Federal Register today, November 5, 2021.

What Providers/Suppliers Must Comply with the Interim Final Rules?

The Interim Final Rules apply to most of the 21 types of health care providers that are subject to health and safety requirements established and administered by CMS, commonly known as Conditions of Participation.  Providers that are not specifically identified in the Interim Final Rules, such as (in most cases at least) physician’s offices and other provider types identified by CMS are not subject to the CMS mandate.  CMS makes a special point of indicating that providers who are not covered by the mandate may be covered by other state or federal laws that mandate vaccinations; so be sure to check your state law and the mandate that was issued by OSHA on the same date the CMS mandate was released.

The providers/suppliers specifically identified in the Interim Final Rules as requiring compliance with the CMS mandate include the following:

  • Hospitals (acute care hospitals, psychiatric hospitals, hospital swing beds, long-term care hospitals, children’s hospitals, transplant centers, cancer hospitals, and rehabilitation hospitals/inpatient rehabilitation facilities);
  • Critical Access Hospitals (CAHs);
  • Long-Term Care (LTC) Facilities, including Skilled Nursing Facilities (SNFs) and Nursing Facilities (NFs), generally referred to as nursing homes;
  • Ambulatory Surgical Centers (ASCs)
  • Hospices;
  • Home Health Agencies (HHAs);
  • Rural Health Clinics (RHCs)/Federally Qualified Health Centers (FQHCs);
  • Home Infusion Therapy (HIT) suppliers;
  • Comprehensive Outpatient Rehabilitation Facilities (CORFs);
  • End-Stage Renal Disease (ESRD) Facilities;
  • Clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services;
  • Community Mental Health Centers (CMHCs);
  • Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICFs-IID);
  • Psychiatric residential treatment facilities (PRTFs) (§ 441.151);
  • Programs of All-Inclusive Care for the Elderly (PACE) (§ 460.74)

What Providers/Suppliers are NOT Directly Required to Comply with the Mask Mandate?

CMS specifically excluded a couple of provider types that are subject to CMS jurisdiction including Organ Procurement Organizations or Portable X-Ray suppliers.  CMS justifies the exclusion of these providers from direct application of the mandate because these two types of providers do not provide direct service to the public.  Additionally, physician offices are also not directly covered by the vaccine mandate because they are not required to be certified by CMS.

Providers who are not required to directly comply with the mandate should not think that they are off the hook completely.  The providers with which they contract will have an obligation to include these providers within their compliance process.  Providers/suppliers who are directly required to comply with the mandate should take care to assure that these contractors are made subject to their vaccination program, policies, and requirements to assure that a violation does not occur with respect to contracted entities.

Health care providers who are not directly covered by the CMS mandate and do not need to comply by virtue of their contract arrangements might still need to implement vaccination requirements under state licensing laws or other applicable state or federal law. For example, OSHA also released its vaccination mandate on November 4, 2021 which might apply to providers who do not have direct compliance obligations under the CMS mandate.  (Our employment law department issued a blog covering the OSHA mandate which can be accessed here.)  The OSHA requirements are beyond the scope of this update.  It is also possible other state agencies will follow suit now that CMS and OSHA have both established their mandates.

No Testing Option

Unlike the OSHA vaccination mandate, the CMS mandate does not permit providers to offer staff a testing option.  CMS states that they considered a daily or weekly testing option but determined that “scientific evidence on testing found that vaccination is a more effective infection control measure.”  (Note however that the September 2020 directive that requires testing of staff and residents in long-term care facilities was not negated by the new mandate.  Compliance with those requirements must still be maintained.  CMS states that it will continue to “review evidence and stakeholder feedback on the testing issue” but, at least for now, all covered staff must meet vaccination requirements unless they are able to establish a recognized exemption.

There is no exemption in the CMS mandate for staff members who previously had COVID-19; even if they are able to demonstrate they have COVID-19 antibodies.

How Long Do Providers/Suppliers Have to Comply with the Interim Final Rules?

The Interim Final Rules are effective in 2 separate phases.

Phase 1 includes the requirement that staff receive their first dose of the vaccination (or only dose with respect to single dose vaccinations), of a COVID-19 vaccine, or have requested or been granted an exemption to the vaccination requirements.  Other requirements such as the need to develop specific policies and procedures must also be completed within the Phase 1 period.  Phase 1 must be in place within 30 days after the Interim Final rules are published in the Federal Register.

Phase 2 includes the requirement that all staff have completed the primary vaccination series and that staff is fully vaccinated, except for staff granted an exemption or for whom COVID-19 vaccination must be temporarily delayed, as recommended by CDC, due to clinical precautions and considerations. Phase 2 requirements must be complied with within 60 days after the mandate is published in the Federal Register.

Compliance Dates

It is expected publication in the Federal Register will occur on November 5, 2021, making the Phase 1 compliance date December 4 and the Phase 2 compliance date, including the requirements that all staff having received vaccination, January 2, 2022.

The regulations provide that the provider’s staff who have completed a primary vaccination series are considered to have met the vaccination mandate, even if they have not yet completed the 14-day waiting period following their last shot and are technically not considered fully vaccinated.   The bottom line is that in order to remain in compliance with the Conditions of Participation that pertain to the class of the individual provider (i.e., hospital, home health, surgery center, nursing home, etc.) the provider must assure its staff and contractors receive the first shot (or only depending on which vaccination is administered) during Phase 1.  Policy and other requirements must also be in place during Phase 1, prior to December 4, 2021.  Full vaccination of all staff must occur by January 2, 2022.

This means providers and suppliers have very little time to come into compliance with the mandate.  Providers and suppliers will need to start immediately to establish policies and procedures, educate staff, set up or enhance their vaccination program as needed, have their staff receive the vaccination, and document compliance with the mandate.  That is a lot to do in 30/60 days, particularly in large organizations with large staff and a variety of contractual arrangements.  The majority of the work, such as setting up programs, policies and procedures, identifying contractors that must comply, and having at least one dose in the arms of all required staff is frontloaded and must be completed within the first 30-day phase.  The second 30 days can be largely devoted to assuring staff on a 2-dose regimen receive their second injection.

Other Requirements of the CMS Mandate

The CMS mandate regulation contains a variety of requirements that extend beyond simply requiring staff to become vaccinated.  For example, covered providers and suppliers are required to establish specific policies and procedures covering various aspects of the vaccination mandate.  These policies and procedures must be implemented by the December 4, 2021 Phase 1 compliance date.  Specific requirements for policy coverage are sprinkled throughout the regulations.  For example, providers are required to define the conditions under which staff members may be permitted to claim an exemption from the vaccination mandate if they have “recognized medical conditions for which vaccines are contraindicated” or do not wish to be vaccinated based on “religious beliefs, observances, or practices.”

Additional Details and Updates

Ruder Ware will continue to monitor the implementation of the new CMS vaccination mandate and will publish updates as necessary to keep our clients updated on any further changes or requirements.  We continue to write about the regulations and will be posting a more detailed summary of the new regulatory requirements early next week, so please check back for more detailed information.  In the meantime, you may be able to answer your questions about application of the mandate by accessing the Frequently Asked Questions.

Back to all News & Insights


The content in the following blog posts is based upon the state of the law at the time of its original publication. As legal developments change quickly, the content in these blog posts may not remain accurate as laws change over time. None of the information contained in these publications is intended as legal advice or opinion relative to specific matters, facts, situations, or issues. You should not act upon the information in these blog posts without discussing your specific situation with legal counsel.

© 2022 Ruder Ware, L.L.S.C. Accurate reproduction with acknowledgment granted. All rights reserved.