Skip to Main Content
Thought Leadership

CMS Interim Final Rule: Hard Vaccine Mandate for Healthcare Facilities

Legal Updates

On November 4, 2021, the Centers for Medicare & Medicaid Services (CMS) released an advance copy of the Interim Final Rule (IFR) related to COVID-19 vaccines for most of the entities covered by applicable Conditions of Participation, Conditions for Coverage or Requirements for Participation. 

The CMS rule requires that covered facilities establish a policy requiring that all eligible staff receive the first dose of a two-dose COVID-19 vaccine or a one-dose COVID-19 vaccine by December 5, 2021 and complete their primary vaccination series by January 4, 2022, except for staff who have been granted an exemption from the COVID-19 vaccination. The rule does not provide testing as an alternative to vaccination. According to the CMS FAQs, the CMS rule preempts any state law that is contrary to the CMS rule, and the CMS rules take priority over other federal vaccination rules and standards for facilities that participate in and are certified under the Medicare and Medicaid programs and are regulated by CMS health and safety standards known as the Conditions of Participation. The CMS rule is effective on November 5, 2021.

The table below provides a summary of the provisions of the CMS rule:

November 2021 CMS Fact Sheet

Effective Date:

  • The rule is effective November 5, 2021 
  • While CMS is accepting comments on the IFR between now and January 4, 2022, the IFR goes into effect immediately. CMS will consider and respond to comments as part of potential future rulemaking, if needed. 

Conflict with State Laws:

  • The IFR “preempts any inconsistent state or local laws, including laws that ban or limit an employer’s authority to require vaccination, masks, or testing.”
  • The IFR also “preempts the applicability of any State or local law providing for exemptions [for religious and/or medical purposes] to the extent such law provides broader exemptions than provided for by Federal law and are inconsistent with” the IFR. Thus, any state law which grants, for example, a religious exemption that is broader than that allowed under federal law applicable to religious exemptions is preempted.

November OSHA ETS Regarding Vaccines vs. CMS IFR:

  • The IFR is a “hard” mandate, requiring vaccination or religious or medical exemption under federal law. There is no alternative to test employees in lieu of vaccination.
  • Employers in compliance with the CMS IFR will satisfy vaccine requirements in the November OSHA ETS Regarding Vaccines.

June OSHA ETS for Healthcare v. CMS IFR:

  • The OSHA ETS, issued on June 21, 2021 (“June OSHA ETS for Healthcare”), applies to some, but not all, healthcare entities covered by the CMS IFR.
  • The June OSHA ETS for Healthcare exempts non-hospital ambulatory care settings where all non-employees are screened prior to entry and are excluded if symptomatic; well-defined ambulatory care settings where all employees are vaccinated and individuals with possible COVID-19 infections are prohibited from entry; and home health care settings where all employees are fully vaccinated and there is no reasonable expectation that COVID-19 is present.
  • The June OSHA ETS for Healthcare requires covered healthcare employers to develop and implement a COVID-19 plan to identify and control COVID-19 transmission in the workplace and to implement numerous virus-control measures to reduce transmission, including: patient screening, personal protective equipment, controls for aerosol-generating procedures, physical distancing, physical barriers, cleaning and disinfection, ventilation, health screening, medical management, training, anti-retaliation, recordkeeping, and reporting
  • The June OSHA ETS for Healthcare encourages (but does not mandate) vaccination
  • The June OSHA ETS for Healthcare requires covered healthcare employers to pay for COVID-19 vaccination for each employee by providing reasonable time and paid leave (e.g., paid sick leave, administrative leave) to each employee for vaccination as well as any side effects experienced following vaccination. Reasonable time may include, but is not limited to, time spent during work hours related to the vaccination appointment(s), such as registering, completing required paperwork, all time spent at the vaccination site (e.g., receiving the vaccination dose, post-vaccination monitoring by vaccine provider), and time spent traveling to and from the location for vaccination (including travel to an off-site location (e.g., a pharmacy), or situations in which an employee working remotely (e.g., telework) or in an alternate location must travel to the workplace to receive the vaccine).  Paid leave provided may include paid sick leave or administrative leave. The paid leave can be in the form of an employee’s accrued sick leave, if available, or in additional paid leave provided by the employer for this purpose.

Applies to “health care provider and supplier types” that participate in Medicare and Medicaid including:

  • Hospitals
  • Community Mental Health Centers
  • Comprehensive Outpatient Rehabilitation Facilities, Critical Access Hospitals,
  • End-Stage Renal Disease Facilities
  • Ambulatory Surgery Centers (ASCs)
  • Dialysis Facilities
  • Home Health Agencies
  • Home Infusion Therapy Suppliers
  • Hospices
  • Intermediate Care Facilities for Individuals with Intellectual Disabilities
  • Clinics
  • Rehabilitation Agencies
  • Public Health Agencies as Providers of Outpatient Physical Therapy and Speech-Language Pathology Services
  • Psychiatric Residential Treatment Facilities (PRTFs)
  • Programs for All-Inclusive Care for the Elderly Organizations (PACE)
  • Rural Health Clinics/Federally Qualified Health Centers
  • Long-Term Care Facilities
  • Indian Health Service (IHS) Facilities

Does not apply to:

  • Physician’s Offices
  • Dental Offices
  • Assisted Living Facilities
  • Group Homes
  • Religious Nonmedical Health Care Institutions (RNHCIs)
  • Organ Procurement Organizations (OPOs)
  • Portable X-Ray Suppliers
  • Providers of Home and Community-Based Services (HCBC) that receive Medicaid funding but are not regulated by CMS
  • Schools that receive Medicaid funding but are not regulated by CMS


  • Workers must receive their first shot of a two-dose series or the single shot of the J&J vaccine by December 5, 2021.
  • Covered facilities must have appropriate policies and procedures for a vaccine program, ensuring all covered staff are vaccinated or receive an exemption, developed and implemented by December 5, 2021. 
  • Workers must receive their second dose by January 4, 2022 unless they receive a religious or medical exemption.
  • Applies to workers who do and do not have patient-facing roles.
  • Applies to all facility employees and licensed practitioners, including physicians with privileges at a covered facility.
  • Applies to students, trainees, and volunteers working or volunteering in covered facilities – regardless of whether they have patient contact.
  • Also applies to those who perform services at covered facilities under a contract, such as food service and janitorial workers.
  • The IFR is not limited to workers who perform services in a formal clinical setting: applies to all workers who interact with other staff, patients, residents, clients, or PACE program participants in any location beyond the formal clinical setting (e.g., homes, clinics, other sites of care, administrative offices, off-site meetings, etc.)
  • Does not apply to workers who work 100% remotely and do not have any contact with any patients or other staff (e.g., telehealth or payroll service providers).
  • Note: Employees may comply by receiving any vaccine listed by the World Health Organization (WHO) for emergency use, even if those vaccines are not authorized by the FDA, and employees are not required to receive the vaccine in the United States.

Phases for Implementation:

  • Phase 1: Within 30 days of the IFR being published on November 5, 2021, all covered employees must have received their first shot of a two-dose series or the single shot of the J&J vaccine.
  • Phase 2:  Within 60 days of the IFR being published, all covered employees must have received their second dose or have received an approved exemption.
  • Note:  Staff are not required to be “fully vaccinated” (defined as 14-days after receiving the second dose of a two-dose series or the first dose of the J&J vaccine) by the compliance deadline; rather, they must have received the second dose or have received an approved exemption.
  • Note: the CMS Frequently Asked Questions (FAQs) notes another category of employees: “staff for whom COVID-19 vaccination must be temporarily delayed, as recommended by CDC.” Covered entities must be aware of and document who these employees are and when they are eligible to receive the vaccine. 

Proof of Vaccination:

  • Proof of vaccination may include a CDC COVID-19 vaccination record card or a legible photo of the card, documentation from a health care provider or an electronic health record, or a State immunization information system record.
  • Note:  Covered facilities must carefully consider applicable HIPAA, state confidentiality and other privacy laws when accessing medical records and state immunization information systems.
  • If vaccinated outside the U.S., a reasonable equivalent of any of these will suffice.


  • Covered facilities must “track and securely document the vaccination status of each staff member, including those for whom there is a temporary delay in vaccination, such as recent receipt of monoclonal antibodies or convalescent plasma.”
  • All documentation relating to staff vaccinations that includes medical records (including vaccine documentation) must be kept confidential and stored separately from an employee’s personnel file.

Exemptions and Delayed Vaccination:

  • Religious and medical exemption requests under federal law must be considered.
  • Covered facilities are required to implement policies and procedures to consider exemption requests and must document their evaluation of exemption requests.
  • Medical exemption requests must be supported by signed documentation from a licensed medical provider who is not the individual requesting the exemption and who is acting within their scope of practice; this documentation must specify which of the COVID-19 vaccines are clinically contraindicated for the staff member and the recognized clinical reasons for the contraindications; the medical provider must also sign a statement stating the employee should be exempted from the facility’s COVID-19 vaccination requirement.
  • “No exemption should be provided to any staff for whom it is not legally required [under the ADA or Title VII].”
  • The IFR expressly preempts any state law which grants a broader exemption for religious or medical purposes than federal ADA or Title VII law.
  • Pregnancy: The IFR lists the Pregnancy Discrimination Act as one of the federal laws. employers must consider when considering accommodation requests, but it does not list pregnancy as a contraindication for any COVID-19 vaccine (the IFR also lists pregnancy as a condition that may put an individual at a greater risk of severe illness from COVID-19)
  • Accommodations: In granting accommodations, employers must ensure they minimize the risk of transmission of COVID-19 to at-risk individuals, in keeping with their obligation to protect the health and safety of patients.
  • Delayed vaccination:  Eligible staff may have their vaccination delayed due to a recent COVID-19 diagnosis or other clinical precautions or considerations as recommended by the CDC, including “recent receipt of monoclonal antibodies or convalescent plasma.”
  • Prior COVID infections/Antibodies: The presence of antibodies from a prior COVID-19 infection does not exempt any covered employee from the IFR’s vaccination mandate.

Enforcement and Penalties for Non-Compliance:

  • CMS “will not hesitate to use [its] full enforcement authority” including issuing civil monetary penalties, denying Medicare or Medicaid payments, and “as a last resort,” terminating non-compliant entities from Medicare and Medicaid programs
  • Enforcement: CMS expects State Survey Agencies to conduct onsite compliance reviews by assessing facilities for compliance during standard recertification surveys and assessing vaccination status of staff on all complaint surveys
  • While onsite, surveyors will review the facility’s COVID-19 vaccination policies and procedures, the number of residents and staff who have tested positive for COVID-19 in the last 4 weeks, and a list of all staff and their vaccination status
  • Accrediting Organizations will be required to update their survey processes to assess the facilities they accredit for compliance with the IFR.

Testing in Lieu of Vaccination:

  • Testing in lieu of vaccination is not an option (unlike the November OSHA ETS Regarding Vaccines, which allows unvaccinated individuals to mask and submit to weekly COVID-19 testing).
  • CMS indicates in the FAQs that it intends to continue to require Long Term Care Facilities to test staff and residents for COVID-19 in compliance with CMS’ September 2020 emergency regulation for Long Term Care Facilities. This testing is in addition to mandatory vaccination.  


  • The CMS IFR does not require booster shots at this time.

New Hires:

  • The requirements for new hires are the same as for existing staff
  • All new hires must be vaccinated or receive an approved exemption by the deadlines above
  • If a new staff member is hired after the compliance deadline and is not vaccinated, the staff member must become vaccinated “prior to providing any care, treatment, or other services for the facility and/or its patients” (FAQs).

Data Reporting:

  • The IFR does not impose new or additional data reporting requirements on covered facilities.
  • Hospitals and Long-Term Care Facilities are required to continue complying with their facility-specific data reporting requirements stated in the emergency regulations issued by CMS in May 2020, August 2020, and May 2021.
  • Facilities participating in the Inpatient, PPS-Exempt Cancer, Long-Term Care Hospital, Inpatient Rehabilitation, and Inpatient Psychiatric Quality Reporting Programs must collect data on the new COVID-19 Vaccination Coverage among Health Care Professionals measure from October 1, 2021 to December 31, 2021 and quarterly thereafter.

Additional Guidance:

What this means to you

With ongoing COVID-19 transmissions in the workplace resulting in the issuance of the November 4, 2021 release of the CMS staff vaccine mandate, the OSHA ETS regarding vaccines, the Executive Order on Ensuring Adequate COVID Safety Protocols for Federal Contractors as well as the pending expiration of the June OSHA Healthcare ETS, employers face continuing compliance issues. For employers that constitute facilities participating in and certified under the Medicare and Medicaid programs and are regulated by the CMS health and safety standards, the CMS rule takes precedence over the other federal rules. Yet, there are circumstances where the executive order relating to federal contractors, the June OSHA Healthcare ETS or the November OSHA ETS relating to vaccine mandates may apply to staff who are not subject to vaccination requirements in the CMS rule.

Healthcare employers who had already implemented COVID-19 vaccine programs will also need to make sure that their programs are in compliance with the new standard. This includes potentially revisiting religious and in particular medical/disability exemptions to ensure that the documentation on file satisfies the new demands from CMS.

So long as facilities Identify and work to resolve these situations in a timely manner, serious non-compliance consequences can be averted.

Contact us

For compliance issues related to the CMS rule and other federal vaccine mandates, or issues involving conflicting state mandate laws or orders, contact Tom O'Day, Barb Grandjean, Jessica Brown, Beth Zewdie or your Husch Blackwell attorney.


Tom O'Day


Barbara A. Grandjean

Office Managing Partner

Jessica Brown

Senior Counsel

Tracey O'Brien

Senior Counsel