Skip to content

CMS Releases Interim Final Rule Mandating COVID-19 Vaccination for Healthcare Employees

November 4, 2021

On Nov. 4, the Centers for Medicare & Medicaid Services (“CMS”) released its highly anticipated Omnibus COVID-19 Health Care Staff Vaccination Interim Final Rule, which upon publication in the Federal Register will mandate COVID-19 vaccination for all employees of healthcare facilities regulated by CMS.


The rule requires covered healthcare providers and suppliers to ensure staff are fully vaccinated for COVID-19 unless individuals are exempt. CMS considers staff to be fully vaccinated once two or more weeks have passed since they completed a primary vaccination series.  In turn, a primary vaccination series is defined as having received a single-dose vaccine or all doses of a multi-dose vaccine. Consistent with current CDC guidance, for purposes of this rule, CMS is not currently requiring healthcare staff to receive additional (third) doses or booster doses.  Unlike the OSHA Emergency Temporary Standard also released today, which impacts all employers with more than 100 employees in all industries nationwide, the CMS Interim Final Rule does not allow for a testing option in lieu of vaccination. CMS estimates that some 2.4 million healthcare workers will need to be vaccinated or replaced in the first year, most in the first two months after the rule is published.

Covered Providers

The rule applies directly to the following Medicare- and Medicaid-certified providers: Ambulatory Surgical Centers (ASCs); Hospices; Psychiatric Residential Treatment Facilities (PRTFs); Programs of All-Inclusive Care for the Elderly (PACE); Hospitals (acute care hospitals, psychiatric hospitals, hospital swing beds, long term care hospitals, children’s hospitals, transplant centers, cancer hospitals, and rehabilitation hospitals/inpatient rehabilitation facilities); Long Term Care (LTC) Facilities, including Skilled Nursing Facilities (SNFs) and Nursing Facilities (NFs), generally referred to as nursing homes; Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICFs-IID); Home Health Agencies (HHAs); Comprehensive Outpatient Rehabilitation Facilities (CORFs); Critical Access Hospitals (CAHs); Clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services; Community Mental Health Centers (CMHCs); Home Infusion Therapy (HIT) suppliers; Rural Health Clinics (RHCs)/Federally Qualified Health Centers (FQHCs); and End-Stage Renal Disease (ESRD) Facilities.  At this time the rule has not been written to directly apply to other health care facilities that are not regulated by CMS health and safety standards, such as physician offices.

Covered Healthcare Staff

The categories of individual workers covered by the rule are also broad and include not only licensed practitioners, but students, volunteers, trainees, administrative staff, leadership, and any other individuals providing care, treatment, or other services, regardless of clinical responsibility, relationship to patient care, or work location. The only exception is for individuals who work 100% remotely or provide one-off non-healthcare-related services.

Covered Vaccines

CMS expects most healthcare staff will receive in the United States one of the three vaccines currently authorized for emergency use by the U.S. Food and Drug Administration (FDA): Pfizer-BioNTech (interchangeable with the licensed Comirnaty vaccine made by Pfizer for BioNTech), Moderna, and Janssen (Johnson & Johnson) COVID-19 vaccines. The rule does contemplate some possible alternative scenarios such as receipt of an FDA authorized vaccine outside the U.S., administration of a vaccine not authorized by the FDA but listed by the World Health Organization (WHO) for emergency use, or vaccinations that are part of clinical trials in the United States. For those possible alternate scenarios, CMS directs employers to this CDC website.

Conflicting State and Local Requirements

Recognizing that healthcare providers are regulated at the federal, state, and local level, and sometimes those requirements are in tension or even conflict, CMS made clear that for purposes of this rule, it intends the requirements to take precedence over conflicting state and local requirements. Specifically, CMS said:

We understand that some states and localities have established laws that would seem to prevent Medicare- and Medicaid-certified providers and suppliers from complying with the requirements of this IFC. We intend, consistent with the Supremacy Clause of the United States Constitution, that this nationwide regulation preempts inconsistent State and local laws as applied to Medicare- and Medicaid-certified providers and suppliers.

Effective Date, Compliance Dates, and Comment Deadlines

Effective and Compliance Dates. The rule is currently only posted for public inspection by the Federal Register, but it is expected to be published in the Federal Register on Nov. 5 or shortly thereafter, and the deadlines for compliance will begin to run at that time.

While the rule is effective once officially published (which will likely be on Nov. 5), there are two “phases” for compliance. Within 30 days, or likely by Dec. 5, covered healthcare employers must require workers to receive their first dose (or the single dose vaccine) prior to providing care and services to patients. Covered health care employers must also put into place their policies and procedures requiring vaccination against COVID-19 within 30 days. Within 60 days, or likely by Jan. 4, 2022, healthcare workers must be fully vaccinated, which means having received the final dose plus two weeks. However, CMS has indicated that health care facilities will be considered in compliance with the rule if health care workers have at least received the final dose in a two-dose series.”

Comment Deadline. Once the rule is published, covered healthcare providers and other stakeholders will have 60 days to provide comments on the regulation to CMS. Thereafter, CMS may revise the rule to account for questions, concerns, data, or other issues that have arisen during the first 60 days of implementation. Healthcare facilities and others should strongly consider providing responses to inform CMS’s further development and management of the rule.

CMS will accept comments on all aspects of the rule, and it has specifically requested comment on a range of issues such as whether and how it may impact staffing retention, how small rural hospitals might increase vaccination rates, whether the compliance deadline should be extended for an additional month, and whether CMS should require daily or weekly testing of unvaccinated individuals. Given the overlap and conflict with some state and local requirements, CMS has also specifically invited State and local comments on the rule. CMS has also invited comments on new information obligations created by the rule, including on the need for the collections, the burdens associated with them, the clarity and utility of the collections, and any recommendations to minimize the burdens imposed by the collections.


The standards established by the rule are new conditions of participation in Medicare and Medicaid, which means violation of the standards could jeopardize future participation and trigger a range of penalties and enforcement actions up to and including exclusion, although CMS has said the goal is to obtain compliance.  To date, potential fines have not been published.

Other Information

This is a lengthy, significant, and complicated rule with import for a wide range of healthcare providers and suppliers. If you need help understanding your obligations, need help developing or updating your vaccination compliance and documentation plan, want to explore the possibility of submitting questions or comments to CMS, or otherwise need assistance with this or related legal and regulatory obligations, please contact the Clark Hill PLC team. Our Healthcare, Labor & Employment, and Government & Regulatory Affairs teams have in-depth experience developing vaccination compliance programs for healthcare providers, counseling healthcare employers on a wide range of related healthcare and labor compliance issues, and helping clients to seek and obtain further clarity or accommodation on specific regulatory issues. Please contact one of the authors or your Clark Hill attorney today for assistance.

The views and opinions expressed in the article represent the view of the author and not necessarily the official view of Clark Hill PLC. Nothing in this article constitutes professional legal advice nor is intended to be a substitute for professional legal advice. 

Subscribe For The Latest




2024 Cybersecurity and Data Privacy Laws Summit Chicago

This event will include a panel discussion with expert industry leaders, offering a deep dive into the most pressing issues and advancements in AI and data privacy laws. You’ll gain critical knowledge and explore the implications of AI in legal and privacy domains so you can update your practices to reflect the highest standards of data stewardship.

Explore more

WEBINAR: The Race to 2024: Politics and Social Media in the Workplace and Employer Rights.

Over the last several years, employers have seen and continue to see increased political activities from their employees at work and on social media platforms, including on business-related social media platforms, like LinkedIn. Managing employee expression causes unique challenges for employers and HR professionals, and in a General Election year, these challenges are likely to increase as the Presidential race, and other races, heat up.

Explore more

Webinar: A Cookieless Future and Promise of PETs: A Primer on Privacy Enhancing Technologies

This webinar will explore PETs – we will define what they are, what problems PETs exist to address, and emerging PET standards including the National Institute of Standards and Technology (NIST) draft guidance on how to evaluate PET effectiveness. We will provide specific PET use cases and discuss how PETs may be utilized to address the phase out of third party cookies by certain browsers for purposes of targeted advertising.

Explore more