On December 28, 2021, the Centers for Medicare and Medicaid Services (CMS) Quality, Safety and Oversight Group released a memorandum (QSO-22-07-ALL) providing guidance and details on survey procedures for assessing and maintaining compliance with CMS’s November 5, 2021, interim final rule with comment period (IFR) healthcare provider vaccination mandate in those states where it may be enforced. This move toward enforcement came as a surprise to some, given ongoing controversy regarding the IFR: a series of court decisions resulted in a stay of the IFR’s implementation in 25 states and oral arguments are expected to occur before the Supreme Court of the United States on January 7, 2022, regarding the fate of lower court injunctions. Regardless of the Supreme Court review, and that enforcement may only be undertaken in about half of all states, CMS has now identified updated deadlines for IFR compliance, as well as specific compliance thresholds and tiered enforcement levels for each of the specific CMS-enrolled provider types covered by the IFR.

As a result, covered facilities in states where the IFR may be enforced (roughly half of the country) find themselves again working with a short timeline for compliance, compounded by a new survey and enforcement regimen. Note that at this time, surveyors are not permitted to implement or enforce the IFR in the states where a stay of enforcement of the IFR remains in effect.

IN-DEPTH

New Compliance Dates

As outlined in its December 28, 2021, memo to surveyors and in updated FAQs for the IFR, CMS has adjusted the compliance date for Phase 1 of the mandate to January 27, 2022 (30 days after release of the memo), and the Phase 2 compliance date to February 28, 2022 (60 days after release of the memo). Generally speaking, Phase 1 entails covered staff having received the first dose of a multi-dose vaccine or requesting a federally recognized exemption, and Phase 2 involves covered staff receiving the second dose of a multi-dose vaccine (or a single dose of a single-dose vaccine) or having received a federally recognized exemption. For details on what is contemplated to be completed within each phase of the IFR’s implementation, see below and our prior On the Subject.

Who Assesses Compliance?

The memo specifies that federal, state, accrediting organization (e.g., The Joint Commission) and “CMS-contracted surveyors” will assess compliance upon survey. It is not clear whether the last category of surveyors mentioned in that list references state agencies conducting surveys on behalf of CMS, or separate survey staff provided directly by CMS.

Assessing Compliance on Survey

The memo describes the general compliance assessment process applicable to all covered provider types and defers specific details for each type to a series of 14 attachments, one for each covered provider type. Surveyors will apply the general guidance in the memo and the specific guidance for the surveyed provider types during any initial certification, standard recertification, reaccreditation or complaint survey starting January 27, 2022 (30 days after issuance of the memo).

While there is some variation in the details depending upon provider type, the memo and attachments provide that a covered facility with a vaccination rate under 100% (accounting for federally recognized exemptions and delayed dosing recommended by the Centers for Disease Control and Prevention (CDC)) is out of compliance with the IFR. Depending upon the type of provider and the level of non-compliance, the potential ramifications of noncompliance could include monetary penalties, denial of admissions, required plans of correction and other actions ultimately including termination of the provider agreement with CMS. CMS states in the memo and FAQ, as it had in calls at the time the IFR was published, that noncompliance will not necessarily lead to termination, and that covered facilities will generally be given opportunities to return to compliance prior to such actions being undertaken.

By the new Phase 1 date, in order to be considered compliant with the IFR, each covered provider must develop and implement policies and procedures to ensure staff vaccination, and 100% of covered staff must have received at least one dose of a COVID-19 vaccine or have requested or received a federally recognized exemption from vaccination (or have a temporary delay as recommended by the CDC). Facilities that are not in full compliance will receive written notice of their non-compliance via a Form 2567, and those with a compliance level at or above 80% with a plan to achieve 100% compliance within 60 days will not be subject to additional enforcement action. Facilities with a lesser level of compliance could be subject to additional enforcement action, depending upon provider type.

As of the updated Phase 2 date, compliance with the IFR requires each covered provider to develop and implement policies and procedures to ensure staff vaccination, and requires that 100% of covered staff have received the doses necessary to complete their vaccination series or have received a federally recognized exemption or temporary delay as recommended by the CDC. Facilities that are not in full compliance will receive written notice of their non-compliance via a Form 2567, and those with a compliance level at or above 90% with a plan to achieve 100% compliance within 30 days will not be subject to additional enforcement action. Facilities that fail to meet these thresholds will be subject to additional enforcement action, as described under Phase 1.

After the Phase 2 date has passed, any covered provider that fails to maintain 100% compliance as described above may be subject to enforcement action.

The survey impact of noncompliance is further addressed in the provider-specific attachments to the memo.

Provider-Specific Information and Compliance Thresholds

The provider-specific attachments to the memo detail both the changes to the applicable conditions of participation or coverage, or other requirements under which covered facilities must operate pursuant to their provider agreement or enrollment agreement with CMS, and specific survey guidelines for the various elements of the IFR as applied to covered facilities.

For example, for hospitals, Attachment D to the memo outlines specific expectations in relation to the required policies and procedures regarding staff vaccination, and details the information that each hospital is required to track and securely document regarding staff vaccination, including:

• Each staff member’s vaccination status (including the specific vaccine received and the dates of each dose received, or the date of the next scheduled dose for a multidose vaccine)

• Any staff member who has obtained any booster doses (including the specific vaccine booster received and the date of the administration of the booster)

• Staff who have been granted an exemption from vaccination requirements by the hospital (including the type of exemption and supporting documentation)

• Staff for whom COVID-19 vaccination must be temporarily delayed, including the tracking of when the identified staff can safely resume their vaccination.

For hospitals that began gathering vaccination information prior to the release of the memo, certain of these data points may not have been part of their tracking. Hospitals may need to restructure their tracking processes and obtain more information from staff to ensure their records are complete.

The provider-specific attachments also detail the survey process that will be followed to evaluate compliance with the IFR. The process will be intensive and detailed, including staff interviews and questioning; validating documents; and pressure-testing exemptions, exemption processes and contingency plans. Covered facilities need to be prepared for this level of scrutiny.

For illustrative purposes, in the context of a hospital survey, the surveyors are guided to take the following actions:

For vaccinated staff:

• Review hospital records to verify vaccination status and validate the evidence provided.

• Conduct follow-up interviews with staff and administration if any discrepancies are identified or if any additional doses were provided.

For unvaccinated staff:

• Review hospital records.

• Determine if such staff have been educated and offered vaccination.

• Interview staff and ask if they plan to get vaccinated if they have declined to get vaccinated, and if they have a medical contraindication or religious exemption.

• Request and review documentation of the medical contraindication.

• Request to see employee record of the staff education on the hospital policy and procedure regarding unvaccinated individuals.

• Observe staff providing care to determine compliance with current standards of practice with infection control and prevention.

For each individual identified by the hospital as unvaccinated due to a medical contraindication:

• Review and verify that all required documentation is fully executed, sufficiently detailed and in order.

Hospitals are expected to provide a list off all staff, their position/role and their vaccination status, including newly hired staff within the last 60 days.

The above is only a partial list of the detailed surveyor responsibilities for assessing a hospital’s compliance with the IFR on survey. Similar survey process expectations are in place for the other covered provider types in their respective attachments to the memo. The additional work required on the part of the survey team, and the resources required of the hospital to respond to these detailed expectations, seem almost certain to complicate and prolong the survey process.

Levels of Deficiency and Plans of Correction

The attachments to the memo also articulate how surveyors are to determine the level of deficiency in cases where a covered provider is found to be out of compliance with the IFR. As noted above, from 30 to 60 days following issuance of the memo, the expected minimum threshold for compliance is 80%, and from 60 to 90 days following issuance of the memo, the expected minimum compliance threshold is be 90%. After the 90-day point, the expected minimum threshold is 100% compliance. Noncompliance outside of these parameters may be cited within a range of severity, including by way of example, for hospitals:

• Immediate Jeopardy where 40% or more of covered staff remain unvaccinated, or where the covered facility failed to meet the 100% threshold and had noncompliant infection control practices and one or more undeveloped or unimplemented policies and procedures

• Condition Level where the covered facility did not meet the 100% threshold and one or more components of the policies and procedures were not developed and implemented or 21-39% of covered staff remain unvaccinated

• Standard Level where 100% of staff are vaccinated and all new staff have received at least one dose but one or more components of the policies and procedures were not developed and implemented, or where the provider did not meet the 100% threshold but is “making good faith efforts” toward compliance.

Other covered provider types (i.e., long-term care facilities) include patient/resident infection information as part of the determination of severity and scope of the noncompliance.

Provisions regarding how covered providers can clear citations and demonstrate substantial compliance in plans of correction provide little flexibility, focusing on coming into 100% compliance as quickly as possible. Achieving compliance and clearing a citation requires a showing that all staff are fully vaccinated (through measures such as obtaining vaccine doses for staff or “replacing unvaccinated staff with vaccinated staff”), and even achieving substantial compliance with a continuing citation presumes that unvaccinated staff have obtained a first dose and are scheduled for a second dose.

Many of the corrective actions are presented in a matter-of-fact manner, as though they could be achieved quickly and easily, which may come as a surprise to providers presently dealing with nurse and other staff shortages (e.g., “obtaining temporary vaccinated staff until permanent vaccinated replacements can be found” as a component of a contingency plan). Perhaps recognizing this, in the case of hospitals, CMS provides that the citation level and/or enforcement action may be lowered if it is identified that prior to the survey, the covered provider had no or limited access to vaccines, despite documented attempts to obtain access, or if the hospital provides evidence that it has taken aggressive steps to have all staff vaccinated, such as advertising for new staff or hosting vaccine clinics. To what extent these “good-faith” efforts to achieve compliance will be weighed in the survey process remains to be seen.

Key Takeaways

The memo and provider-specific attachments provide detailed, actionable information for covered providers in anticipation of Phase 1 and Phase 2 deadlines. With oral arguments on the ability to enforce the IFR scheduled at the Supreme Court on January 7, 2022, and an unknown timeline for a decision to be issued thereafter, providers in all states—including those where enforcement is currently enjoined—would be well advised to determine how this new survey guidance may apply to them in the future, if not now.

Covered facilities should carefully review the memo and relevant attachment for their provider type in advance of the Phase 1 and Phase 2 dates, familiarize themselves with the new guidance and survey processes as applied to their facilities, and consider making changes to processes where the current state is not in alignment with the guidance. Links to each of the provider-specific attachments are provided below.

Providers who still wish to comment on the IFR may do so under the existing comment period, which closes January 4, 2022.