SyringVial900 blue background


CMS COVID-19 Vaccine Mandate Guidance


Jane Drummond Crop LR

Jane Drummond

General Counsel and Senior Vice President of Governmental Relations





  • Compliance
  • COVID-19
  • Workforce


compliance COVID-19 guide workforce

On Nov. 5, the Centers for Medicare & Medicaid Services issued an Omnibus COVID-19 Health Care Staff Vaccination Interim Final Rule, adding vaccination requirements to the Conditions of Participation for numerous health care providers, including Medicare- and Medicaid-certified hospitals and critical access hospitals.

Contemporaneously, the Occupational Health and Safety Administration published a Vaccination and Testing Emergency Temporary Standard imposing vaccination requirements and other COVID-19 safety protocols on employers with 100 or more employees. The OSHA Vaccination and Testing ETS exempts facilities subject to its COVID-19 Healthcare ETS issued in June, so long as the OSHA Healthcare ETS remains in effect. Generally, public entities governed by an elected board, or a board appointed by elected officials, are not subject to OSHA jurisdiction. Thus, Medicare-certified hospitals are required to implement the CMS vaccination mandate.

In adopting policies and procedures to implement the CMS IFR, a hospital should be cognizant of its existing policies to protect patients and staff from exposure to SARS-CoV-2. Additionally, the hospital will have existing policies and procedures on infection control and prevention and staff health and reporting, as well as various human resource policies that could be impacted by the CMS IFR, including leave away from work and disciplinary processes. Hospitals may consider adding addendums to existing policies and procedures to implement the new vaccination requirements, or they may develop separate policies and procedures. When developing separate policies and procedures, a hospital should be careful that areas of overlap are consistent and do not contradict one another.

It may be beneficial if the hospital policy implementing the CMS IFR is constructed to accommodate evolving guidance and consider how the hospital will communicate such changes to its employees. The hospital also may want to consider keeping a list of all policies and procedures where addendums or changes were made to incorporate the new CMS rule. This will make the survey process more efficient and reduce the risk of noncompliance.


Jane Drummond
General Counsel and
Vice President of Legal Affairs
573-893-3700 | ext. 1328

Sarah Willson
Vice President of Clinical and
Regulatory Affairs
573-893-3700 | ext. 1304

At a Glance

The CMS IFR requires hospitals to implement the following.

  • policies and procedures to ensure all staff are fully vaccinated
  • a process for ensuring all staff, other than those who are entitled to exemption or deferral, who have not received at least one dose of vaccine by Dec. 5, 2021, do not provide care, treatment or other services for the hospital or its patients
  • a process for ensuring all staff, other than those who are entitled to exemption or deferral, have received all required doses of any vaccine regimen by Jan. 4, 2022
  • a process for implementing appropriate safety measures to mitigate the transmission and spread of COVID-19 for all staff who are not fully vaccinated
  • a process for tracking and documenting the vaccination status of employees
  • a process for tracking and documenting the receipt of recommended booster doses
  • a process for staff to request medical or religious exemptions from the vaccination requirements
  • a process for tracking and documenting exemption requests and decisions to grant such requests
  • a process for ensuring all required documentation is received to support requests for medical exemptions
  • a process for tracking and documenting the vaccination status of employees who have requested temporary deferral of the vaccination requirements
  • contingency plans for staff who are not fully vaccinated


General Application

The CMS IFR requires all hospital staff to be fully vaccinated against COVID-19. Fully vaccinated means it has been two weeks or more since an individual completed a primary vaccination series for COVID-19. A primary vaccination series is defined as the administration of a single-dose vaccine (such as the Janssen (Johnson & Johnson) vaccine) or all required doses of a multi-dose vaccine (such as the Pfizer-BioNTech vaccine (interchangeable with the licensed Comirnaty vaccine) or the Moderna vaccine). For purposes of the rule, staff who have completed the primary series of vaccination by Jan. 4, 2022, without having completed the two weeks post-vaccination, will be considered fully vaccinated.

Additionally, staff who receive vaccines listed by the World Health Organization for emergency use that are not approved or authorized by the U.S. Food and Drug Administration, or were vaccinated as part of a clinical trial, also are considered to have completed the vaccination series in accordance with the Centers for Disease Control and Prevention guidelines. The rule requires the hospital to have a process in place to document employees’ receipt of booster doses but currently does not require employees to receive a booster. Should boosters become a required dose of a multi-dose regimen, the rule would require staff to receive boosters.

The rule considers “all staff” to include all hospital employees, licensed practitioners, students, trainees and volunteers, together with all individuals who provide care, treatment or other services for the hospital or its patients, under contract or by other arrangements. The rule does not exempt staff based on clinical responsibilities or patient contact. The rule does exempt staff who exclusively provide telehealth, telemedicine or wholly remote support services outside the hospital setting and who do not have any direct contact with patients or other staff who are required to be vaccinated.

Staff who are required to be vaccinated must receive a single-dose vaccine or the initial dose of a multi-dose vaccine by Sunday, Dec. 5, 2021. Staff who receive a multi-dose vaccine must receive all required doses no later than Jan. 4, 2022. Staff are considered to be fully vaccinated two weeks after administration of a single-dose vaccine or the second shot of a multi-dose regimen.

A policy setting forth the application and basic requirements of the CMS IFR should include the following.

  • a description of staff to whom the requirements apply
  • a statement requiring staff to have received, at a minimum, the first dose of a multi-dose COVID-19 vaccine or a one-dose COVID-19 vaccine, or have an approved medical or religious exemption in place, by Saturday, Dec. 4, 2021, to provide any care, treatment or other services for the facility and/or its patients
  • a statement that all staff without an approved medical or religious exemption must be fully vaccinated by Jan. 4, 2022
  • a statement that all newly hired employees will be subject to the vaccination requirements, including receipt of a single-dose vaccine or the first shot of a two-dose vaccine, before providing care, treatment or other services
  • a statement that staff who have received a COVID-19 vaccination neither licensed or authorized by the FDA nor listed on the WHO emergency use list will receive an FDA licensed or authorized vaccination series after 28 days
  • a process for determining vaccination status of covered staff
  • a process for tracking vaccination status of staff and a method for providing a list of all staff and their vaccination status upon request by onsite surveyors


Disability-Related and Religious Exemptions

The CMS IFR requires hospitals to allow exemptions from the vaccination requirement as required by federal law. The Americans with Disabilities Act and Title VII of the Civil Rights Act require reasonable accommodations for individuals with qualifying disabilities and sincerely held religious beliefs, practices or observances that would prevent them from receiving the vaccine.

Generally, an employer must evaluate requests to accommodate a disability on a case-by-case basis after engaging in an interactive process with the employee. If the employee has a qualifying disability, an accommodation is required unless it would impose undue hardship on the employer.

The CMS IFR is fairly restrictive in allowing medical exemptions only for “recognized clinical contraindications” to a COVID-19 vaccine. Presently, the CDC considers severe allergic reaction (e.g., anaphylaxis) after a previous dose, to a component of a COVID-19 vaccine or a diagnosed allergy to an ingredient of a COVID-19 vaccine to be contraindications for which an individual should not be vaccinated. Recent communication with CMS officials indicated that there may be other conditions for which one or more COVID-19 vaccine may be clinically inappropriate, as recognized by medical studies or in the vaccine literature. Allergy or other contraindication to one approved vaccine does not excuse an employee from the vaccination requirement ― he or she would need to demonstrate a disabling condition in relation to all three available vaccines.

Individuals may be eligible for a temporary deferral of the vaccination requirement in certain circumstances. The CDC recommends that employees who received monoclonal antibodies or convalescent plasma wait 90 days before receiving a COVID-19 vaccine. Similarly, individuals with a history of multisystem inflammatory syndrome due to SARS-CoV-2 are encouraged to delay vaccination until they have recovered from the illness and for 90 days after the date of diagnosis.

Hospitals should anticipate that some employees may have medical conditions that require enhanced protection from exposure to COVID-19 who will request accommodations to minimize their individual risk. Such requests should be evaluated in the same manner as any other disability accommodation request under the hospital’s existing ADA policy.

Requests for religious accommodations do not need to be based on mainstream religious practices; however, an employer may ask for further information to understand the nature of an employee’s claimed belief. According to EEOC guidance on religious accommodations, a religious belief is one that is “sincere and meaningful” and of similar import to the individual as belief in God. This does not require the employee to be a scrupulous observer of his or her belief, or that the beliefs are logical. Religious beliefs may be theistic or nontheistic, but they should be based in a strong moral or ethical framework held with the strength of traditional religious views.

Religious beliefs can be distinguished from views that are social, political, economic or based on personal preference. The EEOC stated that objections to COVID-19 vaccination based on such preferences, or on nonreligious fears about potential side effects of the vaccine, do not constitute protected religious beliefs.

The sincerity of an employee’s stated religious belief should be assumed unless the employer has objective evidence that calls the individual’s credibility into doubt. The EEOC lists the following considerations when assessing whether an employee’s beliefs are sincere: whether past behavior is distinctly inconsistent with the proffered belief, whether there are substantial secular reasons for the requested accommodation and whether the timing of the request raises suspicion (for example, the employee previously made the same request for secular reasons).

Evaluating requests for medical accommodations is by nature an objective matter; assessing religious beliefs involves subjectivity. Consistency in decisions is the best means to avoid disputes over religious beliefs. Centralizing those decisions insures against incongruous evaluation of purported beliefs and likely results in a more uniform application of the guidance surrounding religious accommodations.

Hospitals can expect an increased number of accommodation requests in relation to the vaccination requirements of the CMS IFR; however, the analysis of such requests would be similar to supervisors’ current processes for determining whether to grant an accommodation in any other circumstance. Hospitals then must implement measures to mitigate against the spread of COVID-19 by those individuals who have a valid exemption under the rule. An employee’s vaccination status is considered confidential medical information; therefore, hospitals must take steps to prevent safety measures from being used to identify individuals subject to an exemption, except as necessary to enforce those protocols.

All accommodation requests should be properly documented. The CMS IFR has specific documentation requirements surrounding requests for exemption from or delay of vaccination due to medical reasons. Medical exemptions must be supported by documentation from a licensed practitioner (not the individual requesting the exemption) acting in their scope of practice. The documentation must include all information specifying the vaccine(s) that are clinically contraindicated and the recognized clinical reasons for the contraindications, as well as a statement by the practitioner recommending the individual be exempted from the vaccination requirement. If the individual is seeking a temporary deferral of the vaccination requirement, the hospital must have a process for tracking the status of those individuals and ensuring vaccination when medically appropriate.

A policy implementing the process for requesting an exemption or deferral from the vaccination requirements should include the following.

  • an explanation of medical and religious exemptions, and a process by which such exemptions may be sought
  • a description of who may be entitled to a temporary delay of vaccination and the process by which such deferral may be sought
  • an explanation that medical exemptions must be based on a recognized clinical contraindication to the vaccines — severe allergic reaction (e.g., anaphylaxis) to a previous dose, to a component of a COVID-19 vaccine or known allergic reaction to a component of a COVID-19 vaccine
  • documentation requirements for an exemption (hospitals should use existing forms for requesting disability-related or religious accommodations, and/or adapt such forms for the purpose of this rule)
  • the date by which accommodation requests must be submitted
  • the date by which decisions will be made to grant or deny an exemption
  • the date by which an employee must receive a vaccination if an exemption is denied
  • the consequences of refusing to receive a vaccination if an exemption is denied


Mitigating Transmission and Spread Among Unvaccinated Staff

The CMS IFR directs hospitals to have policies and procedures outlining what steps should be taken to mitigate the spread of COVID-19 among unvaccinated staff. OSHA’s Healthcare ETS requires covered health care employers to develop and implement a COVID-19 plan to identify and control COVID-19 hazards in the workplace and implement requirements to reduce transmission of COVID-19. The Healthcare ETS requires health care facilities to address patient screening and management, standard and transmission-based precautions, personal protective equipment (facemasks, respirators), controls for aerosol-generating procedures, physical distancing, physical barriers, cleaning and disinfection, ventilation, health screening and medical management, training, anti-retaliation, recordkeeping, and reporting.

Hospitals subject to OSHA’s jurisdiction must continue to follow these requirements until the Healthcare ETS expires and is not replaced by a formal rule.i The safety measures covered by the Healthcare ETS should satisfy CMS requirements for mitigating against transmission of COVID-19 by unvaccinated staff. For hospitals that are not subject to OSHA requirements, the Healthcare ETS describes safety measures that could be incorporated to protect against COVID-19 transmission by unvaccinated employees. The standards for masking, screening, PPE, distancing, medical management and others may guide the development of additional precautions for unvaccinated staff. Appropriate safety measures to mitigate against the spread of COVID-19 will be facility-specific and based on numerous factors, such as physical plant, the number of unvaccinated staff, job duties and location within the hospital. Each hospital must identify the practices best suited to guard against transmission of the virus, which may include some or all of the standards provided by OSHA.

Several resources for implementing the Healthcare ETS are available on OSHA’s website. Many hospitals adapted the sample COVID-19 Plan Template into a policy and procedure for their facility. Hospitals, regardless of staff vaccination status and irrespective of the new CMS rule, still are directed to follow QSO 21-08-NLTC, “Revised COVID-19 Focused Infection Control Survey Tool for Acute and Continuing Care.”

To mitigate risk, the OSHA and CMS requirements already in place pertain to vaccinated and unvaccinated persons, as well as those waiting medical exemption determination. If/when the precautions for those who are vaccinated or unvaccinated differ, hospitals may consider changing their infection control and other practices accordingly.

A policy implementing processes for mitigating the transmission of COVID-19 for unvaccinated staff should include the following, as well as any other aspect of the OSHA COVID-19 Plan Template deemed appropriate to the facility’s needs.ii

  • masking and other PPE requirements
  • screening and/or routine testing of unvaccinated staff
  • physical distancing/barriers
  • remote work


Tracking and Securely Documenting Employee Vaccine Status, Including Boosters

Hospitals are required to track and securely document vaccination status for each employee. Hospitals may require employees to submit their proof of vaccination to the individual or department that collects other employee vaccination records, and this process should be clearly outlined in the hospital’s plan. The IFR does not dictate required proof of vaccination, but the following are examples from CMS.

  • CDC COVID-19 vaccination record card (or a legible photo/photocopy of the card)
  • documentation of vaccination from a health care provider or electronic health record
  • state immunization information system record

Hospitals are encouraged to keep records in a manner that is easy to pull a list of all staff and their vaccination status, as surveyors will ask to access this information during surveys.



  • Consider hosting vaccination opportunities at your facility, and create a one-stop-shop for employees to receive their vaccinations and submit their documentation.
  • Employees cannot merely show proof of vaccination, as documentation must be retained by the employer.
  • Temporary deferral in staff vaccination needs to be included in employee vaccine documentation. Potential reasons for delayed vaccination include recent receipt of monoclonal antibodies or convalescent plasma.
  • This should be an ongoing process as new staff are onboarded to your organization.
  • Vaccine documentation is considered part of a medical record, and must be confidential and stored separately from personnel files, pursuant to the Americans with Disabilities Act and the Rehabilitation Act.



i Two locations are exempted by the ETS: 1) well-defined hospital ambulatory care settings where all employees are fully vaccinated and individuals with possible COVID-19 are prohibited from entry, and 2) home health care settings where all employees are fully vaccinated and there is no reasonable expectation that individuals with COVID-19 will be present. However, the CMS rule requires all staff in the above areas to be vaccinated, as well as policies and procedures outlining additional precautions for those staff who are not fully vaccinated be available. So, these areas may not have adopted the OSHA ETS in the event of a carefully controlled environment; however, the CMS rule requires they have a policy and procedure outlining additional precautions in the event they would.

ii Hospitals may adopt policies and procedures addressing these safety measures from OSHA’s COVID-19 Plan Template.

Back to Top