Business & Legal
COVID-19, COVID-legal, Foley Hoag

Details on OSHA, CMS Vaccination Rules Released


On November 6, 2021, the Fifth Circuit Court of Appeals temporarily blocked enforcement of the OSHA vaccination-or-testing rule. Citing “grave statutory and constitutional issues” with the rule, a three-judge panel issued the emergency stay in response to a lawsuit filed by several states and private entities challenging the rule. The Court has given the federal government until 5:00 PM on November 8, 2021 to respond.


On November 4, 2021, the Centers for Medicare & Medicaid Services (“CMS”) and the Occupational Safety and Health Administration (“OSHA”) each released their long-awaited rules about mandatory vaccinations in the workplace. Both rules make clear that the new requirements preempt any inconsistent state or local laws, including laws that ban or limit an employer’s authority to require vaccination, masks or testing.

The CMS rule, titled the “COVID-19 Health Care Staff Vaccination Interim Final Rule” (the “IFR”), establishes a vaccination mandate for staff at certain Medicare and Medicaid certified providers and suppliers (“Providers”). The IFR interprets the term “staff” very broadly. Also, it does not provide for any testing alternative, i.e., staff are not allowed to choose to submit to frequent COVID-19 testing rather than become fully vaccinated.

The OSHA Emergency Temporary Standard (“ETS”), on the other hand, requires most private-sector employers with 100 or more employees to ensure that their covered employees are either fully vaccinated against COVID-19, or require unvaccinated employees to undergo regular COVID-19-testing and wear a mask in the workplace. The ETS requirements do not apply to employees who do not report to a workplace where other individuals (such as coworkers or customers) are present, or to employees working from home. The ETS also contains employee notice obligations and recordkeeping requirements, and requires that covered employers provide paid time off to employees for certain COVID-19-related circumstances.

Below is a general outline of the major provisions of each rule, along with important next steps that covered healthcare providers and employers will want to consider as they prepare to comply with either (or both) rules.


Scope of the CMS IFR

Covered Providers. The IFR’s requirements apply to Providers that are subject to CMS’s Conditions of Participation, including, but not limited to: (i) ambulatory surgical centers; (ii) hospices; (iii) psychiatric residential treatment facilities (“PRTFs”); (iv) programs for all-inclusive care for the elderly; (v) hospitals; (vi) long-term care facilities (including skilled nursing facilities and nursing homes); (vii) intermediate-care facilities for individuals with intellectual disabilities; (viii) home health agencies; (ix) comprehensive outpatient rehabilitation facilities; (x) critical access hospitals; (xi) clinics, rehabilitation agencies, and public health agencies as providers of outpatient physical therapy and speech-language pathology services; (xii) community mental health centers; (xiii) home infusion therapy (“HIT”) suppliers; (xiv) rural health clinics (“RHCs”) / Federally qualified health centers (“FQHCs”); and (xv) end-stage renal disease facilities.

Covered Staff. The vaccination mandate broadly applies to all staff of Providers that provide any care, treatment, or other services in any patient care location, or otherwise interact (regardless of frequency) with any other staff, patients, residents, clients, or PACE program participants in any location, beyond those that physically enter facilities or other sites of patient care. At a minimum the vaccination mandate thus applies to: (i) all employees of the Provider; (ii) licensed practitioners; (iii) students; (iv) trainees; (v) volunteers; and (vi) other individuals who provide care, treatment, or other services for the Provider and/or its patients under contract or other arrangement.

Individuals who provide services on a 100% remote basis are not required to become vaccinated. Similarly, vaccination is not mandated for “one off” vendors, volunteers, or professionals who provide infrequent, non-healthcare services, or for individuals who provide services exclusively at an off-site location where no patient care is rendered. In general, CMS states that when determining whether to require COVID–19 vaccination of an individual who does not fall into the categories established by this IFC, facilities should consider frequency of presence, services provided, and proximity to patients and staff.


Staff may request exemptions from the vaccination mandate due to a disability, medical condition, or sincerely held religious belief, practice, or observance. Depending on the reason for a particular request, the IFR lists relevant documentation that a Provider should request from the individual to verify the legitimacy of the request. The IFR also lists federal authorities to which the Provider should refer (e.g., Equal Employment Opportunity Commission guidance) in order to make a determination on the request that complies with existing anti-discrimination and civil rights laws.

Documentation of Staff Vaccinations

Providers are responsible for tracking and documenting staff vaccinations. Examples of acceptable proof of vaccination include: CDC COVID-19 vaccination record card (or a legible photo of the card); documentation of vaccination from a healthcare provider or electronic health record; or state immunization information system record. All such documentation related to vaccination status must be treated as confidential and stored securely and separately from an employer’s personnel files, pursuant to the ADA and the Rehabilitation Act.


CMS will enforce the IFR in accordance with its existing Conditions of Participation enforcement policies, which rely primarily on the issuance of interpretive guidelines, survey protocols, and surveys of Providers by state survey agencies. Providers that do not comply with the IFR may be subject to civil monetary penalties, denial of payment by CMS for covered services, and/or (as a final measure) termination from participation in Medicare or Medicaid.

Effective Dates and Action Items for Providers

Covered providers should immediately begin developing COVID-19 vaccination policies in accordance with the requirements in the CMS IFR.

The IFR’s requirements will be implemented in two phases. Phase 1 begins on December 6, 2021, at which time covered staff must have received the first dose of a primary series or a single dose COVID-19 vaccine, or have requested and/or been granted an exemption or accommodation. By the beginning of Phase 1, covered Providers must also have enacted policies and procedures for:

  • Effectuating the vaccination of all covered staff;
  • Reviewing and granting staff requests for exemptions or accommodations; and
  • Tracking and documenting staff vaccinations.

Phase 2 begins on January 4, 2021, at which time covered staff must be “fully vaccinated” against COVID-19. The IFR generally does not consider an individual to be “fully vaccinated” until two weeks after he or she receives the final dose of a primary series or a single dose COVID-19 vaccine. An exception for this general rule exists with respect to the beginning of Phase 2, however; An individual will be considered “fully vaccinated” so long as he or she receives the final dose of a primary series or a single dose COVID-19 vaccine before the beginning of Phase 2 (i.e., covered staff can, for example, receive their last shot on January 3, 2021).


Scope of the OSHA ETS

As mentioned above, the OSHA ETS applies to all employers with a total of 100 or more employees any time the ETS is in effect. However, OSHA specifies that the OSHA ETS will not apply to (1) workplaces covered under the Safer Federal Workforce Task Force COVID–19 Workplace Safety: Guidance for Federal Contractors and Subcontractors (Contractor Guidance); or (2) settings where any employee provides healthcare services or healthcare support services when subject to an earlier Healthcare Setting ETS issued by OSHA in June (although this previous ETS is set to expire in 2 months, at which point these employers may be subject to the new ETS).

The OSHA ETS also specifies that its requirements will not apply to employees who: a) do not report to a workplace where other individuals, such as coworkers or customers, are present; b) who work from home; or c) who work exclusively outdoors.

Option 1: Mandatory Vaccination Policies

Covered employers may comply with the ETS by establishing, implementing, and enforcing a written mandatory vaccination policy, which requires all covered employees to be fully vaccinated. To meet the definition of a mandatory vaccination policy, the policy must require vaccination of all covered employees, other than employees with medical or religious accommodations, and must inform employees about applicable medical and religious exclusions, paid time off and/or sick leave for vaccination purposes, the methods for collecting proof of vaccination, and other information. The policy must be made readily accessible to all employees through the employer’s normal methods of distributing information.

The ETS also permits employers to implement different vaccination policies for different types of employees. For example, employers may require all retail employees to be vaccinated, but permit optional vaccines for employees who work in other locations or telework intermittently.

Time Off for Primary Vaccine Doses and Side Effects

Covered employers must support COVID-19 vaccination for each employee by providing reasonable time to each employee during work hours for each of their primary vaccination dose(s), which may be capped at up to four hours of paid time at the employee’s regular rate of pay. Employers may not require employees to use accrued paid time off or sick time to cover time spent receiving up to two primary vaccination doses. However, employers are not required to reimburse employees for transportation costs associated with their vaccination doses.

Employers must also provide “reasonable” time and paid sick leave to employees to recover from side effects following a primary vaccination dose. While this may vary, the ETS notes that up to two days of paid sick leave per vaccination dose would satisfy this requirement. For the purposes of recovering from vaccination side effects, an employer may require an employee to use available, accrued paid sick leave. However, employers may not require employees to use vacation that is accrued in a separate bank from sick time, accrue negative paid sick leave, or borrow against future accrued sick leave.

A Second Option: Testing and Face Coverings

Rather than mandate vaccination, employers have the option to permit unvaccinated employees to submit to weekly COVID-19 testing and face covering requirements. Unvaccinated employees – including those who are unvaccinated for medical or religious reasons – may not enter the workplace unless they have received a negative COVID-19 test result within 7 days of entering the workplace, and must wear a face covering. The test may not be both self-administered and self-read, meaning the employee’s test must involve either the employer or a healthcare provider in order to qualify them to enter the workplace. Employers are responsible for retaining the results of each test during the duration of the ETS. Importantly, and in furtherance of the ETS’s purpose of promoting vaccination for all employees, employers are not required to pay for any costs associated with testing unless required by another applicable law or agreement.

COVID Diagnoses

All covered employees, regardless of vaccination status, are responsible for “promptly” notifying their employer of a positive COVID-19 diagnosis, and must immediately be removed from the workplace if they test positive for COVID-19 or are diagnosed with COVID-19 by a medical provider. The employee must remain out of the workplace until the employee either receives a negative result on a COVID-19 nucleic acid amplification test (NAAT), meets the return to work criteria in the CDC’s “Isolation Guidance,” or receives a recommendation to return to work from a licensed healthcare provider. Employers are not required by the ETS to provide paid time off for time spent out of the workplace due to a COVID-19 diagnosis, but should note that other federal, state, or local laws may provide employees with leave for these circumstances. If the employee is not too ill to work, employers can require an employee to work remotely or in isolation if suitable work is available. Where this is not possible, the ETS encourages employers to consider flexible and creative solutions, such as a temporary reassignment to a different position that can be performed by telework. The ETS does not require employers to maintain records of positive COVID-19 diagnoses, but must report work-related hospitalizations and fatalities in accordance with proper OSHA reporting procedures.

Effective Dates and Action Items for Employers

Employers should immediately begin implementing COVID-19 vaccination and/or testing policies required by the ETS. Employers who have already implemented COVID-19 policies should review them thoroughly for compliance with all applicable requirements of the ETS. In addition to maintaining a written policy, employers must determine the vaccination status of each employee, maintain records of each employees’ vaccination status during the duration of the ETS, and maintain a roster that documents each employee’s vaccination status. Employers are not responsible for monitoring or detecting fraudulent vaccine documentation.

By December 6, 2021, all employers must provide appropriate time off for workers to be inoculated and implement masks requirements. By January 4, 2022, all employees must either be fully vaccinated or submit to testing. Additionally, by January 4, 2022, employers must provide each employee with the following:

  • Any policy and procedure the employer implements in response to the ETS
  • COVID vaccine efficacy, safety, and the benefits of being vaccinated (by providing the document, “Key Things to Know About COVID-19 Vaccines,” available at “Key Things to Know About COVID-19 Vaccines”
  • Information about protection from retaliation
  • Information about OSHA’s prohibition against supplying false statements or documentation

Rule Interaction with Other Federal and State Requirements

Consistent with the Supremacy Clause of the United States Constitution, OSHA and CMS state that their rules preempt any inconsistent state or local law or executive or court order as applied to covered entities. Furthermore, the CMS IFR states that a provider may be covered by both the IFR and another federal law, regulation, or guidance, including, but not limited to, a previous OSHA ETS relating to COVID-19 safety, which generally applies to all employers of 100+ employees.

It should be noted that in a Fact Sheet, the Biden Administration has stated that OSHA “will not apply its new rule to workplaces covered by either the CMS [IFR] or the federal contractor vaccination requirement.” However, a large healthcare entity may have to comply with both rules, depending on the applicable setting. The CMS IFR applies to individuals who work at any site of care, or have the potential to contact anyone at the site of care, including staff or patient. However, it does not apply to employees of a provider who work off-campus, and have no interaction with the site of care (e.g., a hospital’s accounting department). Thus, in practice, off-campus employees of providers with over 100 employees would not be covered by the CMS IFR, but may arguably be covered by the OSHA ETS, and thus be afforded the testing option and other features only available under the OSHA ETS, as they are located in a different “workplace” that is not covered by the CMS IFR.


While the rules provide detailed information regarding vaccination, compliance with the rules, particularly with the medical and religious exemption requirements as well as the issue of covered “workplaces”, will continue to raise complicated issues for covered entities. In the meantime, such clients should take necessary steps to comply with the rules, as mentioned above.

Foley Hoag will continue to monitor developments and update clients on issues surrounding both the CMS IFR and the OSHA ETS.


This post was originally published on the Foley Hoag blog.

Foley Hoag logo





Upcoming Events


Related Articles