Supreme Court Upholds CMS Provider Rule Requiring Staff Vaccination
In November of 2021, the Department of Health and Human Services (HHS) issued a rule (the “CMS Provider Rule”) requiring all healthcare providers participating in Medicare and Medicaid programs to require staff vaccination. HHS claims that the rule is necessary to safeguard the health and safety of patients and residents who receive care from these providers.
Medicare and Medicaid providers and several states filed suit in the U.S. Supreme Court, challenging the rule. On January 13, 2022, by a 5-4 vote, in Biden v. Missouri, the Supreme Court upheld the CMS Provider Rule as a lawful exercise of CMS’ regulatory authority. The details of the CMS provider rule case are summarized below.
What’s Up With the Supreme Court’s Hearing the CMS Provider Rule Case So Quickly?
The Supreme Court has virtually limitless discretion as to which cases to hear, and virtually limitless discretion as to when to hear the cases it decides to hear. According to the U.S. Supreme Court website, the Court receives approximately 10,000 petitions requesting review of a lower court decision (petitions for a “writ of certiorari”) each year. Of these, the Court grants about 100. In about 70 of the 100 per year, the court hears oral argument and then issues a written decision. Usually, the Court takes several months to decide a case.
But not this one. When the Court decides that a case is of urgent, national significance (or, when it really wants to send one or both litigants a message – no one is sure, since the Court is not required to provide its reasoning for taking a case, much less for why it decides one the way it does), the Court acts promptly. As many may recall, the Court heard arguments in Bush v. Gore, on one day – December 11, 2000 – and issued an opinion halting the 2000 Florida presidential recount the next day.
On January 7, 2022, with lower courts having blocked the CMS provider rule, the Court heard oral arguments in the CMS provider rule case, Biden v. Missouri. It held fast-tracked argument on a related case, NFIB v. OSHA, on the same date, and six days later, by a 6-3 vote blocked an OSHA Emergency Temporary Standard, that would have required vaccination or testing for workplaces with 100 or more employees, from taking effect. As in Bush v. Gore, the stakes in Biden v. Missouri were through the roof: the CMS provider rule applies to approximately 11 million healthcare workers.
The 5-4 Decision: HHS Prevails
On January 13, 2022, by a five-to-four vote, the Court in Biden v. Missouri terminated the lower court blockade of the CMS provider rule, allowing the rule to take effect. The question before the Court was this: Was the CMS provider rule, which requires that, to receive Medicare and Medicaid funding, participating facilities must ensure staff (unless exempt for medical or religious reasons) are vaccinated against COVID–19, lawful?
The Court said “yes.” The majority opinion concluded that the CMS provider rule “fits neatly within the language” of the Medicare and Medicaid laws. Those laws permit the HHS Secretary to impose conditions on the receipt of Medicaid and Medicare funds that “the Secretary finds necessary in the interest of the health and safety of individuals who are furnished services.” HHS has previously issued, and the Court has upheld, myriad rules governing Medicare and Medicaid facilities, from large, infection control rules to hospital size rules to minute rules requiring qualified dieticians to complete at least 900 hours of supervised practice before Medicare and Medicaid can pay for the dietician’s services.
The Court analyzed the CMS provider rule, and found it plausible that the rule was necessary in the interest in the health and safety of Medicare and Medicaid patients. As the majority noted, “After all, ensuring that providers take steps to avoid transmitting a dangerous virus to their patients is consistent with the fundamental principle of the medical profession: first, do no harm. Citing a lower court case, the Court held, “It would be the “very opposite of efficient and effective administration for a facility that is supposed to make people well to make them sick with COVID–19.”
The Angry Dissenters
Both Justices Thomas and Alito issued dissents opining otherwise. Using borderline apocalyptic language, Thomas concluded that the CMS provider rule “Requires millions of healthcare workers to choose between losing their livelihoods and acquiescing to a vaccine they have rejected for months.” Since the Medicare and Medicaid laws did not specifically authorize HHS to require federally funded facilities to vaccinate their workforce, Thomas reasoned, the regulation was invalid. Justice Alito, also clearly irritated by the majority opinion, agreed with Justice Thomas, and further opined that HHS did not follow proper administrative procedures in issuing the rule. To this and other Alito grousing about federal government overreach, the Court answered:
“The challenges posed by a global pandemic do not allow a federal agency to exercise power that Congress has not conferred upon it. At the same time, such unprecedented circumstances provide no grounds for limiting the exercise of authorities the agency has long been recognized to have.”
What are the Requirements of the Healthcare Staff Vaccine Mandate?
The rule, originally scheduled to take effect on January 4, 2022, will now go into effect. The rule requires covered facilities to establish a policy ensuring eligible staff is vaccinated. Specifically, covered facilities must establish a policy requiring all eligible staff to receive the first dose of a two-dose COVID-19 vaccine or a one-dose COVID-19 vaccine prior to providing any care, treatment, or other services. All eligible staff must then receive the necessary shots to be fully vaccinated – either two doses of Pfizer or Moderna or one dose of Johnson & Johnson. The rule also provides exemptions based on recognized medical conditions or religious beliefs, observances, or practices. The exact compliance dates are to be determined.
What Happens Now HIPAA-Wise?
Since the Court upheld the CMS rule, covered facilities must issue policies and procedures for vaccination that comply with HIPAA. Since the rule regulates not patients, but rather staff members, an interesting HIPAA issue arises. What if a patient demands to know whether a particular staff member is vaccinated? Under current law (and the CMS rule does nothing to change this), individuals may ask for the vaccination status of staff, but a provider may refuse to provide that information. Per the rule, Medicare and Medicaid providers must have a process for tracking and documenting the COVID-19 vaccination status of staff members.
