Surveyors counted the people hospitals don’t employ: the CMS staff rule after the Supreme Court

The week

For nearly two years, hospitals had lived with COVID-19 as a clinical crisis. In the second week of January 2022, it also became a test of record-keeping, with Medicare and Medicaid participation riding on the result.

How the rule got to the Court

The story started two months earlier. On November 5, 2021, the Centers for Medicare & Medicaid Services published an interim final rule requiring staff at Medicare- and Medicaid-certified providers and suppliers to be vaccinated against COVID-19. CMS is the federal agency that runs those two programs and pays a large share of most hospitals’ bills.

An interim final rule is one an agency puts into effect before finishing the usual public comment process, generally because it argues the matter cannot wait. This one set two phases. In the first, staff needed at least a first dose, or a pending or granted exemption. In the second, they needed to be fully vaccinated. The original deadlines fell in early December 2021 and early January 2022.

The rule reached about fifteen categories of certified provider and supplier. Hospitals and critical access hospitals were on the list. So were nursing homes, home health agencies, hospices, ambulatory surgical centers, dialysis facilities, rural health clinics and federally qualified health centers, among others. Physician offices that CMS does not regulate as a certified provider type were not directly covered.

The legal fight moved fast. In late November 2021, two federal district courts blocked the rule, one for a group of states that had sued in Missouri and one in Louisiana that initially applied nationwide. On December 15, the Fifth Circuit narrowed the Louisiana order to the states that had brought that case. Texas had won a separate order of its own.

That left the country split. In the states not covered by any injunction, CMS told surveyors on December 28 to begin checking compliance, with a first deadline of January 27 and a second of February 28. In the other states, the rule was on hold. The Supreme Court heard argument on January 7.

The two decisions

On January 13, 2022, the Supreme Court decided two challenges to federal COVID-19 vaccination rules on the same day, and it split them. Both were unsigned, per curiam rulings on emergency applications rather than final judgments after full briefing.

In National Federation of Independent Business v. OSHA, by six votes to three, it stayed the emergency standard that the Occupational Safety and Health Administration had written for employers with 100 or more employees. That standard would have required vaccination or regular testing. A stay is a pause: the rule could not be enforced while the legal fight went on. The majority reasoned that OSHA’s statute let it regulate workplace hazards, not set broad public health measures.

In Biden v. Missouri, by five votes to four, the Court went the other way for health care. It allowed CMS to enforce its rule. The majority relied on the Secretary of Health and Human Services’ authority to set conditions that protect the health and safety of patients. It also noted that health care workers were already commonly required to be vaccinated against other diseases.

A month earlier, on December 27, OSHA had withdrawn most of its separate COVID-19 emergency standard for health care employers, keeping only its recordkeeping provisions. So by mid-January, the CMS rule was the main federal vaccination requirement left standing for hospitals.

The definition that mattered

The detail that mattered most to hospital operators was a definition. The CMS rule defined “staff” broadly. It covered employees, but also licensed practitioners, students, trainees, volunteers and people providing care, treatment or other services under contract or other arrangement. It applied regardless of clinical responsibility or patient contact.

There were limited exceptions. Staff working entirely outside the facility, such as remote workers who never came on site, were not covered. CMS said outside service providers, such as an occasional repair worker, should be assessed case by case. The rule followed the people in the building rather than the people on the payroll.

What happened next that week

The checking itself would fall to state survey agencies, and to accrediting organizations such as The Joint Commission for hospitals they accredit. State surveyors are the inspectors who visit hospitals, nursing homes and other providers on CMS’s behalf. They confirm that a provider meets the “conditions of participation,” the federal rulebook it must follow to keep taking Medicare and Medicaid patients.

On January 14, the day after the ruling, CMS issued guidance for the 24 states where the injunctions had now lifted. Facilities there had until February 14 for the first phase and March 15 for the second. Texas followed a week later on a slightly later timetable. The Omicron wave was near its peak at the time, and many hospitals were short of staff.

So every certified facility faced a practical question that week, whatever it thought of the rule or its vaccination rate. Could it hand an inspector an accurate list of everyone who counted as staff, and show the status of each person on it?

The September 2021 vaccine-or-test plan had forced employers to build ways of collecting status, managing testing and handling exemptions. The Supreme Court’s January 2022 decisions settled which of those rules would bind health care, and they changed the question.

For certified providers, the test would no longer be an employer’s internal policy. It would be an inspection under the conditions of participation, conducted by a state surveyor or accreditor who would ask for a list of covered staff and check it against the people actually working. That made the denominator the hard part: not how many people were vaccinated, but how many people there were to count in the first place.

The problem had three parts: who counted as staff, what evidence a surveyor would accept, and who was obliged to supply it. Each applies to any organization that depends on people it doesn’t directly employ. Before taking them in turn, the first section explains the inspection machinery that gave the rule its teeth. After them come three more: how a facility could make the list a by-product of routine, why the question has outlived the rule, and the questions a leader can ask today.

How a survey works

The way hospitals are regulated shaped everything that followed. A hospital that wants to treat Medicare and Medicaid patients and be paid for it has to meet a set of federal requirements called the conditions of participation. They cover everything from infection control to medical records. For most hospitals, those two programs are too large a share of revenue to give up, so the conditions work as a license to operate in all but name.

CMS does not usually send its own staff to check. It relies on state survey agencies, whose inspectors, called surveyors, arrive at a facility, review documents, walk the floors, interview people and write up what they find. Many hospitals are instead surveyed by an accrediting organization that CMS has approved, a status known as deemed status. Either way, a shortfall becomes a citation, sometimes called a deficiency, and the facility must submit a plan to fix it. Repeated or serious failures can escalate.

The CMS vaccination rule plugged into that existing machinery. That was a meaningful choice. An internal policy is something an organization can interpret generously. An inspection is a moment when an outsider asks for proof, on the spot, and compares the paperwork with what they can see.

How a visit unfolds

A typical survey starts with an entrance conference, where the team tells facility leaders what it needs and how fast. Documents requested at that meeting are expected within hours, not days. For the vaccination requirement, CMS guidance told surveyors to ask for the facility’s policies and procedures and a list of all staff with their vaccination status. They also asked for records of exemption requests and decisions, and for the additional precautions applied to unvaccinated staff.

Surveyors then test the documents against reality. They observe who is working on a unit, ask people about their role and employer, and look for those names on the list. The method resembles an auditor tracing a sample of transactions back to the ledger. The sample does not need to be large to be damning. One contracted transport aide missing from the list shows that the list was built from the wrong sources.

How severity was judged

CMS’s enforcement memos treated anything below full compliance as noncompliance, but set out how surveyors should weigh it. In the first phase, a facility with at least 80 percent of staff vaccinated and a plan to reach 100 percent within 60 days would generally not face further enforcement. In the second, the equivalent mark was 90 percent, with a plan to close the gap within 30 days. Higher shares of unvaccinated staff could support more serious findings, up to immediate jeopardy.

Those thresholds were about rates, but every rate has a denominator. A facility could only claim 92 percent if it could show who the hundred percent were. A list that left out two hundred contracted workers would overstate the rate, and a surveyor who found those workers on the floor would discount the whole calculation.

What was at stake differed by provider type

The consequences of a finding depended on the kind of facility. For nursing homes, home health agencies and hospices, CMS had a range of remedies, including civil money penalties and denial of payment, with termination as a last resort. For hospitals and several other provider types, the formal remedy for unresolved noncompliance was termination from the programs. CMS said facilities would generally get a chance to correct problems first.

That asymmetry changed behavior. A hospital faced a remedy too drastic to be used lightly, so the real cost of a finding was the correction plan, the follow-up survey and the reputational damage. A nursing home faced fines that could arrive without the program ending. Nursing homes had also been reporting staff vaccination data to the Centers for Disease Control and Prevention’s National Healthcare Safety Network since 2021, so many already had a roster shaped for counting.

Who counted as staff

The rule’s definition reached far past the payroll. It covered physicians and advanced practice clinicians with privileges but employed elsewhere, residents and nursing students on rotation, volunteers, and contractors who provided care, treatment or other services to the facility or its patients. Agency nurses, traveling therapists, contracted environmental services and food service staff, dialysis teams working under arrangement, equipment service technicians and on-site IT contractors could all fall inside it.

A word on “privileges,” since it trips up many non-clinical leaders. Many doctors who treat patients in a hospital are not its employees. They belong to a private practice or another health system, and the hospital grants them permission, after a credentialing review, to admit and treat patients there. Those doctors may be among the most visible people in the building and appear on none of its payroll reports.

Each of those groups lived in a different system. The medical staff office tracked privileged practitioners. Graduate medical education and nursing schools held rotation schedules under affiliation agreements. Vendor credentialing services logged some visiting representatives at the door. Departments arranged other contractors directly, and some appeared only in purchase orders. Not one of these systems was designed to answer how many people were working in a building on a given day.

Where the edges were

The edges also needed rules. Someone who visits once to repair equipment is treated differently from a contractor who comes weekly. A remote coder never enters the facility. A practitioner with privileges at three hospitals counts at each. Facilities had to write those rules down so that the list could be built the same way every time and defended when a surveyor asked why someone was absent from it.

A good definition document was short and concrete. It listed each population by name, said which system was its source, and gave a rule for each awkward case. A traveling nurse counted from the first shift. A medical student counted while on rotation, not while enrolled at a distant school. A software vendor’s engineer counted if on site to support a go-live, and not if working only by remote connection. The decisions mattered less than writing them down once.

How the boundary shifted by type of provider

The same definition produced very different lists in different settings. An academic medical center might have residents employed by an affiliated university, students from several schools and researchers with clinical access. Its hardest population was trainees, whose numbers changed every few weeks.

A home health agency had no building to count people in. Its staff worked in patients’ homes, which counted as delivering care, so the remote-work exception did not reach them. Its hardest problem was confirming status for clinicians who rarely visited the office.

A critical access hospital in a rural county often relied heavily on agency nurses and visiting specialists. Its list might be small, but a large share of it sat outside its own HR system. A dialysis facility had a compact, stable staff, and its hardest cases were the technicians who serviced equipment.

Multi-hospital systems faced a further twist. A contracted service might cover every site, and a practitioner might hold privileges at four of them. Each certified facility needed its own accurate list, so a system-wide roster had to record where each person actually worked.

Matching names across lists

Joining those sources exposed an identifier problem. In data terms, a “join” is lining up records from two lists that refer to the same thing. It works well when both lists share a reliable key, such as an identification number. It works badly when the only common thread is a name.

An agency nurse might appear under a legal name in the agency’s roster, a nickname on the badge and a different spelling in the timekeeping system. Students often had no employee number at all. Facilities that assigned a person identifier at first badge issue, and carried it into every downstream system, could match records automatically. Others matched by hand, and the hand-built list drifted within weeks.

This is the less glamorous side of what technologists call identity management: knowing, with confidence, that the person in one system is the same person in another. Most organizations invest in it for employees because the HR system gives everyone a number on day one. For everyone else, there is often no front door, so there is no number.

Matching by name and date of birth works better than matching by name alone, but it brings its own risk. Date of birth is personal data, and copying it into more systems widens the exposure. A facility-issued identifier avoids that. It carries no meaning outside the facility and can be printed on a badge without revealing anything sensitive.

What evidence a surveyor would accept

CMS guidance told surveyors to review the facility’s policies, its list of staff with their status, and its handling of exemption requests. A facility could have a high vaccination rate and still be cited if its list was incomplete or inconsistent with the people seen on the floor. Surveyors could interview staff and compare names against the roster, so a contracted worker missing from the list was a finding regardless of their status.

A hospital could be doing well on the outcome the rule cared about and still fail the inspection, because it could not prove it. Boards will know the pattern from financial audits: being right is not enough; the facility has to be demonstrably right.

What the record for each person needed

That pushed facilities toward evidence they could reproduce. A list generated from a join of HR, medical staff, student and contractor records on the day of the survey is more credible than a spreadsheet updated by hand. A defensible record for each person tended to hold a small set of fields:

• a facility identifier and the person’s name as it appears on the badge;
• the population they belong to and the sponsor responsible for them, such as a department, a school or a staffing agency;
• the site or sites where they work, and their first and last dates on site;
• their status, the source of that status and the date it was verified;
• for exemptions, the type requested, the decision, the date and who decided;
• the additional precautions applied, such as testing or masking, where the facility used them.

Every field had to come from somewhere. The status source mattered because a surveyor could ask to see it. A line saying “vaccinated, per agency” was weaker than one pointing to a card image or an immunization registry record held under the facility’s access controls.

Exemptions as their own evidence trail

Exemption files contain medical and religious information, which raises the privacy stakes. Employee vaccination records an employer holds are generally employment records rather than protected health information under HIPAA, the federal health privacy law. But disability and employment law still require confidentiality and restricted access. How those rules apply in a given state is a question for the facility’s lawyers.

The rule required facilities to have a process for exemption requests and to track decisions. That made the exemption log a document in its own right. It needed to show that requests were decided on a consistent standard, by named people, with dates. The supporting files themselves belonged in a separate, restricted store, linked to the main list only by the facility identifier. A surveyor could see that a decision existed without the compliance team copying medical details into a spreadsheet.

Religious exemption decisions carried their own legal frame. Federal employment law requires employers to consider religious accommodation requests, and the federal Equal Employment Opportunity Commission had published guidance on COVID-19 vaccination in that context. A facility that granted or denied requests inconsistently invited both survey findings and employment claims. Counsel’s involvement in the standard, not in every case, was the practical balance.

Keeping it current

The evidence also had to stay current. People join and leave every week. Agency staff rotate in for thirteen-week contracts. A list that was accurate in February and untouched in April would fail. Facilities that assigned an owner for each population and set a weekly reconciliation cadence could produce a current list on demand. Reconciliation, here, means comparing the list against its sources on a schedule and fixing the differences.

A few simple measures showed whether the process was working. One was the share of active badges matched to a list entry. Another was the number of list entries with no badge activity in thirty days. A third was the age of open exceptions, and a fourth the time taken to generate the full list from a standing start. These are data quality measures rather than vaccination measures, and data quality was what the survey was really testing.

Rehearsing the request

The facilities that did best treated the surveyor’s request as something to rehearse. A compliance lead would ask, without warning, for the full list as of that morning, and time how long it took to produce. A second person would then walk two or three units and check the names of the people working there against it.

The rehearsal tended to fail in predictable places. Night and weekend shifts were full of agency staff whose records lagged. Units with heavy student rotations showed names the list did not know. Contracted services that worked outside normal hours, such as overnight cleaning crews, were often missing entirely. Each failure pointed to a source population whose owner needed to change a process, not to a spreadsheet that needed another row.

Rehearsal also tested the people who would be asked. Surveyors interview staff, and a contracted worker asked who employed them and how their status was recorded might give an answer that did not match the file. Short briefings for supervisors, explaining what the list was and where it came from, made those conversations consistent. The goal was not coaching. It was making sure that the facility’s account of its own process matched what front-line managers actually did.

Who was obliged to supply it

A hospital cannot inspect a staffing agency’s files or a nursing school’s records unless an agreement lets it. Many staffing contracts and affiliation agreements predated the pandemic and said nothing about vaccination status, exemption decisions or notice when a worker’s status changed. Some agencies offered attestations rather than documents. Some schools would not share exemption details at all.

Contract terms that carried the obligation

Facilities resolved this through contract amendments. Useful terms included:

• a duty to provide status or attestation before a worker’s first shift;
• a duty to notify the facility of changes;
• a statement of who decides exemptions for non-employees, and on what standard;
• audit rights over the supplier’s records;
• a named contact at the supplier for survey-day requests.

The decision about exemptions mattered most. A facility that accepted a supplier’s exemption decisions without seeing them still owned the result in a survey, so many kept the decision in-house or required supporting documents. You can outsource the work; you cannot outsource the accountability.

The cost of insisting

These amendments had a cost. Smaller agencies and schools pushed back, and at the height of the Omicron surge, facilities needed contract labor too much to lose suppliers over paperwork. The workable compromise was attestation backed by spot audits, with the audit results kept as survey evidence. An attestation is a signed statement that something is true; a spot audit is checking a sample of those statements against the underlying records. Together they give reasonable confidence without demanding every document up front.

Bargaining power varied by relationship. A large health system that was a staffing agency’s biggest customer could set terms. A small rural hospital that depended on one agency for night coverage could not. Schools posed a different problem. A nursing program placing students at a dozen hospitals faced a dozen slightly different demands, and some programs responded by setting one standard of their own and asking hospitals to accept it.

Practitioners who are neither employees nor contractors

Privileged practitioners fit neither model. They are not employed and usually not paid by the hospital, so there is no supply contract to amend. The lever is the medical staff bylaws and the credentialing process, which govern who may hold privileges. Changing bylaws requires the medical staff’s own approval process, which can be slow.

Many hospitals handled this through the medical staff office instead, treating vaccination status as information required to keep privileges current. That worked best where the office already ran a reliable reappointment cycle. Where it did not, the vaccination requirement exposed gaps in the basic credentialing record, such as practitioners who still held privileges but had stopped practicing at the hospital years earlier.

The counter-argument: let the supplier carry the risk

A reasonable objection ran the other way. Staffing agencies employ their workers, carry their own compliance duties and know their own people better than any client. Pushing verification onto the hospital duplicates effort and spreads sensitive data into more systems. On this view, an attestation should be enough, and the agency should bear the consequences if it is wrong.

The objection has force for routine employment matters. It fails at survey time, because the conditions of participation bind the certified facility, not its vendors. A surveyor citing a hospital for an unlisted contractor will not accept a reference to the agency’s contract as a correction plan. Attestation plus audit respects the supplier’s role while keeping the evidence where the obligation falls.

Making the list a by-product of routine

The fix required no exotic software, only an understanding of a handful of ordinary systems and how they relate. The most important idea is the “system of record”: the one place an organization treats as the official answer to a question. The HR system is the system of record for employees. The medical staff office’s credentialing database is the system of record for privileged practitioners. The trouble in 2022 was that many other groups had no system of record at all. Agency nurses, students and contracted technicians lived in a mix of emails, rosters and purchase orders.

The badge office as front door

The second idea is the badge system, which most hospitals already ran for physical security. Because nearly everyone who works on site needs a badge to get through the doors, the badge office is often the closest thing a facility has to a front door for non-employees. That made it a natural place to issue the single person identifier described above, and to capture the sponsor, the department or supplier responsible for each person.

Badges also expire. A facility that issued non-employee badges with an end date tied to the contract or rotation got automatic cleanup. One that issued open-ended badges accumulated active credentials for people long gone. The vaccination list surfaced those badges, because each needed a status and nobody could supply one.

Integration over copying

The third idea is integration: getting systems to share data automatically rather than relying on someone to copy it across. A modest integration might send each new badge record, with its identifier, to the timekeeping system and the IT account system. Once that happens, a report rather than a person can produce the weekly list. The report can also flag anyone who has a badge but no recorded status, or a status but no badge.

The order of work mattered. Teams that started by buying a new tracking tool often spent weeks configuring it while the spreadsheet kept growing. Teams that started with the definition and the identifier could use whatever reporting they already had. The tool could come later, once the data was clean enough to load.

Building the list at a mid-sized hospital

Take a hypothetical mid-sized hospital. Its HR system lists its employees. When the compliance team first tries to answer the surveyor’s question, the HR report is the obvious starting point, and it is badly incomplete.

The team then pulls the medical staff office’s list of privileged practitioners and the residency program’s rotation schedule. It adds the nursing school rotations, the volunteer office’s roster and the staffing agency’s list of nurses currently on assignment. Facilities management supplies the names of contracted cleaners and the biomedical equipment service firm. IT adds two on-site contractors working on a system upgrade.

Putting those lists together reveals the problems described above. Some people appear twice under different spellings. Some contractors appear only as a company name on a purchase order, with no individuals listed. A volunteer program has been paused, but its roster still shows active names. Two doctors hold privileges but have not admitted a patient in a year, and nobody is sure whether they count.

A team that handles this well does four things. It writes a short policy defining each population and the edge cases. It names an owner for each source list. It gives every person a single identifier, issued when they first receive a badge, and records it in every system. And it runs the join weekly, investigating the exceptions rather than patching the spreadsheet. By the time a surveyor arrives, the list is a by-product of routine, not a last-minute project.

Who owns what

Ownership is where these efforts usually stall, because the list crosses departments that rarely work together. A workable split gave each source population to the office that already managed it. HR owned employees, the medical staff office owned practitioners, and education owned trainees. Volunteer services owned volunteers, and supply chain or vendor management owned contractors. The badge office owned the identifier. Compliance owned the definition and the weekly exceptions review. IT owned the integration and the report.

That split also clarified escalation. When a contractor appeared at the door with no record, the badge office knew whom to call. When a department arranged a contractor directly, bypassing supply chain, the weekly report caught the person at the next badge swipe. The governance was light, but it had to be written down and given to named people.

The practice that works, and how it fails

The practice that works is not exotic. It consists of:

• A written definition of who counts as on-site workforce, including the awkward cases.
• One identifier per person, assigned at the first point of contact and carried everywhere.
• A generated list, built from source systems on demand, not maintained by hand.
• Named owners for each population, with a regular reconciliation cadence.
• Contracts that match the obligation, so suppliers must provide what the facility will be asked to show.
• Restricted access to sensitive exemption files, with counsel’s input on state law.

The failures mirror those. Organizations started from the payroll and called it done. They built a heroic spreadsheet before the inspection and let it decay. They accepted a supplier’s word for exemptions without any way to check it. They stored medical and religious information in shared folders that too many people could open. And they treated the whole exercise as a one-off, so the next requirement started from zero.

Who is working here today

Who is working here today? Surveyors asked it to enforce a requirement that has since gone away; boards, regulators and attackers ask it in different forms.

For money, the stakes ran straight to the revenue line, because the inspection tied compliance to Medicare and Medicaid participation. For risk, a contractor nobody tracks is a contractor nobody remembers to offboard: their badge may still open doors and their accounts may still log into clinical systems after the engagement ends. For staff, the burden of hand-built lists fell on managers already stretched by the Omicron surge. For regulators, the episode showed how readily a public health rule could become a test of data quality. And for reputation, a citation for an incomplete list reads very differently in the local press than the facility’s actual vaccination rate would.

The same list, other uses

The register serves several obligations that never went away. Hospitals screen employees and contractors against the HHS Office of Inspector General’s list of excluded individuals, because paying for services furnished by an excluded person can bring penalties. That screening is only as complete as the list of people it runs against. Background checks, annual training, tuberculosis screening and influenza vaccination tracking all need the same denominator.

Security teams need it too. Access reviews for the electronic health record ask managers to confirm that each account still belongs to someone who should have it. For employees, HR termination events drive that. For contractors and students, the end date on the register is often the only trigger available. A facility without one relies on someone remembering to call IT.

The counter-argument: a temporary rule did not justify permanent investment

The strongest objection in January 2022 was about proportion. The rule was an emergency measure, likely to be withdrawn once the pandemic eased. Building a permanent workforce register for it looked like overreach, especially for a small hospital with no spare analysts during a surge.

The objection was right about the rule and wrong about the data. The vaccination requirement did end. The need to know who is working on site did not, because every other use listed above predated the pandemic. A facility that built the register as a vaccination project and disbanded it in 2023 paid twice. One that built it as a workforce identity asset, with vaccination as its first use, paid once.

There was also a narrower objection about privacy. A central register, the argument went, concentrates sensitive data and creates a target. The answer is design, not avoidance. The register needs identity, role, sponsor and dates. Medical and religious details can stay in a restricted store, referenced but not copied. A register built that way holds less sensitive data than the scattered spreadsheets it replaces.

Differences that persist by type of organization

The strategic point applies unevenly. Health care, like many sectors, increasingly relies on people outside the payroll: agency staff, contracted services, students, affiliated physicians. An organization that can only see its employees can only manage part of its workforce.

For a large academic system, the hard part is scale and churn among trainees and researchers. For a rural hospital, it is dependence on a few suppliers who may not share data readily. For a home health agency, it is confirming who is delivering care in places the agency never sees. For a physician group that was outside the CMS rule, the episode may have passed by, but the same gap shows up whenever a payer, an accreditor or an incident asks who had access.

Proving who is in the building

• If an inspector asked today for a list of everyone working in our buildings, how quickly could we produce it, and how would we know it was complete?
• Which groups of non-employees work on our sites, and which system, if any, records each of them?
• Does every person who receives a badge get a single identifier that follows them into our other systems?
• When a contractor or student leaves, what tells us to switch off their badge and system accounts?
• Do our staffing, service and affiliation contracts require suppliers to give us the information regulators expect us to hold?

With hindsight

OSHA withdrew its emergency standard for large employers in late January 2022. The CMS rule stayed in force for more than a year after the Court let it stand.

How the CMS requirement wound down

CMS adjusted how the rule was checked as the pandemic changed. In 2022 it revised its survey guidance, and in October 2022 it issued a consolidated memo. That memo replaced the separate guidance for the three groups of states. It also told state survey agencies and accrediting organizations to review the vaccination requirement during initial and recertification surveys and in response to complaints, rather than on every survey.

The federal public health emergency ended on May 11, 2023, and CMS said that spring it would end the staff vaccination requirement. It withdrew the requirement by a final rule published on June 5, 2023, stopped enforcing it at once, and the withdrawal took effect on August 4. CMS said the risks the rule targeted had largely been addressed. It aligned its approach with how it treats other infectious diseases, such as influenza. The final rule also made clear that facilities could still set their own vaccination policies.

The legal legacy

The legal reasoning in NFIB v. OSHA, about the limits of agency power over questions of vast economic and political significance, was cited in June 2022 in West Virginia v. EPA, where the Court named the major questions doctrine. That doctrine says that when an agency claims power over a question of great economic or political weight, courts expect clear authorization from Congress. The Court applied it again in June 2023, when it struck down the federal student loan forgiveness plan in Biden v. Nebraska.

A year later, in Loper Bright Enterprises v. Raimondo, the Court overruled the Chevron doctrine. Chevron had told courts to defer to an agency’s reasonable reading of an ambiguous statute. Its end means courts now decide for themselves what a statute allows.

Biden v. Missouri itself has aged differently. It rested on CMS’s long-standing power to set conditions for providers that take Medicare and Medicaid money. That power remains the backbone of federal oversight of hospitals. The practical effect is that sweeping new federal rules face a higher legal bar, while conditions of participation remain a strong lever. Planning should allow for the possibility that a headline rule is paused or narrowed in court, and should not assume that every survey requirement is equally fragile.

The reporting trail that followed

The vaccination question also lived on for a time in quality reporting. CMS had added a measure of COVID-19 vaccination coverage among health care personnel to its hospital quality programs, reported through the CDC’s National Healthcare Safety Network. Its denominator counted employees, licensed independent practitioners, and adult students, trainees and volunteers, much like the survey list. In its final payment rule for fiscal 2026, issued in 2025, CMS removed the measure from the Hospital Inpatient Quality Reporting Program.

What outlasted the rule

Operationally, the more lasting legacy drew less attention. The register that some hospitals built for surveyors outlived the rule. A current list of every person working on site, with their sponsor, role and status, turned out to be useful well past the survey. Badge access, clinical system accounts, background checks, exclusion screening and offboarding all needed the same data. A rule about vaccination had, in effect, forced a basic security and governance asset into existence.

By this point in 2026, workforce identity programs at well-run health systems include contractors, students and agency staff as a matter of course. Those that built a one-time spreadsheet in 2022 rebuilt it for the next requirement.

Compliance projects come and go, but the data they demand often does not. When a regulator asks a question your organization struggles to answer, the struggle is usually a symptom of a gap that also affects security, cost and service. Fixing the gap once, as a permanent capability with an owner and a budget, is cheaper than rebuilding a spreadsheet each time a new rule arrives. The organizations that treated January 2022 that way were better prepared for whatever came next, whether it was an audit, a security incident or the need to know who was in the building.