Surveyors counted the people hospitals don’t employ: the CMS staff rule after the Supreme Court
Once the Supreme Court let the CMS staff vaccination rule stand, compliance would be tested by state surveyors against a staff list that included contractors, students and practitioners. Most hospitals had no single list that reached past the payroll.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On January 13, 2022, the Supreme Court decided two challenges to federal COVID-19 vaccination rules. In National Federation of Independent Business v. OSHA, it stayed the Occupational Safety and Health Administration’s emergency standard for large employers. In Biden v. Missouri, it allowed the Centers for Medicare & Medicaid Services to enforce its interim final rule requiring staff at Medicare- and Medicaid-certified providers and suppliers to be vaccinated, subject to medical and religious exemptions. The CMS rule defined staff broadly: employees, licensed practitioners, students, trainees, volunteers and people providing care or services under contract, with limited exceptions such as those working entirely remotely. CMS had already issued survey guidance, and after the ruling it set phased deadlines for the states where court orders had blocked the rule. State survey agencies would check compliance as part of their inspections.
Earlier in this series we looked at the September 2021 vaccine-or-test plan and the capabilities it forced on employers: collecting status, managing testing and handling exemptions. The Supreme Court’s January 2022 decision settled which of those rules would bind health care, and it changed the question. For certified providers, the test would no longer be an employer’s internal policy. It would be an inspection under the conditions of participation, conducted by a state surveyor who would ask for a list of covered staff and check it against the people actually working. That made the denominator the hard part. We look at three parts: who counted as staff, what evidence a surveyor would accept, and who was obliged to supply it.
Who counted as staff
The rule’s definition reached far past the payroll. It covered physicians and advanced practice clinicians with privileges but employed elsewhere, residents and nursing students on rotation, volunteers, and contractors who provided care, treatment or other services to the facility or its patients. Agency nurses, traveling therapists, contracted environmental services and food service staff, dialysis teams working under arrangement, equipment service technicians and on-site IT contractors could all fall inside it.
Each of those groups lived in a different system. The medical staff office tracked privileged practitioners. Graduate medical education and nursing schools held rotation schedules under affiliation agreements. Vendor credentialing services logged some visiting representatives at the door. Departments arranged other contractors directly, and some appeared only in purchase orders. None of these systems was designed to answer how many people were working in a building on a given day.
The edges also needed rules. Someone who visits once to repair equipment is treated differently from a contractor who comes weekly. A remote coder never enters the facility. A practitioner with privileges at three hospitals counts at each. Facilities had to write those rules down so that the list could be built the same way every time and defended when a surveyor asked why someone was absent from it.
Joining those sources exposed an identifier problem. An agency nurse might appear under a legal name in the agency’s roster, a nickname on the badge and a different spelling in the timekeeping system. Students often had no employee number at all. Facilities that assigned a person identifier at first badge issue, and carried it into every downstream system, could match records automatically. Others matched by hand, and the hand-built list drifted within weeks.
What evidence a surveyor would accept
CMS guidance told surveyors to review the facility’s policies, its list of staff with their status, and its handling of exemption requests. A facility could have a high vaccination rate and still be cited if its list was incomplete or inconsistent with the people seen on the floor. Surveyors could interview staff and compare names against the roster, so a contracted worker missing from the list was a finding regardless of their status.
That pushed facilities toward evidence they could reproduce. A list generated from a join of HR, medical staff, student and contractor records on the day of the survey is more credible than a spreadsheet updated by hand. Each entry needs a status, a source for that status, and for exemptions, a dated decision and the additional precautions applied. Exemption files contain medical and religious information. Employee vaccination records an employer holds are generally employment records rather than protected health information under HIPAA, but disability and employment law still require confidentiality and restricted access. Organizations should check with counsel on how those rules apply in their state.
The evidence also had to stay current. People join and leave every week. Agency staff rotate in for thirteen-week contracts. A list that was accurate in February and untouched in April would fail. Facilities that assigned an owner for each population and set a weekly reconciliation cadence could produce a current list on demand.
Who was obliged to supply it
A hospital cannot inspect a staffing agency’s files or a nursing school’s records unless an agreement lets it. Many staffing contracts and affiliation agreements predated the pandemic and said nothing about vaccination status, exemption decisions or notice when a worker’s status changed. Some agencies offered attestations rather than documents. Some schools would not share exemption details at all.
Facilities resolved this through contract amendments. Useful terms included a duty to provide status or attestation before a worker’s first shift, a duty to notify the facility of changes, a statement of who decides exemptions for non-employees and on what standard, and audit rights over the supplier’s records. The decision about exemptions mattered most. A facility that accepted a supplier’s exemption decisions without seeing them still owned the result in a survey, so many kept the decision in-house or required supporting documents.
These amendments had a cost. Smaller agencies and schools pushed back, and at the height of the Omicron surge, facilities needed contract labor too much to lose suppliers over paperwork. The workable compromise was attestation backed by spot audits, with the audit results kept as survey evidence.
With hindsight
OSHA withdrew its emergency standard in late January 2022. CMS ended the staff vaccination requirement in 2023 as the federal public health emergency wound down, withdrawing it by final rule that June. The legal reasoning in NFIB v. OSHA, about the limits of agency power over questions of major economic significance, fed into later Supreme Court decisions that narrowed deference to federal agencies. Operationally, the register that some hospitals built for surveyors outlived the rule. A current list of every person working on site, with their sponsor, role and status, turned out to be the same data needed for badge access, clinical system accounts, background checks and offboarding. By this point in 2026, workforce identity programs at well-run health systems include contractors, students and agency staff as a matter of course. Those that built a one-time spreadsheet in 2022 rebuilt it for the next requirement.