CMS Flu Vaccine Requirements for Healthcare Workers

CMS flu vaccine requirements for healthcare workers don’t force any individual to get vaccinated. They require the facility to run an active flu vaccination program, track every worker’s vaccination status by category, and report the numbers to the CDC’s National Healthcare Safety Network once a year. Workers can decline for medical, religious, or personal reasons, but the facility has to account for them. Facilities that skip the reporting, or let their vaccination program lapse as part of broader infection control failures, face Medicare payment reductions and, at the far end, loss of their Medicare agreement.

Which Facilities the Rule Covers

The requirement is tied to CMS Quality Reporting Programs, so it lands on specific facility types rather than every Medicare provider. Facilities currently required to report healthcare personnel influenza vaccination data through NHSN include acute care hospitals, critical access hospitals, inpatient rehabilitation facilities (including IRF units inside other hospitals), long-term acute care hospitals, skilled nursing facilities, and PPS-exempt cancer hospitals.¹²³

Outpatient dialysis facilities used to report but have been exempt from the CMS flu vaccination reporting requirement since the 2018–2019 season, though state rules may still apply.⁴

The underlying legal hook for hospitals is 42 CFR 482.42, the Condition of Participation on infection prevention and control, which requires an active facility-wide program for surveillance, prevention, and control of healthcare-associated infections.⁵

Who Counts as a Healthcare Worker

CMS uses a wide definition. If you spend time inside the facility during flu season, you probably count, regardless of whether you’re on the payroll or wearing scrubs. Reporting groups everyone into three categories:

Employees on the facility’s payroll, in any role.
Licensed independent practitioners who aren’t employees — physicians, advanced practice nurses, and physician assistants.
Adult students, trainees, and volunteers age 18 or older.

Contract workers get pulled in too. Outside cleaning crews, maintenance workers, and billing staff who physically work at the facility count in its numbers.⁶

There’s one bright line. A person only counts if they are physically present at the facility for at least one working day between October 1 and March 31. Fully remote employees and telemedicine providers who never step inside during flu season are excluded from the count.⁶

What the Facility’s Vaccination Program Must Do

Every covered facility must maintain a written flu vaccination policy for the influenza season, defined as October 1 through March 31.⁷ The policy has to include education on the benefits of vaccination and the risks of influenza, and a system that securely documents each worker’s vaccination status.

Vaccinations administered somewhere else — a pharmacy, a personal doctor’s office — still count toward the facility’s rate, but only if the facility has documentation to back them up.⁶ “Offered a flyer in October” is not an active vaccination program. Surveyors expect to see evidence that the facility actually pursued vaccination throughout the season.

How Workers Can Decline

Nothing in the CMS rule forces an individual worker to accept the shot. What the rule requires is that every unvaccinated person fall into a recognized category on the facility’s report.

Medical Contraindications

A worker with a legitimate medical reason to skip the vaccine, such as a severe allergic reaction to a vaccine component, is counted as a medical contraindication. For NHSN reporting, the CDC accepts a verbal statement — no written documentation is required at the reporting level.⁶ Most facilities set a higher internal bar and ask for a note from a licensed practitioner.

Religious Exemptions

CMS also recognizes exemptions based on sincerely held religious beliefs. Facilities must have a process for workers to request one and must evaluate those requests under Title VII of the Civil Rights Act. CMS directs facilities to the EEOC’s Compliance Manual on Religious Discrimination for guidance on assessing sincerity.⁸

Personal Declinations

A worker who refuses without claiming a medical or religious reason is reported as “declined.” This is the catch-all for personal, philosophical, or unstated reasons. NHSN accepts a verbal statement for declinations too, though facilities typically ask workers to sign an internal declination form for their own records.⁶

Annual Reporting and the May 15 Deadline

Facilities submit their numbers through the NHSN Healthcare Personnel Safety Component. One summary form per season covers October 1 through March 31, broken down by the three worker categories and by outcome: vaccinated, medical contraindication, or declined.⁹¹⁰

For the 2025–2026 season, all data must be entered into NHSN no later than May 15, 2026. CDC forwards the data to CMS after that date, and edits made after May 15 don’t get sent along. In compliance terms, data that isn’t in NHSN by May 15 doesn’t exist.⁶

The submission bar is high. For IRFs and LTACHs, the data completeness threshold is 100 percent, meaning the facility must submit vaccination data for every required worker, not a sample.¹¹¹²

What Non-Compliance Costs

Missing the report or failing quality program requirements hits the facility’s Medicare payment update for the year:

Skilled nursing facilities lose 2 percentage points from the Annual Payment Update for failing to submit required quality data, including flu vaccination reporting.²
Inpatient rehabilitation facilities take a 2 percentage point reduction to the annual payment update, in effect since FY 2016.¹¹
Long-term acute care hospitals face the same 2 percentage point reduction to the Annual Payment Update.¹²
Acute care hospitals under the Hospital Inpatient Quality Reporting Program lose one-quarter of the applicable annual payment rate update for failing to meet all program requirements.¹³

Two percent sounds small on paper. On every Medicare claim, every fiscal year, it isn’t.

Payment cuts are the routine consequence, not the ceiling. Flu vaccination programs sit inside the broader Conditions of Participation on infection prevention, and a facility that lets its program lapse can pick up a deficiency citation on survey. Under 42 CFR 489.53, CMS can terminate a facility’s Medicare agreement when it no longer meets applicable Conditions of Participation, with at least 15 days’ notice, or as few as 2 days in immediate jeopardy situations.¹⁴ Termination over flu reporting alone would be unusual; termination that includes flu program failures as part of a wider infection control pattern is not.

1
CDC. Operational Guidance for Inpatient Rehabilitation Facilities to Report HCP Influenza Vaccination Data to NHSN
2
Centers for Medicare & Medicaid Services. Skilled Nursing Facility Quality Reporting Program
3
CDC. Operational Guidance for PPS-Exempt Cancer Hospitals to Report HCP Influenza Vaccination Data to NHSN
4
CDC. Tips for Submitting HCP Influenza Vaccination Summary Data for Outpatient Dialysis Facilities
5
eCFR. 42 CFR 482.42 – Condition of Participation: Infection Prevention and Control and Antibiotic Stewardship Programs
6
Centers for Disease Control and Prevention. HCP Influenza Vaccination Summary Reporting FAQs
7
Centers for Disease Control and Prevention. Operational Guidance for Skilled Nursing Facilities to Report Annual Influenza Vaccination Data to NHSN
8
CMS. QSO-22-07 ALL Long-Term Care and Skilled Nursing Facility Attachment A
9
Centers for Disease Control and Prevention. HCP Flu Vaccination – HPS – NHSN
10
CDC. Tips for Submitting HCP Influenza Vaccination Summary Data for CMS SNF Quality Reporting Program
11
eCFR. 42 CFR 412.634 – Requirements Under the Inpatient Rehabilitation Facility Quality Reporting Program
12
Centers for Medicare & Medicaid Services. FY2025 Long-Term Care Hospital Quality Reporting Program FAQs
13
Centers for Medicare & Medicaid Services. Hospital Inpatient Quality Reporting Program
14
eCFR. 42 CFR 489.53 – Termination by CMS