<img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=1748356452286451&amp;ev=PageView&amp;noscript=1">
Skip to content
22 min read

Emergency Preparedness Programs Compliance


In 2016, thousands of healthcare providers were surprised to learn that they were expected to participate in the nation’s Emergency Preparedness programs. A year later, they were further surprised when they were asked to demonstrate that they had been compliant with the updated Conditions of Participation for the past year.

Since most clinicians are interested in dealing with patient problems, treatments, techniques, and basic office operations, many ask how this EP environment came about and how to deal with it.

In May 1998 - Pres. Bill Clinton’s administration recognized health services as part of the national infrastructure (Presidential Decision Directive 63).

”On March 30, 2011, President Obama signed the Presidential Policy Directive (PPD) 8 on National Preparedness. This directive instructs the federal government to strengthen our nation’s security and resilience against a variety of hazards, including terrorism, pandemics, and catastrophic natural disasters…”


Healthcare now ranks among the nation’s “Critical Infrastructure and Key Resources” (CIKR).

Developed by the Department of Homeland Security, the National Infrastructure Protection Plan (NIPP) which includes healthcare, addresses a number of key areas and responsibilities, including:

  • Identify, deter, detect, disrupt, and prepare for threats and hazards to the nation’s critical infrastructure.
  • Reduce vulnerabilities in critical systems, assets, and networks
  • Mitigate the potential consequences for critical infrastructure of adverse events and incidents that occur.

Medicare State Operations Manual 102_appendix Z_Emergency Preparedness includes the requirements for all 17 Medicare provider types, including OPT/Rehabilitation Agencies. The CMS Condition of Participation 485.727 (QUAD A Standard 5-D-1) calls for Medicare OPT providers to develop an Emergency Preparedness Program. As we look at what this entails, let us remember that emergency preparedness is not simply a policy manual and annual activity. It is intended to become a way of life in every Medicare facility of every provider type.

The Emergency Preparedness Program has several components.

  • The Emergency Plan outlines how the organization will deal with emergency events in general.
  • It is driven by a robust “All Hazards Vulnerability Assessment” that rigorously identifies potential threats from natural, man-made, and/or facility emergencies. It analyzes their implications and evaluates their consequences and impact on the organization and the community.
  • Leadership’s decisions about how the organization operates are recorded in the Policies and Procedures
  • To avoid isolation and facilitate collaboration with other entities within the greater community and the healthcare community, a Communication Plan was developed.
  • To ensure that the facility’s staff knows what the organization plans to do and is competent to execute the plan, initial and ongoing Training is provided to the staff.
  • In addition, by participating in drills and exercises, the plan is Tested for effectiveness, each component is updated accordingly, and the findings are incorporated into the following phase of the improvement cycle feedback loop.

Program - The program can be described as the overall container vessel for what your organization has done, does, and will do before, during, and after an emergency event. The first component of your program will be a written descriptive Plan for how you intend to deal with emergencies in general. This would be distilled into details for each type of emergency that might occur. Therefore, this will include written policies for preparation, response, and recovery.

A key to how your organization intends to deal with emergencies is your All Hazards Vulnerability Assessment, viewed from a “Whole Facility” perspective. A robust instrument such as the Kaiser Permanente Hazard Vulnerability Assessment Tool, available at https://www.calhospitalprepare.org/hazard-vulnerability-analysis uses an Excel spreadsheet to identify potential threats and evaluate them in terms of potential damage, likelihood of occurrence, severity of threats, and the effect on your practice or institution. The data is then analyzed and graphed by the software for your reference.

With the graphed information, you can better understand the cause-and-effect relationships of different events, whether technological, natural, or human-made.
“What emergency might occur?”

“What effects might they have?”

“How can we survive now and in the future as an organization?”

  • Written Policies will serve as a reference during an emergency to explain what your organization intends to do and expects from its leaders, employees, vendors, and patients/clients in the event of an emergency. By having a well-defined policy, you can ensure that everyone understands their roles and responsibilities during an emergency and that these roles are consistently applied across all aspects of your organization.
  • The Communications Plan demonstrates your ability to provide and acquire information concerning your organization's emergency preparedness. CMS expects your organization to communicate with your constituents, government, and services as well as other healthcare organizations. The requirements stipulate that you maintain contact information for political jurisdictions, law enforcement, fire rescue providers, significant participants in your organization, referral sources, vendors, staff, and clients. Even if you will close on the day a hurricane is expected to arrive, you should discuss how you will communicate this information to all parties involved.

Organizations often use the Internet to access routine business software such as word processors, spreadsheets, and email. In addition, many facilities utilize web-based applications for maintaining patient records, including billing records, personnel records, treatment protocols, patient education, and a variety of other applications. Many individuals and businesses rely on “Voice over Internet Protocol” (VOIP) – a telephone service that depends on a functional internet connection. In the event that electrical power or internet services that rely on VHF, UHF are lost or satellite service fails, the organization may be left without communication.

In an emergency, cellular telephone service is equally susceptible to electrical or signal failures. Some providers plan to use satellite telephones in an emergency. Others have obtained amateur radio (“Ham”) operator licenses. The use of a “runner” to communicate with appropriate entities is legitimate. It is prudent for planners to consider backup communication methods prior to any emergency in order to ensure that vital information can be conveyed in a timely manner regardless of the situation. The CMS does not stipulate how to deal with each problem. However, it asks that you address what you will do if these problems arise.

Training and Testing the Plan

  • In the past, healthcare providers might have conducted quarterly fire drills or annual disaster drills, but today we are considered critical infrastructure resources for our communities and regions, so we are required to prepare and participate in "Full-Scale" exercises and/or drills.
  • Medicare defines Full-Scale as multi-jurisdictional, and governed by community authorities above organizational management. This would imply the sort of activity that accompanies a simulated annual countywide hurricane drill or airline crash. Other areas may have multijurisdictional earthquake (“Shakeout”), tornado, flood, or blizzard exercises.
  • Join the Consortium! Be aware that many regions or states offer “consortiums” for Emergency Preparedness planning and exercise activities. Documentation of real participation in these activities is acceptable for compliance purposes. It may be more feasible than trying to get your small clinic accepted as a “player” in your county’s large annual disaster drill.
  • Tabletop Exercise (TTX): To be clear, while it is beneficial to gather the staff over lunch to discuss what the facility will do in an emergency, this does not meet the Condition of Participation or the standard requirements.
  • A Tabletop Exercise is a discussion-based exercise that involves senior staff, elected or appointed officials, and other key decision-making personnel in a group discussion centered on a hypothetical scenario. A compliant tabletop exercise or workshop is led by a facilitator. It includes a group discussion using a narrated clinically-relevant emergency scenario and a set of problem statements, directed messages, or prepared questions designed to challenge an emergency plan.”


  • Training: A critical part of preparing for an emergency, whether large or small, is ensuring that leaders and staff know what is happening, and what to do about it, according to the organization’s pre-planned policies. Training is required for this purpose. To ensure employees are prepared, regular training sessions should be conducted on emergency procedures. These sessions should focus on how to respond to the organization's specific needs.
  • Consequently, the organization must review and update its training and emergency response policies at least annually (485.727 d).
  • It is required to participate in a Full-Scale Drill to test its plan and competence every two years.
  • Outpatient providers are required to test their own Emergency Preparedness Plan annually opposite the year of their participation in a Full-Scale Drill (So, at least every two years their exercise must be a Full-Scale exercise).


  • For Medicare facilities, the plan must be reviewed and updated at least every two years. This periodic review must be documented with the review date. It must also include any updates made to the emergency plan as a result of reviewing the format used by the facility.
  • It is essential to train new employees and evaluate their competence during orientation (or shortly thereafter) to ensure that the initial training was productive.
  • Outpatient providers are required to conduct one “testing” exercise annually (their exercise must be a full-scale exercise every two years). This is to test their plan, execution, and effectiveness. The expectation is that “lessons learned” from the test will be used to update the plan. Providers should expect a surveyor to request documentation of the exercises and tests performed in recent years.
  • Facilities must be able to demonstrate additional training when the emergency plan is significantly updated.
  • Participate in a full-scale community exercise every two years. When a community-based exercise is not accessible, conduct a facility-based functional exercise every two years. Document the reasons why it is not accessible.
  • Experiencing an actual natural or man-made emergency exempts the facility from its next required community or individual facility-based functional exercise.
  • Conduct an additional exercise every two years opposite the year of the full-scale or functional exercise. This may be:
    • A second full-scale exercise or individual facility-based functional exercise
    • A mock disaster drill
    • A tabletop exercise or workshop led by a facilitator and includes a group discussion using a narrated clinically-relevant emergency scenario and a set of problem statements, directed messages, or prepared questions designed to challenge an emergency plan.
  • Keep a record of the intention, execution, and results of your organization's drills. Analyze their impact on each plan component.

The author sincerely hopes that this information has improved the reader’s understanding of the history and rationale for the Emergency Preparedness Program requirements. Additionally, the author provides some direction and instructions on how to follow this condition of participation.

At QUAD A, our goal is to be your go-to provider for accreditation – always striving to be an effective, efficient, and easy-to-work-with partner that values education, reliability, and communication.