Emergency Preparedness: Medicare and Medicaid Provider and Supplier Requirements (Part 2)

by Michael Kotch

May 28, 2020

In Part 1 , we provided an overview of the Centers for Medicare and Medicaid Services (CMS) rule mandating emergency preparedness for 17 types of Medicare and Medicaid providers and suppliers.

Here we will describe the CMS general requirements that are necessary for compliance with the emergency preparedness rule.


There are five (5) general requirements of the emergency preparedness rule. Specific requirements are dependent on the provider or supplier type. A list and brief synopsis of the general requirements includes the following:

Emergency Preparedness Plan – Requires development, documentation and implementation of a formalized emergency preparedness plan based on a risk assessment using an integrated ‘‘all-hazards’’ approach. This approach is used to identify capacities and capabilities that are critical to preparedness and the plan must do all of the following: (1) Be based on and include a documented, facility-based and community-based risk assessment; (2) Include strategies for addressing emergency events identified by the risk assessment; (3) Address patient population, including, but not limited to (a) persons at risk, (b) the type of services the plan has the ability to provide in an emergency, and (c) continuity of operations, including delegations of authority and succession plans; and (4) Include a process for cooperation and collaboration with local, State, and Federal emergency preparedness and response officials. The plan must be reviewed and updated at least annually.

Policies and procedures – Requires development and implementation of emergency preparedness policies and procedures, based on the risk assessment, emergency plan, and communications plan outlined in the rule. The policies and procedures must address: (1) the provision of subsistence needs (i.e., food, water, and supplies) and alternative sources of energy to maintain temperature, lighting, fire detection and extinguishing, and sewerage and waste disposal for staff and patients; (2) a system to track the location of on-duty staff and sheltered patients; (3) safe evacuation when necessary to protect staff and patients; (4) a means to shelter in place; (5) a system of care documentation that preserves patient information, protects confidentiality of patient, and secures and maintains records; (6) emergency staffing strategies; (7) development of arrangements with other providers and suppliers to receive patients in the event of limitations or cessation of operations; and (8) the role and responsibility of the provider or supplier under a section 1135 waiver of the Act when declared by the Secretary during a declared emergency. The policies and procedures must be reviewed and updated at least annually.

Currently CMS is waiving 42 CFR §482.12(f)(3), emergency services, with respect to surge facilities only. Written policies and procedures for staff to use when evaluating emergencies are not required for surge facilities. This removes the burden on facilities to develop and establish additional policies and procedures at surge sites related to assessment, initial treatment, and referral of patients. These flexibilities can be implemented so long as they are not inconsistent with a state’s emergency preparedness or pandemic plan.

Communication plan – Requires the development and maintenance of an emergency communication plan that complies with federal, state, and local laws that includes: (1) names and contact information for all staff and all federal, state, regional and local emergency preparedness organizations and responders; (2) a primary and alternate means for communicating with staff and federal, state, regional and local emergency preparedness organizations and responders; (3) a method for sharing information and care documentation for patients with care providers to maintain the continuity of care; (4) a means, in the event of an evacuation, to release patient information as permitted; (5) a means of providing information about the general condition and location of patients receiving care; and (6) a means of providing information about provider or supplier regarding occupancy, needs, and its ability to provide assistance. The communications plan must be reviewed and updated at least annually.

Training and Testing – A training and testing program that is based on the emergency plan, policies and procedures, and communications plan is required. The training component must include: (1) initial training for new staff and training for all staff at least annually; and (2) documentation of all emergency preparedness training. The testing component requires: (1) a paper-based, tabletop exercise led by a facilitator, using a narrated, clinically relevant emergency scenario, and a set of problem statements, directed messages, or prepared questions designed to challenge an emergency plan; and (2) documentation of all tabletop exercises, and emergency events. The training and testing program must be reviewed and updated at least annually.

Emergency Standby Power – Requires implementation of emergency and standby power systems based on the emergency plan. Key components include (1) meeting the emergency generator location requirements; (2) mandatory emergency generator inspection and testing; and (3) a plan for keeping emergency power systems operational during the emergency.


Emergency preparedness requires a high degree of organization. Everyone in the organization should understand their roles and responsibilities in an emergency situation and everyone should actively participate in emergency preparedness training and testing. Don’t wait for an emergency situation to occur before assigning specific roles and responsibilities.

Consider establishing an Emergency Preparedness Committee with representation from each functional area or department of the organization. We recommend assigning overall responsibility and accountability to a senior leader, with committee members placed under the senior leader’s operational control for the duration of the development and implementation of the emergency preparedness plan, communications plan, and training and testing. This structure may also be useful as a command, communications, and control group during an actual emergency.

We recommend development and implementation of policies and procedures at department level to engage staff and leadership in a team process.

Use a project management professional to assist the Emergency Preparedness Committee with a project plan to keep track of tasks, activities, timelines, and milestones. The project manager should also report delays, missed milestones, and other issues to the committee for mitigation and/or resolution.

We recommend that the Compliance Officer monitor, audit and report the status of all aspects of the emergency preparedness plan, policies and procedures, communications plan, and in particular, training and testing to senior leadership and the Board of Directors.


There is no such thing as being too prepared for an emergency. Whether it is a natural disaster, a pandemic, an act of terrorism, or some other unplanned event, preparation and planning is key and essential for successful action and mitigation.

As a first step, we recommend going to CMS for information pertaining to the emergency preparedness rule.[1] Learn from the experts and adapt concepts and methodologies to meet organizational needs. Take time to do things right the first time.

At present, there are a number of CMS waivers that temporarily modify certain provisions of the emergency preparedness plan regulation. These waivers are in place only until the end of the national emergency is declared. When the national emergency has ended we recommend taking time to conduct a comprehensive after action review, including a risk vulnerability assessment, a thorough review of your emergency preparedness plan, and a review of lessons learned during the emergency. Update your plan, training and testing accordingly.

The Assistant Secretary for Preparedness and Response - Technical Resources, Assistance Center, and Information Exchange (ASPR-TRACIE), the Federal Emergency Management Agency (FEMA), and CMS, along with first responders at the local, State, and federal government are valuable resources that can assist with emergency preparedness planning, training and testing.

SunHawk Consulting’s team of experts is available to assist your organization in navigating the emergency preparedness and related compliance requirements to meet the CMS rules and conditions of participation.



Ramping Up Virtual Project Management / Team Facilitation in Response to COVID-19?

SunHawk Can Help

Our skilled leaders and professionals at SunHawk are experts at managing complex and time sensitive projects in a virtual on-line world.  In these disruptive times, we can jump in to help your organization with regulatory and compliance management needs including:

· Organizing a short-term crisis management/response team,

· Facilitating or assume leadership of a new compliance initiative, or

· Provide leadership to an established team or add additional expertise.

Do you have work that needs to be done? Do you not have the immediate bandwidth or resources to see such projects to fruition given other priorities? We can help, please reach out to Jim Rough or James Rose for assistance:

SunHawk Consulting is a team of highly skilled and experienced subject matter experts in the Healthcare, Life Sciences, and Insurance Industries who understand that the client’s needs and budgets come first. SunHawk provides Crisis Management Response, Compliance Consulting, Disputes & Investigations, and Staff Augmentation services for Boards of Directors, internal/external legal counsel, company management and employees, special committees, bankruptcy trustees and receivers, and government agencies.