CMS Reinforces Compliance Guidance in Wake of Coronavirus Outbreak

Flash Reports - European Court of Justice Invalidates the EU-US Privacy Shield Framework
CMS Reinforces Compliance Guidance in Wake of Coronavirus Outbreak

March 2, 2020

Is Your Healthcare Organisation Adequately Prepared to Withstand an Emergency Situation?


On February 6, 2020, the Centers for Medicare & Medicaid Services (CMS) issued a press release1 urging State Survey Agencies to ensure that Medicare and Medicaid participating organisations are compliant with the CMS Conditions of Participation and Conditions for Coverage Emergency Preparedness Requirements2 (“Requirements”) and are prepared to respond to the threat of the 2019 – Novel Coronavirus (2019-nCoV). CMS Administrator Seema Verna announced in the press release:

“We [CMS] are working diligently to ensure surveyors and health care providers across the country understand and comply with critically important guidelines that are designed to stop the spread of infectious diseases and keep patients free from harm.”

CMS noted that when developing an emergency preparedness plan, it is critically important that healthcare organisations adhere to the “all-hazards approach” to adequately capture the full spectrum of potential emergency situations and disasters that could occur in specific facility locations. CMS stated that when using the “all-hazards approach,” healthcare organisations must consider all natural, man-made and/or facility emergencies that may include, but are not limited to, care-related emergencies; equipment and power failures; interruptions in communications, such as cyberattacks; terrorism; and loss of, or interruption in supply of, food or water at facilities. In February 2019, CMS added emerging infectious disease threats as an additional category within the “all-hazards approach” to address emerging infectious disease threats like influenza, Ebola, Zika virus and new emerging infectious diseases, such as COVID-19.3

As a result, healthcare organisations must be able to demonstrate compliance with the emergency preparedness requirements with an “all-hazards approach.” Hospital emergency preparedness is a priority for government at all levels and a key focus of regulatory and accrediting agencies. These agencies include CMS, the Federal Emergency Management Agency (FEMA), the Joint Commission, (TJC), DNV, the Centers for Disease Control and Prevention (CDC), and state and local governments. The Joint Commission is currently updating its requirements to “meet or exceed” the CMS guidelines.

CMS Requirements

Developing an emergency preparedness plan that is consistent with regulatory requirements is no simple task. Healthcare organisations should be continually developing, refining and executing all aspects of the plan. In order to meet all the Requirements, CMS recommends that organisations, at a minimum, perform the following four activities:

  1. Engage in planning activities prior to developing a written emergency operations plan. This includes engaging leaders to help develop the emergency operations plan and reviewing it at least annually. 
  2. Develop and maintain a written emergency operations plan that describes the response procedures to follow when emergencies occur, as well as identifies the healthcare organisation’s capabilities, and response procedures when the organisation cannot be supported by the local community to provide communications, resources and assets, security and safety, staff, utilities, or patient care for at least 96 hours.
  3. Conduct a hazard vulnerability analysis.
  4. Work with community partners to prioritise the potential emergencies identified in the facilities hazard vulnerability analysis, communicate organisational needs and vulnerabilities to the community emergency response agencies, and identify the community’s ability to meet its needs.

Emergency Preparedness “Pain Points”

CMS requires healthcare organisations to create a comprehensive emergency preparedness plan. Key processes and controls that we recommend to undertake and put in place include the following:

  • Develop a communication plan to help facilitate how the healthcare organisation will perform the following:
    • Connect with staff, external authorities, patients and their families, media, suppliers, vendors, and others regarding the emergency.
    • Relay the names of patients and the deceased with other local healthcare organisations and third parties, and communicate with identified alternative care sites.
  • Include in the communication plan any backup systems and technologies used for the plan; how resources and assets will be managed during emergencies; how the organisation will obtain and replenish medications and supplies, as well as share resources and assets with other local healthcare organisations; arrangements for transporting patients; management of security and safety during an emergency; management of hazardous materials and waste, utilities, water, and fuel.
  • Train employees for their assigned emergency roles and determine how the healthcare organisation will manage patients during emergencies. For example, develop a plan for keeping patients on the premises or evacuating them if the facility is not safe; determine how the organisation will manage scheduling, triaging, assessing, treating, admitting, transferring and discharging patients; and plan how the organisation will manage an increase in demand for services, medications, patients’ personal hygiene and sanitation needs, mental health needs, dietary needs, and mortuary services.
  • Ensure there is a system or readily available paper records to document and track patients’ clinical information.
  • Grant disaster privileges to volunteer licensed independent practitioners and volunteer practitioners during emergencies, and determine how volunteers will be distinguished from regular staff and how their performance will be overseen. 
  • Perform an evaluation of the effectiveness of the healthcare organisation’s emergency operations plan. This includes:
    • Activating the emergency operations plan twice a year
    • Conducting an annual exercise that includes an influx of simulated patients
    • Conducting at least one annual exercise that includes an escalating event in which the local community is unable to support the healthcare organisation
    • Conducting an annual exercise that includes participation in a community-wide exercise
  • Update the business continuity plan by department and the disaster recovery plan by organisation and facility annually.

With the current increase in natural disasters and the onset of the coronavirus, as well as increased oversight by regulating and accreditation bodies, healthcare organisations should reassess their emergency preparedness plans not only to meet regulatory expectations, but more importantly, leave the organisation in a ready state for any response that may be required in an emergency situation.

1 Press release, “CMS Prepares Nation’s Healthcare Facilities for Coronavirus Threat,” February 6, 2020.
2 42 CFR § 482.15.
3 See State Operations Manual, Appendix Z-Emergency Preparedness for All Provider and Certified Supplier Types (03-04-2019), Centers for Medicare & Medicaid Services.