CMS Reinforces Compliance Guidance in Wake of Coronavirus Outbreak

Flash Reports - European Court of Justice Invalidates the EU-US Privacy Shield Framework
CMS Reinforces Compliance Guidance in Wake of Coronavirus Outbreak

March 2, 2020

Is Your Healthcare Organization Adequately Prepared to Withstand an Emergency Situation?


On February 6, 2020, the Centers for Medicare & Medicaid Services (CMS) issued a press release1 urging State Survey Agencies to ensure that Medicare and Medicaid participating organizations are compliant with the CMS Conditions of Participation and Conditions for Coverage Emergency Preparedness Requirements2 (“Requirements”) and are prepared to respond to the threat of the 2019 – Novel Coronavirus (2019-nCoV). CMS Administrator Seema Verna announced in the press release:

“We [CMS] are working diligently to ensure surveyors and health care providers across the country understand and comply with critically important guidelines that are designed to stop the spread of infectious diseases and keep patients free from harm.”

CMS noted that when developing an emergency preparedness plan, it is critically important that healthcare organizations adhere to the “all-hazards approach” to adequately capture the full spectrum of potential emergency situations and disasters that could occur in specific facility locations. CMS stated that when using the “all-hazards approach,” healthcare organizations must consider all natural, man-made and/or facility emergencies that may include, but are not limited to, care-related emergencies; equipment and power failures; interruptions in communications, such as cyberattacks; terrorism; and loss of, or interruption in supply of, food or water at facilities. In February 2019, CMS added emerging infectious disease threats as an additional category within the “all-hazards approach” to address emerging infectious disease threats like influenza, Ebola, Zika virus and new emerging infectious diseases, such as COVID-19.3

As a result, healthcare organizations must be able to demonstrate compliance with the emergency preparedness requirements with an “all-hazards approach.” Hospital emergency preparedness is a priority for government at all levels and a key focus of regulatory and accrediting agencies. These agencies include CMS, the Federal Emergency Management Agency (FEMA), the Joint Commission, (TJC), DNV, the Centers for Disease Control and Prevention (CDC), and state and local governments. The Joint Commission is currently updating its requirements to “meet or exceed” the CMS guidelines.

CMS Requirements

Developing an emergency preparedness plan that is consistent with regulatory requirements is no simple task. Healthcare organizations should be continually developing, refining and executing all aspects of the plan. In order to meet all the Requirements, CMS recommends that organizations, at a minimum, perform the following four activities:

  1. Engage in planning activities prior to developing a written emergency operations plan. This includes engaging leaders to help develop the emergency operations plan and reviewing it at least annually. 
  2. Develop and maintain a written emergency operations plan that describes the response procedures to follow when emergencies occur, as well as identifies the healthcare organization’s capabilities, and response procedures when the organization cannot be supported by the local community to provide communications, resources and assets, security and safety, staff, utilities, or patient care for at least 96 hours.
  3. Conduct a hazard vulnerability analysis.
  4. Work with community partners to prioritize the potential emergencies identified in the facilities hazard vulnerability analysis, communicate organizational needs and vulnerabilities to the community emergency response agencies, and identify the community’s ability to meet its needs.

Emergency Preparedness “Pain Points”

CMS requires healthcare organizations to create a comprehensive emergency preparedness plan. Key processes and controls that we recommend to undertake and put in place include the following:

  • Develop a communication plan to help facilitate how the healthcare organization will perform the following:
    • Connect with staff, external authorities, patients and their families, media, suppliers, vendors, and others regarding the emergency.
    • Relay the names of patients and the deceased with other local healthcare organizations and third parties, and communicate with identified alternative care sites.
  • Include in the communication plan any backup systems and technologies used for the plan; how resources and assets will be managed during emergencies; how the organization will obtain and replenish medications and supplies, as well as share resources and assets with other local healthcare organizations; arrangements for transporting patients; management of security and safety during an emergency; management of hazardous materials and waste, utilities, water, and fuel.
  • Train employees for their assigned emergency roles and determine how the healthcare organization will manage patients during emergencies. For example, develop a plan for keeping patients on the premises or evacuating them if the facility is not safe; determine how the organization will manage scheduling, triaging, assessing, treating, admitting, transferring and discharging patients; and plan how the organization will manage an increase in demand for services, medications, patients’ personal hygiene and sanitation needs, mental health needs, dietary needs, and mortuary services.
  • Ensure there is a system or readily available paper records to document and track patients’ clinical information.
  • Grant disaster privileges to volunteer licensed independent practitioners and volunteer practitioners during emergencies, and determine how volunteers will be distinguished from regular staff and how their performance will be overseen. 
  • Perform an evaluation of the effectiveness of the healthcare organization’s emergency operations plan. This includes:
    • Activating the emergency operations plan twice a year
    • Conducting an annual exercise that includes an influx of simulated patients
    • Conducting at least one annual exercise that includes an escalating event in which the local community is unable to support the healthcare organization
    • Conducting an annual exercise that includes participation in a community-wide exercise
  • Update the business continuity plan by department and the disaster recovery plan by organization and facility annually.

With the current increase in natural disasters and the onset of the coronavirus, as well as increased oversight by regulating and accreditation bodies, healthcare organizations should reassess their emergency preparedness plans not only to meet regulatory expectations, but more importantly, leave the organization in a ready state for any response that may be required in an emergency situation.

1 Press release, “CMS Prepares Nation’s Healthcare Facilities for Coronavirus Threat,” February 6, 2020.
2 42 CFR § 482.15.
3 See State Operations Manual, Appendix Z-Emergency Preparedness for All Provider and Certified Supplier Types (03-04-2019), Centers for Medicare & Medicaid Services.

Ready to work with us?

Richard Williams
Richard Williams
Managing Director
+1 (214) 395-1662