Emergency Preparedness Requirements for Medical Offices
The CMS Emergency Preparedness Rule (42 CFR 482.15 for hospitals, 42 CFR 416.54 for ASCs, and parallel sections for other provider types) requires all Medicare- and Medicaid-participating facilities to maintain an emergency preparedness program. State accreditation bodies (Joint Commission, AAAHC, DNV GL) incorporate these requirements into their survey standards. This article covers the four core elements, specific documentation requirements, and the deficiency citations surveyors issue most frequently.
The Four Core Elements of the CMS Emergency Preparedness Rule
Element 1: Risk Assessment and Emergency Plan. CMS requires an all-hazards risk assessment (42 CFR 482.15(a)) updated annually. 'All-hazards' means the plan addresses natural disasters (hurricanes, earthquakes, flooding, wildfires), man-made events (active shooter, cyberattack, chemical spill), infrastructure failures (power outage, water main break, HVAC failure), and infectious disease outbreaks. The plan must be facility-specific, not a generic template. Surveyors verify the risk assessment reflects actual geographic and operational risks for the facility's location.
Element 2: Policies and Procedures. Written policies and procedures must address: patient evacuation and sheltering-in-place, tracking patients and staff during an emergency, communication with local emergency management agencies, continuity of operations for essential clinical functions, management of medical records during and after an emergency, and arrangements for alternative care sites if the facility is inoperable. CMS requires these policies be reviewed and updated annually (42 CFR 482.15(b)).
Element 3: Communication Plan. The communication plan must include: contact information for all staff (updated quarterly), procedures for sharing patient information with other facilities during a transfer or evacuation, methods for communicating with patients and families during an emergency (including patients with limited English proficiency and communication disabilities), and contact information for local, tribal, regional, and state emergency management agencies. CMS requires the plan comply with federal, state, and local laws governing emergency communication (42 CFR 482.15(c)).
Element 4: Training and Testing. All staff must receive emergency preparedness training within 30 days of hire and annually thereafter. CMS requires facilities to conduct two emergency preparedness exercises per year: one full-scale (community-based or facility-based) exercise and one tabletop exercise. For facilities in areas with actual disaster activations, a documented activation response can substitute for one of the two required exercises (CMS State Operations Manual, Appendix Z).
Common Survey Deficiencies and How to Avoid Them
Deficiency: Risk assessment not updated annually. The CMS State Operations Manual (Appendix Z, Tag E-0004) requires the risk assessment be reviewed and updated at least annually. Surveyors check the date of the most recent update. A risk assessment from 2 years ago is an automatic citation even if the plan itself is current. Fix: schedule an annual review meeting (calendar invite to the compliance officer) in Q1 each year, document the meeting minutes, and date-stamp the updated risk assessment.
Deficiency: Training records incomplete or missing for new hires. CMS requires training within 30 days of hire (Tag E-0037). Practices with high staff turnover frequently lack training records for recent hires. Fix: incorporate emergency preparedness training into the new-hire onboarding checklist. Use a standardized sign-off sheet that captures the employee name, training date, topics covered, and trainer name. Maintain these records for a minimum of 3 years.
Deficiency: Testing exercises not conducted or not documented. Two exercises per year is the minimum (Tag E-0036). Surveyors require documentation of the exercise scenario, participants, timeline, identified gaps, and corrective actions taken. A fire drill alone does not satisfy the CMS exercise requirement; the exercise must test the emergency plan's communication, staffing, and patient tracking components. Fix: schedule one tabletop exercise in Q2 and one functional exercise in Q4 each year, and assign a staff member to document each exercise using the CMS exercise evaluation template.
Deficiency: Communication plan lacks contact information for local emergency management. CMS requires facilities to maintain contact information for local emergency management agencies (Tag E-0030). Many practices list 911 but not the county emergency management office, the state health department emergency operations center, or the Regional Healthcare Coalition (RHC). Fix: identify your county and state emergency management contacts and your Regional Healthcare Coalition coordinator. Verify contact information annually.
Practical Implementation for Small and Mid-Size Practices
Start with the ASPR TRACIE (Technical Resources, Assistance Center, and Information Exchange) templates, published by the HHS Office of the Assistant Secretary for Preparedness and Response. TRACIE provides free, CMS-aligned emergency plan templates for healthcare facilities at phe.gov/tracie. These templates include the risk assessment format, policy and procedure language, communication plan worksheets, and exercise planning tools that match surveyor expectations.
For outpatient surgical centers and medical offices, the emergency plan need not be hundreds of pages. CMS expects the plan to be proportional to the facility's size and patient volume. A 10-provider surgical center needs a more detailed plan than a 2-provider dermatology office. Focus the plan on realistic scenarios: power outage during a procedure, medical emergency (patient cardiac arrest or anaphylaxis), fire, and severe weather requiring shelter-in-place.
Tabletop exercises require minimal time and cost. Gather staff for 30 to 45 minutes, present a scenario (example: 'A water main break has flooded the parking lot and the building has no running water. You have 3 patients in recovery and 4 scheduled for this afternoon.'), and walk through the decision tree: Who makes the call to cancel? How are patients notified? Where do recovery patients go? Who contacts the water utility? Document the discussion and any plan gaps identified.
If your facility has not participated in a community-wide exercise, contact your county or Regional Healthcare Coalition. RHCs coordinate multi-facility exercises several times per year and provide documentation that satisfies the CMS full-scale exercise requirement. Participation is typically free and counts toward your annual requirement. The FEMA Homeland Security Exercise and Evaluation Program (HSEEP) methodology is the standard framework for these exercises.
Does a solo dental practice need a CMS emergency preparedness plan?
If the practice participates in Medicare or Medicaid (including accepting Medicaid patients for any service), yes. The CMS Emergency Preparedness Rule applies to 17 provider and supplier types that participate in Medicare and Medicaid, including ambulatory surgical centers. Solo dental practices that do not participate in Medicare or Medicaid are not subject to CMS requirements, but may still be subject to state licensing requirements for emergency preparedness. OSHA's general duty clause (29 USC 654) also requires all employers to maintain a safe workplace, which includes emergency action plans under 29 CFR 1910.38.
How often do I need to update my emergency preparedness plan?
CMS requires the emergency plan and risk assessment be reviewed and updated at least annually (42 CFR 482.15(a)(4)). Additionally, the plan should be updated after any actual emergency activation (to incorporate lessons learned), after significant changes to the facility (new location, expansion, new services), and after changes in local hazard profiles (new construction, flood zone reclassification). Date-stamp every revision and maintain prior versions for surveyor review.
Can a tabletop exercise count as the full-scale exercise requirement?
No. CMS requires one full-scale exercise (community-based or individual, facility-based) and one additional exercise annually, which may be a tabletop. However, if your facility activated its emergency plan for an actual emergency in the past year, that activation, if documented, can substitute for one of the two required exercises. The documentation must include a description of the event, the facility's response actions, staff participation, identified gaps, and corrective actions implemented.
What happens if my practice fails the emergency preparedness survey?
Surveyors cite deficiencies by CMS tag number and assign a scope and severity rating. Practices receive a Statement of Deficiencies and must submit a Plan of Correction within 10 calendar days (or the timeframe specified by the state survey agency). The Plan of Correction must describe: the corrective action for each deficiency, how the practice will prevent recurrence, who is responsible, and the completion date. Failure to correct deficiencies can result in civil monetary penalties (up to $10,000 per day per 42 CFR 488.438), denial of payment for new admissions, or termination from the Medicare program.
For practices
Bring this to your own practice.
QR Rx turns every procedure into a branded recovery plan that keeps patients engaged and brings them back. Start free in minutes, or see it live in a 20-minute demo.
This blog provides general information about healthcare compliance and aftercare best practices. It does not constitute legal, medical, or regulatory advice. Consult qualified professionals for guidance specific to your practice.
