CMS Emergency Preparedness Rule: Elements, Testing, and Surveys

The CMS Emergency Preparedness Rule requires every Medicare- and Medicaid-participating provider and supplier in 21 covered categories to build and maintain an all-hazards emergency preparedness program, tested regularly, and integrated with local and state emergency response. CMS finalized the rule in September 2016 after events like Hurricane Katrina exposed how badly healthcare facilities had planned for large-scale disasters. Compliance is checked during routine health and safety surveys, and failures can lead to civil monetary penalties or termination from federal healthcare programs.

Which Providers and Suppliers Are Covered

CMS applies the rule to 21 distinct provider and supplier types. The original 2016 regulation covered 17 categories; later updates added Rural Emergency Hospitals and expanded the list to its current scope.¹

The inpatient side covers Hospitals, Psychiatric Hospitals, Critical Access Hospitals, Rural Emergency Hospitals, Long-Term Care/Nursing Homes, Intermediate Care Facilities for Individuals with Intellectual Disabilities, Psychiatric Residential Treatment Facilities, and Religious Nonmedical Health Care Institutions. Outpatient and community-based providers include Ambulatory Surgical Centers, Home Health Agencies, Hospices, End-Stage Renal Disease Facilities, Programs of All-Inclusive Care for the Elderly (PACE), Comprehensive Outpatient Rehabilitation Facilities, Rural Health Clinics, Federally Qualified Health Centers, Community Mental Health Centers, Organ Procurement Organizations, and Outpatient Physical Therapy/Speech-Language Pathology Services. The rule also reaches Clinical Laboratories, Organ Transplant Programs, and Portable X-Ray Suppliers.

Each category has its own regulation. Hospitals sit at 42 CFR 482.15, Critical Access Hospitals at 42 CFR 485.625, Long-Term Care facilities at 42 CFR 483.73, and PACE organizations at 42 CFR 460.84.²³⁴ The framework is the same, but the details of training frequency and testing exercises shift based on whether a facility is inpatient, outpatient, or long-term care.

The Four Required Program Elements

Every covered facility has to build its program around four elements, and CMS treats them as one integrated system rather than a checklist.⁵

A documented all-hazards risk assessment and a written emergency plan responding to the threats it identifies.
Policies and procedures that translate that plan into concrete staff actions.
A communication plan covering staff, patients, and external emergency officials.
Training and testing that confirm the other three elements actually work.

The elements feed each other. A risk assessment that flags flooding should drive the stockpile policy, shape the contact list for local emergency management, and dictate what the facility drills. Gaps found during testing loop back into a revised assessment and updated policies. For most provider types, the whole program must be reviewed and updated at least every two years. Long-term care facilities have to do it annually.²

Risk Assessment and the Written Emergency Plan

The foundation is an all-hazards risk assessment, sometimes called a Hazard Vulnerability Analysis, that identifies the threats most likely to hit a specific facility and its surrounding community.⁶ Generic templates copied from another facility do not survive survey scrutiny. CMS expects the analysis to reflect real local conditions: regional weather patterns, utility reliability, proximity to flood zones, wildfire corridors, and industrial hazards.

The assessment also has to cover facility-specific vulnerabilities, including prolonged power failures, water disruptions, and cyberattacks. CMS explicitly includes “interruptions in communications, including cyber-attacks” within the all-hazards framework, so cybersecurity cannot be treated as someone else’s problem.⁷ Historical data on local outages and past incidents is what lets you justify risk rankings with evidence rather than guesswork.

The written plan then addresses every hazard the assessment identifies. It has to speak to the specific patient population, so a facility serving ventilator-dependent or dialysis patients faces different planning obligations than a freestanding surgical center. It also has to document how the facility will cooperate with local, tribal, regional, state, and federal emergency management officials so the response is integrated rather than siloed.²

One requirement that catches facilities off guard is succession planning. The plan must include documented delegations of authority and a succession line for leadership. If the administrator and medical director are both unreachable during a hurricane, the plan needs to spell out who takes over and what authority they carry. Surveyors check for it.

Policies the Plan Has to Cover

Written policies turn the plan into instructions staff can follow under pressure. CMS calls out several specific areas.

Subsistence Needs

Facilities have to plan for food, water, and medical and pharmaceutical supplies for both patients and on-duty staff, whether the facility shelters in place or evacuates.⁸ A common misconception is that CMS mandates a specific stockpile duration such as 72 or 96 hours. It does not. Appendix Z states there is “no requirement or standard establishing a set amount of provisions” for a fixed number of hours. Supplies must be adequate “for the duration of an emergency or until all patients have been evacuated and operations cease.” Some state laws and accrediting organizations do impose fixed durations, so facilities should check those separately.

Evacuation and Transfer

Evacuation policies must detail how patients will be moved safely to pre-arranged alternative care sites, factoring in patient acuity, staff responsibilities, and transportation. A triage system that sorts patients by mobility and medical need is essential because stretcher-bound patients and ambulatory ones need very different logistics.⁹

Written transfer agreements, often structured as Memoranda of Understanding, need to be in place with receiving facilities before a disaster hits. CMS publishes a template that covers the responsibilities of transferring and receiving facilities, patient stabilization before transport, medical record handoff, billing, EMTALA and HIPAA compliance, and a written termination clause.¹⁰ The worst time to negotiate one is during the emergency itself.

Medical Records

Policies have to address how medical records will be preserved and transferred to keep care continuous regardless of the physical environment, including scenarios where the electronic health record is unavailable and paper backups are needed.

Communication and Patient Tracking

The communication plan needs a full contact list for staff, participating physicians, federal, state, and local emergency management officials, and nearby providers. CMS requires both primary and alternate means of communication, so landlines and email are not enough if power and internet are down. Facilities should document backups like satellite phones, two-way radios, or emergency notification platforms. External partners on the list have to know they are on the plan; a phone number is useless if the person on the other end has never been briefed. Appendix Z spells out the required elements.⁹

Facilities also have to maintain a system that tracks the location of on-duty staff and sheltered patients during and after an emergency. If patients or staff are relocated, the facility must document the specific name and location of the receiving facility. CMS does not require an electronic system; the information just has to be accurate, current, and available to emergency response officials.⁹ Patients who voluntarily leave or are properly discharged do not have to be tracked, but the departure has to be documented in the record. When evacuating, care requirements typically travel with the patient as a hard-copy summary of conditions, allergies, and treatment rendered.

Training and Testing

Training and testing is where the 2017 amendments changed things most and where facilities most often get cited.

Training Frequency

All new and existing staff, including contractors and volunteers, must complete initial emergency preparedness training. After that, most provider types must provide refresher training at least every two years. Long-term care facilities have to train staff annually.⁷

Testing Exercises

Hospitals and other inpatient facilities have to conduct two testing exercises per year. The first must be a full-scale, community-based exercise, or a facility-based functional exercise if no community exercise is accessible. The second can be another full-scale exercise, a mock disaster drill, or a facilitated tabletop exercise using a clinically relevant scenario.²

Outpatient providers, including Ambulatory Surgical Centers, Home Health Agencies, hospices, ESRD facilities, PACE organizations, and several others, have a lighter burden. They conduct one exercise annually, alternating types every other year: a full-scale community-based or facility-based functional exercise one year, and an exercise of their choice — tabletop, drill, or workshop — the next.¹¹

Real-World Activation Credit

When a facility activates its emergency plan during an actual disaster, that activation can substitute for the next required full-scale or functional exercise. Documentation has to back it up: staff alert notifications, patient transfer records, incident command reports, or coordination records with emergency officials.¹¹ The credit does not accumulate; it covers only the next scheduled full-scale exercise in the 12-month cycle, and the facility still has to complete its other required exercise that same period.

After-Action Review

After every exercise or real activation, facilities have to analyze their response, document the event, and revise the plan based on lessons learned.² CMS recommends a structured After Action Report identifying what was supposed to happen, what actually happened, what went well, what needs improvement, and a timeline for changes.⁹ HSEEP standards are not required. Documentation of drills, exercises, and emergency events has to be retained and available for review for at least three years. Surveyors want sign-in sheets, the written analysis, and evidence that the plan actually got revised.

How Compliance Is Surveyed and Enforced

Emergency preparedness is not surveyed on its own cycle. It is checked during regular health and safety surveys by state survey agencies, including initial certification, recertification, revalidation, and complaint surveys.⁹ Surveyors cite specific findings using “E-tags” (Emergency Preparedness tags), each mapped to a specific CFR requirement, so the tag identifies exactly what was unmet.

Plan of Correction and Escalating Remedies

A cited facility has 10 calendar days to submit a Plan of Correction for each deficiency.¹² If the facility does not come into compliance within a reasonable timeframe, CMS can escalate. Remedies vary by provider type but include civil monetary penalties, denial of payment for new admissions, and termination of the provider agreement, which cuts the facility off from billing Medicare and Medicaid.

Penalty amounts are adjusted annually for inflation. For nursing facilities, per-day penalties in 2026 range from $136 to $27,378 depending on severity, with per-instance penalties from $2,739 to $27,378.¹³ Home health agencies face per-day penalties up to $26,262 for noncompliance with statutory requirements. Financial exposure depends on the provider category and the severity of the finding.

Immediate Jeopardy

The most serious finding is Immediate Jeopardy, meaning noncompliance has caused, or is likely to cause, serious injury, harm, or death to a patient. Three components must be present: noncompliance with a federal requirement, a serious adverse outcome that has occurred or is reasonably likely, and a need for immediate corrective action.¹⁴ Lack of adequate emergency preparation is a listed trigger for Immediate Jeopardy investigation in nursing facilities, with examples including lack of potable water or insufficient food supplies.

When Immediate Jeopardy is called, the enforcement timeline compresses. Hospitals get a preliminary notice that the provider agreement will terminate in 23 days if deficiencies are not corrected. Skilled nursing facilities and home health agencies in Immediate Jeopardy can get as little as two days’ notice before termination.¹⁵

Section 1135 Waivers During Declared Emergencies

When the President declares a disaster under the Stafford Act or National Emergencies Act and the HHS Secretary declares a public health emergency, Section 1135 of the Social Security Act lets the Secretary temporarily waive or modify certain Medicare, Medicaid, and CHIP requirements.¹⁶ The point is to keep facilities from being penalized for technical noncompliance while they are focused on responding to the actual disaster.

Waivers can reach conditions of participation, state licensure for out-of-state providers, EMTALA, Stark Act self-referral restrictions, and preapproval requirements. They typically expire 60 days after publication unless the Secretary extends them in 60-day increments, and they cannot extend past the end of the declared emergency. Performance deadlines can be adjusted but not fully waived.

Once an 1135 waiver is authorized, individual facilities submit requests to their CMS Regional Office, with a copy to the State Survey Agency, including facility information and justification. A cross-regional review team validates each request.¹⁷ Keep documentation of any waiver you operate under; it may later serve as survey evidence and can also count toward real-world activation credit for testing requirements.

1
Centers for Medicare & Medicaid Services. Providers / Suppliers Facilities Impacted by the Emergency Preparedness Rule
2
eCFR. 42 CFR 482.15 – Condition of Participation: Emergency Preparedness
3
eCFR. 42 CFR 483.73 – Emergency Preparedness
4
eCFR. 42 CFR 460.84 – Emergency Preparedness
5
Centers for Medicare & Medicaid Services. Core EP Rule Elements
6
Centers for Medicare & Medicaid Services. CMS Emergency Preparedness Regulation – Frequently Asked Questions
7
Centers for Medicare & Medicaid Services. CMS Understanding the EP Final Rule Update
8
Centers for Medicare & Medicaid Services. State Operations Manual Appendix Z – Emergency Preparedness for All Provider and Certified Supplier Types
9
Centers for Medicare & Medicaid Services. State Operations Manual Appendix Z – Emergency Preparedness for All Provider and Certified Supplier Types Interpretive Guidance
10
Centers for Medicare & Medicaid Services. Emergency Preparedness Rule: Facility Transfer Agreement Example
11
Centers for Medicare & Medicaid Services. Guidance Related to Emergency Preparedness – Exercise Exemption Based on a Facility’s Activation of Their Emergency Plan
12
Centers for Medicare & Medicaid Services. Quality, Safety and Oversight – Enforcement
13
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
14
Centers for Medicare & Medicaid Services. State Operations Manual Appendix Q – Core Guidelines for Determining Immediate Jeopardy
15
eCFR. 42 CFR 489.53 – Termination by CMS
16
Centers for Medicare & Medicaid Services. 1135 Waivers
17
Centers for Medicare & Medicaid Services. Requesting an 1135 Waiver