Emergency preparedness built for healthcare
A failed survey, a deficiency citation, an unannounced inspection: for healthcare organizations, an emergency preparedness gap isn't hypothetical, it's a finding waiting to happen. We help hospitals, clinics, and medical practices meet the CMS Emergency Preparedness Rule with plans that hold up in front of a surveyor and in a real emergency.
From the CMS Emergency Preparedness Rule to OSHA requirements to Joint Commission expectations, healthcare faces some of the most demanding preparedness standards of any sector, and surveyors who expect to see plans, training, exercises, and documentation all working together.
We've done this work from the inside: our founder coordinated disaster preparedness for a regional medical center, implementing the Hospital Incident Command System, running Joint Commission disaster exercises, and leading the hazmat decontamination team. That's the perspective your program gets.
We help you meet those requirements without losing sight of what they're for: keeping patients and staff safe when an emergency hits. That means EOPs and continuity plans tailored to clinical operations, plus the training and exercises that make them real.
Whether you're a large system or a single practice, we build a program that stands up to a survey and, more importantly, would actually hold up in a crisis.
The four core elements a surveyor will ask about
The CMS Emergency Preparedness Rule (42 CFR §482.15 and its sister provisions across 17 provider types) is built on four core elements. A surveyor works through them in order, and a gap in any one of them is where a deficiency citation comes from. Here is what each one actually requires, and what "compliant" looks like on paper.
Element 1 — Risk assessment and planning
You need a documented, facility-specific all-hazards risk assessment, and an emergency plan built from it. "All-hazards" does not mean a list of every conceivable disaster; it means an approach that addresses the capabilities and risks specific to your facility, your patient population, and your geography. A surveyor will look for evidence that the assessment drove the plan — not that the two were written separately and stapled together.
The most common gap: a risk assessment done once at adoption and never revisited, while the facility added a service line, changed its patient mix, or moved a critical function. Since the 2019 Burden Reduction rule, the plan, policies and procedures, and communication plan must be reviewed and updated at least every two years for most provider types — long-term care facilities remain on an annual cycle. The risk assessment is part of that review.
Element 2 — Policies and procedures
Policies must be based on the risk assessment and the emergency plan, and they have to address specific required items: subsistence needs for staff and patients, a system to track on-duty staff and sheltered patients during and after an emergency, safe evacuation, a means to shelter in place, medical documentation that preserves patient information and confidentiality, use of volunteers, and arrangements with other facilities. Providers with transfer agreements need those documented.
The most common gap: policies that reference the plan generically rather than specifying who does what, in what order, with what resources. A surveyor asks a staff member what they would do; the answer needs to match the policy.
Element 3 — Communication plan
A communication plan that complies with federal, state, and local law, and includes current contact information for staff, entities providing services under arrangement, patients' physicians, other facilities, and volunteers. It also requires primary and alternate means of communicating with staff and with federal, state, tribal, regional, and local emergency management agencies — plus a method for sharing information and medical documentation with other providers, and a means of providing information about the facility's occupancy, needs, and ability to provide assistance.
The most common gap: contact lists that are out of date. This is the single easiest deficiency for a surveyor to find and the single easiest to prevent. Date-stamp the list and assign an owner. Worth knowing: the 2019 rule removed the requirement to keep written documentation of your efforts to contact local, tribal, regional, state, and federal emergency officials — but you should still be able to describe that process on request.
Element 4 — Training and testing
Training. Initial training for new and existing staff, contractors, and volunteers, and thereafter every two years for most provider types — long-term care facilities remain annual. If you significantly update your policies and procedures, train on the changes rather than waiting for the cycle. Whatever the cadence, the requirement is not that training occurred but that staff can demonstrate knowledge of emergency procedures.
Testing. This is where provider type matters most, and where we see the most confusion:
- Inpatient providers (hospitals, critical access hospitals, inpatient hospice, long-term care) conduct two exercises every year: one full-scale community-based exercise — or an individual facility-based functional exercise when a community exercise is not available — plus one exercise of choice, which may be a second full-scale, a functional exercise, a mock disaster drill, or a facilitated tabletop with a narrated scenario.
- Outpatient providers (ambulatory surgical centers, clinics, physician practices, home health agencies, rural health clinics, FQHCs) conduct one exercise every year, alternating: a full-scale or individual facility-based functional exercise every two years, and an exercise of choice in the opposite years.
If you run a clinic or a practice and someone has told you that you owe two exercises a year, they have handed you the inpatient requirement. It is a common and expensive misunderstanding.
On the exemption: if your facility experiences an actual emergency requiring activation of the emergency plan, you are exempt from your next required full-scale or facility-based functional exercise — but not from the exercise of choice, and only if you have written documentation that the plan was activated. An unwritten real event is worth nothing to you at survey.
The most common gap by a wide margin: the exercise happened, but nobody wrote the after-action report, or the report exists and the improvement plan was never completed. Element 4 is where the cycle closes. If your improvement plan has open items from two years ago, that is what a surveyor will find.
Not sure where your program stands?
The free consultation is a plain-language walkthrough of these four elements against what you actually have on paper — no obligation, and you keep the notes either way.
What we build for healthcare clients
Engagements vary, but the shape is usually the same: we find the gaps, close the ones that matter, and leave you with documentation a surveyor can follow and staff can actually use.
Program assessment. A gap analysis against all four core elements, delivered as a findings document with each gap tied to the specific citation risk it creates and a recommended corrective action. If you do nothing else with us, you leave knowing exactly where you stand.
Emergency Operations Plan development. A facility-specific all-hazards EOP grounded in FEMA CPG 101 and structured to satisfy CMS, written around your clinical operations rather than adapted from a hospital template that does not match how you work.
Hazard vulnerability analysis. A documented, defensible risk assessment that drives the plan — and that you can show a surveyor as the origin of every policy decision downstream.
Exercise design and facilitation. HSEEP-aligned tabletop and functional exercises with a narrated scenario built for your facility, facilitated by a FEMA-credentialed Master Exercise Practitioner, followed by the after-action report and improvement plan that CMS expects to see. Designed to satisfy the requirement and to actually teach your team something.
Training. Initial and annual staff training, including Hospital Incident Command System orientation, with the attendance documentation and competency evidence that closes out Element 4.
Documentation review. Before a survey, a read-through of what you have with fresh eyes, from the perspective of someone who has been the assessor.
Why a practitioner, not a template vendor
Our founder coordinated disaster preparedness and hazmat decontamination for a regional medical center, serving as Hospital Incident Command System coordinator and instructor, planning and running Joint Commission disaster exercises, and leading the decontamination team. That is the vantage point your program gets: someone who has built and defended a hospital preparedness program from the inside, not a compliance vendor working from a checklist.
He is a Certified Emergency Manager (IAEM) and a FEMA-credentialed Master Exercise Practitioner, and he has sat on the other side of the table as an accreditation assessor. That is a different vantage point than a compliance vendor selling a plan template: it means the plan you get is one someone has had to defend, use, and be audited on.
Every engagement is led personally — the person on your first call is the person who writes your plan and facilitates your exercise.
Healthcare preparedness questions we hear most
Who has to comply with the CMS Emergency Preparedness Rule?
Seventeen provider and supplier types that participate in Medicare or Medicaid, including hospitals, critical access hospitals, long-term care facilities, ambulatory surgical centers, hospices, dialysis facilities, home health agencies, rural health clinics, federally qualified health centers, and community mental health centers. Requirements differ by provider type — a physician practice billing Medicare under a hospital's provider number has different obligations than an independent practice.
How often do we have to run a tabletop exercise?
It depends on whether you are an inpatient or outpatient provider. Inpatient providers conduct two exercises a year: one full-scale community-based exercise (or a facility-based functional exercise where a community exercise is not available), plus one exercise of choice, which may be a facilitated tabletop with a narrated scenario. Outpatient providers — clinics, practices, ambulatory surgical centers, home health — conduct one exercise a year, alternating a full-scale or functional exercise every two years with an exercise of choice in the opposite years. An actual emergency requiring plan activation exempts you from the next required full-scale or functional exercise, but not from the exercise of choice, and only with written documentation of the activation.
How often must we review the emergency plan?
Since the 2019 Burden Reduction rule, most provider types review and update the emergency plan, policies and procedures, and communication plan at least every two years. Long-term care facilities remain on an annual cycle, as does their staff training. Many facilities still operate on the original annual cadence, which is not wrong — just more often than required.
We already have a plan. Do we need a new one?
Usually not. Most facilities we work with have a plan that is fundamentally sound and out of date in specific, fixable ways — stale contact lists, a risk assessment that predates a service change, or an improvement plan with open items. A program assessment tells you whether you need a rewrite or a refresh, and most of the time it's a refresh.
What triggers a deficiency citation most often?
In our experience the recurring ones are: contact information that is out of date, training records that don't demonstrate staff competency, an exercise that happened without a documented after-action report, and an improvement plan with corrective actions that were never closed out. All four are documentation failures rather than planning failures — the work was often done, but it wasn't evidenced.
How long does it take?
A program assessment is typically two to three weeks. Full EOP development usually runs four to ten weeks depending on facility complexity and how quickly your team can meet. Exercise design and facilitation is generally three to four weeks from scoping to after-action report.
Do you work with single practices, or only hospital systems?
Both. A single practice has a genuinely different compliance burden than a health system, and scoping the work to what your provider type actually requires is part of the job — not selling you a hospital-scale program you don't need.
Facing a survey or building your program from scratch?
Let's make sure your organization is ready on paper and in practice. Your initial consultation is free.
Request a Consultation