This year, Medicare providers and suppliers — including hospitals, ambulatory surgical centers (ASCs) and end-stage renal disease (ESRD) facilities — will need to develop emergency preparedness plans for both natural and human-made disasters.
Specific requirements for these plans vary among providers and suppliers; however, adequate planning for disasters and emergency situations starts with the same four core elements: (1) risk assessment and emergency planning, (2) developing and implementing policies and procedures, (3) developing and maintaining an emergency preparedness communication plan, and (4) developing and maintaining an emergency preparedness training and testing program. The Centers for Medicare & Medicaid Services (CMS) believes these four elements, discussed further below, will safeguard human resources, maintain business continuity and protect physical assets during future emergencies.
The Emergency Preparedness Requirements for Medicare and Medicaid Participating Providers and Suppliers final rule took effect Nov. 16, 2016, but gives the 17 impacted provider and supplier types until Nov. 15, 2017, to meet their respective Medicare Conditions of Participation or Conditions for Coverage (CoP/CfC). CMS made changes to the CoPs/CfCs for the following types of facilities:
- hospitals
- religious nonmedical health care institutions (RNHCI)
- ASCs
- hospices
- psychiatric residential treatment facilities
- programs of all-inclusive care for the elderly
- transplant centers
- long-term care facilities
- intermediate care facilities for individuals with intellectual disabilities
- home health agencies
- comprehensive outpatient rehabilitation facilities
- critical access hospitals
- providers of outpatient physical therapy and speech-language pathology services
- community mental health centers
- organ procurement organizations
- rural health clinics and federally qualified health centers
- ESRD facilities
The new rule includes four core elements:
1. Risk assessment and emergency planning. The CoP/CfC changes require facilities to perform a risk assessment that uses an “all-hazards” approach. The all-hazards approach is described by CMS as an integrated approach to emergency preparedness planning, focusing on capacities and capabilities necessary to handle a full spectrum of emergencies or disasters. Rather than focusing on a strictly facility-based emergency (e.g., a fire), the all-hazards approach considers threats to the facility and also to the wider community.
This risk assessment forms the emergency program’s foundation. The facility should consider its unique patient population (e.g., pediatric or geriatric patients); most-likely-to-occur internal emergencies (e.g., fires or stored gases that could explode); manmade disasters (e.g., cyber-attacks, anthrax and terrorism); and natural disasters likely to occur in that geographic region (e.g., hurricanes in Florida or tornados in Illinois). While all-hazards planning does not specifically address every possible threat, it ensures that facilities consider thorough responses to a broad range of emergencies.
In the final rule, CMS revised its proposal and explicitly allowed healthcare systems to develop a unified emergency preparedness program, instead of individual plans. Each facility, however, receives a separate certification and survey under its specific CoPs/CfCs. Therefore, each facility within such a system must actively participate in the development of the program and account for its unique patient population and corresponding requirements at the facility level, in addition to the communitywide considerations.
2. Policies and Procedures. The CoP/CfC changes require each facility to develop and implement policies and procedures that make up the emergency plan and address the risks identified as part of the risk assessment. As the base standard that CMS built off of for other facility types, a hospital’s policies and procedures should include, among other things, provisions for subsistence needs for staff and patients of food, water and medical supplies when sheltering in place, and alternate sources of energy to maintain temperature and lighting within the facility upon a power outage.
Facilities should also consider policies addressing specific findings in their individual risk assessments and consider when and how transfer is appropriate. For example, CMS stated that ESRD facilities may need multiple transfer agreements in different areas in the case of a regional emergency. The format of the emergency plans and policies and procedures are largely discretionary; however, facilities are required to review and update policies and procedures annually to account for patient needs and health concerns.
For many facilities, CMS also requires a system to track patients and staff during and after the emergency to ensure the facility can share patient information with other facilities and also update relatives and friends of a patient’s whereabouts. Because not all facilities have an inpatient population, patient tracking requirements vary by provider and supplier type. For example, CMS specifically allows ASCs to stop tracking patients and staff if they cancel all future appointments and transfer patients in the facility during the emergency.
3. Communication Plan. The CoP/CfC changes also require each facility to develop and maintain an emergency preparedness communication plan to coordinate patient care across healthcare providers. The plan should consider state and local public health departments, emergency management agencies and systems, and other providers.
For example, a hospital should have a primary system of communication in place to contact staff, patients’ treating physicians, other hospitals, and other necessary persons in a timely matter; an alternate system of communication, such as internet provided by satellite, pagers or cellular telephones; and a method of sharing patient information upon evacuation and transfer of patients to another facility. Other facilities may not need to have communication with such divergent sources. For example, an ASC does not need to communicate with other ASCs during an emergency, but does need to plan to speak with patients and their families as well as hospitals to transfer acute patients. Facilities are required to review and update this communication plan annually.
4. Training and Testing. Last, the CoP/CfC changes require facilities to develop and maintain annual emergency preparedness training and testing programs with drills and exercises to test the adequacy of the emergency preparedness program. While not explicitly required, CMS assumes that training materials and testing exercises for facilities will reflect the risk assessment results. Facilities should consider not only the facility-based aspects of an emergency situation, but also their physical location, community residents and the wider community. CMS generally requires a community-based exercise (i.e., providers in the community respond to an earthquake’s aftermath as a drill) and a second exercise of the facility’s choice, but has given some flexibility if a community-based exercise is not available (or when encountering an actual emergency).
Because testing exercises are dictated by provider and supplier type, testing requirements vary. For example, due to the narrow role and unique services provided to the community, RNHCIs are not required to conduct a full-scale exercise. Rather, RNHCIs are required to conduct only an annual tabletop exercise (akin to a group discussion) along with staff training. ESRD facilities, by contrast, also need to ensure patients are informed of what to do, where to go, whom to contact, and how to disconnect their dialysis machines themselves in an emergency.
Facilities should analyze responses to testing exercises to develop further training, and document training and exercise results as proof of compliance. Further, facilities should use responses to exercises and trainings to review and update the training and testing program annually, as well as update their policies and procedures and communication plans.
* * * * *
CMS has stated that it does not anticipate providing formal technical assistance, such as CMS-led trainings, for emergency plans and policies and procedures. Rather, CMS anticipates releasing interpretive guidance in spring 2017 to aid facilities in this process. CMS encourages facilities to use their networks to collaboratively plan, leveraging resources and coordinating responses in their community.
For many facilities, this may appear daunting and cause concern about a costly new mandate. CMS estimates suggest a program that requires significant time and effort, but should not lead to full-time hires or significant consulting expenses. For example, with regard to the risk assessment alone, CMS projects this to cost a hospital not previously Joint Commission-accredited $7,408 and an ASC not previously Joint Commission-accredited $763. These estimates are based on average salaries and estimated time burdens. We anticipate some facilities will spend significantly more time and money, but this estimate suggests the level of depth CMS anticipates facilities undertaking on their risk assessment. Each of the four core elements have similar cost estimates that can help guide facilities on the effort to expend.
McGuireWoods looks forward to providing additional commentary regarding emergency preparedness programs in 2017, based in part on additional CMS guidance anticipated later this year. In the meantime, please contact an author of this alert to discuss your program further.