CMS Emergency Preparedness Rule: The Four Core Components

By /

The Centers for Medicare & Medicaid Services Emergency Preparedness Rule — finalized in 2016 and revised under the 2019 burden-reduction rule — requires Medicare and Medicaid participating providers and suppliers to build and maintain a real emergency preparedness program, not a binder. It applies across provider types through parallel sections of the Code of Federal Regulations: §483.73 for long-term care facilities, §482.15 for hospitals, §485.625 for critical access hospitals, and equivalents for home health, hospice, dialysis, and others. The structure is the same everywhere. This guide explains the four core components using the long-term care requirements at 42 CFR 483.73 as the worked example, notes where provider types differ, and describes what surveyors actually examine.

Component 1: The emergency plan — §483.73(a)

The facility must develop and maintain an emergency preparedness plan, reviewed and updated at least annually. The plan must do four things:

  1. Be based on a documented, facility-based and community-based risk assessment using an all-hazards approach, including missing residents. Both assessments are required — the facility’s own hazards and the community’s. “All-hazards” means the assessment cannot be a hurricane plan with a flood paragraph stapled on; it must consider the full range of credible threats. For LTC, the regulation specifically calls out missing residents as a scenario the assessment must include.
  2. Include strategies for addressing the emergency events the risk assessment identifies. The assessment is not the deliverable — the strategies are.
  3. Address the resident population — including persons at risk, the types of services the facility can actually provide in an emergency, and continuity of operations, including delegations of authority and succession plans. Surveyors read this closely: if the administrator and director of nursing are both unreachable, the plan must say who decides.
  4. Include a process for cooperation and collaboration with local, tribal, regional, state, and federal emergency preparedness officials to maintain an integrated response.

What surveyors look for: a dated risk assessment covering both facility and community hazards, a plan that visibly flows from it (strategies tied to assessed risks, not generic templates), documented annual review, and a succession plan with names or titles — not “designee TBD.”

Common failure mode: a purchased template plan with the facility’s name find-and-replaced in, no documented risk assessment behind it, and no evidence it was ever reviewed after the purchase date.

Component 2: Policies and procedures — §483.73(b)

The facility must develop and implement emergency preparedness policies and procedures based on the emergency plan, the risk assessment, and the communication plan — reviewed and updated at least annually. At a minimum, they must address eight items:

  1. Subsistence needs for staff and residents, whether evacuating or sheltering in place: food, water, medical and pharmaceutical supplies — plus alternate sources of energy to maintain temperatures for resident safety and sanitary storage, emergency lighting, fire detection and alarm systems, and sewage and waste disposal.
  2. A system to track the location of on-duty staff and sheltered residents during and after an emergency — including, if relocated, documentation of the specific name and location of the receiving facility.
  3. Safe evacuation: care and treatment needs of evacuees, staff responsibilities, transportation, identification of evacuation locations, and primary and alternate means of communication with external sources of assistance.
  4. A means to shelter in place for residents, staff, and volunteers who remain.
  5. A system of medical documentation that preserves resident information, protects confidentiality, and keeps records available.
  6. The use of volunteers and emergency staffing strategies, including the process and role for integrating state or federally designated health care professionals to address surge needs.
  7. Arrangements with other facilities and providers to receive residents if the facility must limit or cease operations.
  8. The facility’s role under a section 1135 waiver declared by the Secretary — how it provides care at an alternate site identified by emergency management officials.

What surveyors look for: policies that reference the facility’s actual risk assessment (not generic), transportation agreements with names and numbers, receiving-facility arrangements in writing, and a volunteer/staffing surge procedure that goes beyond “call everyone.”

Common failure mode: an evacuation policy that says “transportation will be arranged” with no vendor, no vehicle count, and no plan for residents who need oxygen or bariatric equipment during transport.

Component 3: The communication plan — §483.73(c)

The facility must develop and maintain an emergency preparedness communication plan, compliant with federal, state, and local laws, reviewed and updated at least annually. It must include all of the following:

  1. Names and contact information for: staff; entities providing services under arrangement; residents’ physicians; other LTC facilities; and volunteers.
  2. Contact information for: federal, state, tribal, regional, and local emergency preparedness staff; the State Licensing and Certification Agency; the State Long-Term Care Ombudsman; and other sources of assistance.
  3. Primary and alternate means of communication with the facility’s staff and with emergency management agencies. Both are required — the plan must work when the primary fails.
  4. A method for sharing information and medical documentation for residents with other health care providers to maintain continuity of care.
  5. A means to release resident information during an evacuation, as permitted under 45 CFR 164.510(b)(1)(ii).
  6. A means of providing information about the general condition and location of residents, as permitted under 45 CFR 164.510(b)(4).
  7. A means of providing information about the facility’s occupancy, needs, and ability to provide assistance to the authority having jurisdiction or the Incident Command Center.
  8. A method for sharing appropriate emergency-plan information with residents and their families or representatives.

What surveyors look for: contact lists with dates showing they are current (stale lists are among the most cited deficiencies), a genuinely independent alternate communication method — not two systems on the same network — and evidence the lists are actually used, such as call-down drill logs.

Common failure mode: a contact list last updated two administrators ago, and an “alternate means” that is the same cell network as the primary.

Component 4: Training and testing — §483.73(d)

The facility must develop and maintain a training and testing program based on the emergency plan, risk assessment, policies and procedures, and communication plan — reviewed and updated at least annually.

Training must include: initial training in emergency preparedness policies and procedures for all new and existing staff, individuals providing services under arrangement, and volunteers, consistent with their expected roles; annual refresher training; documentation of the training; and a demonstrated staff knowledge of emergency procedures — surveyors will ask staff directly, and “I think there’s a binder” is a finding.

Testing — for LTC facilities, the bar is specific: exercises at least twice per year, including unannounced staff drills using the emergency procedures. Specifically:

  • (i) An annual full-scale exercise that is community-based — or, when a community-based exercise is not accessible, an annual individual, facility-based functional exercise. If the facility experiences an actual emergency requiring plan activation, it is exempt from the next required full-scale exercise.
  • (ii) An additional annual exercise: a second full-scale exercise, a mock disaster drill, or a facilitated tabletop using a narrated, clinically relevant scenario with problem statements and directed messages designed to challenge the plan.
  • (iii) Analyze the response, document everything, and revise the emergency plan as needed. The after-action is not optional — it is the mechanism that closes the loop back into Component 1.

What surveyors look for: drill and exercise documentation with dates, participants, scenarios, and — critically — the after-action analysis and evidence the plan was revised as a result. An exercise file with no corrective actions reads as theater.

Common failure mode: two tabletops a year with the same attendees, no unannounced drills, no documentation beyond a sign-in sheet, and a plan that has never changed because nothing was ever found wrong.

Two things beyond the big four

The LTC section contains two additional elements worth knowing. Paragraph (e) requires emergency and standby power systems — generator location, inspection, testing, and maintenance per NFPA 99, NFPA 101, and NFPA 110, plus a fuel plan for keeping generators running during the emergency. Paragraph (f) allows facilities in multi-facility health systems to use a unified, integrated emergency preparedness program, provided each facility actively participated in its development and it accounts for each facility’s unique population and services. Neither replaces the four components — they sit on top of them.

A note on provider-type differences

The four-component structure is consistent across the rule, but details vary by provider type — always verify your own section. The testing cadence above is the LTC standard at §483.73(d); hospitals (§482.15), critical access hospitals, and inpatient hospice follow similar annual cycles, while most outpatient providers and suppliers test on a two-year cycle under the 2019 revisions. Do not assume the LTC cadence applies to your facility type — read your section.

How this connects

The CMS rule is the regulatory expression of the same disciplines this site covers as practice. For the operational side, see the Healthcare Continuity Compliance guide (CMS, Joint Commission, and HIPAA requirements in one frame), the Emergency Exercises and Drills guide (tabletop, functional, and full-scale design), and the Crisis Communication Protocols guide (incident command and stakeholder notification) — the rule tells you what must exist; those guides show how to build it well.

Scroll to Top