Report on Medicare Compliance Volume 28, Number 26. July 22, 2019

Regulation Has Four Main Requirements

There are four core CMS requirements for emergency preparedness:

1. Conduct a risk assessment and planning:Organizations must develop an all-hazards emergency preparedness plan based on a risk assessment that’s specific to the community and the services you provide. “For example, your community may be in tornado alley so you will do what you can to mitigate. Do you have a storm shelter?” But organizations also have to think more broadly—e.g., is the facility next to a chemical plant?—and determine how to continue to provide services to residents when disaster strikes. “Do I set people up in a parking lot? Move to an alternate care site? Transfer patients to another facility that I have a memo of understanding with?”

   She recommended using a free tool developed by Kaiser Permanente called the Hazard Vulnerability Analysis Tool. On their vulnerability analyses, long-term care facilities and intermediate care facilities are required to score missing residents, O’Brien said.

   An all-hazards risk assessment also should include the process and documentation for communicating with local, state, tribal and emergency management officials in the event of a disaster. A risk assessment has to be completed for every site and updated for new threats (e.g., measles).

   Organizations can’t always count on “historical modeling” to identify the risks, O’Brien said. For example, a hurricane in Hawaii in August 2018 was predicted to bring 12 to 28 inches of rain, but 47 inches came.

2. Develop policies and procedures:They must be based on an organization’s risk assessment and emergency and communication plan. The number of policies required by CMS varies by provider type, but they have to be updated annually. For example, acute-care hospitals must have nine policies and procedures, while federally qualified health centers only need four. Policies cover evacuation plans, medical documentation and the use of volunteers, among other things (see second box below).

3. Create a communication plan:It has to include the name and contact information of employees, medical staff members, contractors and volunteers, as well as emergency contact information for federal, state, local and tribal officials. She also suggested signing up for a GETS subscription, which gives priority access to emergency and national security personnel when landlines are congested. Wireless priority services also are available.

4. Do training exercises and testing:At least once a year, organizations have to train employees, residents, volunteers and contractors, and twice annually they have to do exercises (i.e., drills). One must be a community-based, full-scale exercise, and the other could be full-scale or a tabletop exercise. CMS wants organizations to test as much of their emergency preparedness plan as possible with their partners in the community so they won’t be scrambling in the event of an actual disaster or outbreak because now “there is a capacity for a community response,” O’Brien said. “The good news is the community is not defined by CMS. The community can mean a lot of things. It can be two community health centers, a hospital and a skilled nursing facility, or you and the fire department—whoever will be your partner in the disaster.”

Drills are not the five-minute tests of whether everyone got out of the building safely. “It should be an operations-based exercise where you can test your plan gaps and incident command,” she said. “Operation drills give muscle memory and being realistic is a good thing.” For example, organizations could do an active shooter drill and test their plans for evacuation and shelter. In contrast, tabletop exercises are discussions about how the organization “would respond based upon their emergency plan. The goal is to find plan gaps and update your plan based upon the findings.”

Providers also are expected to update and improve their emergency preparedness plan based on their after-action report (see first box below), O’Brien said.

O’Brien suggests doing staff notification drills on a regular basis. Call, email or text staffers at their off-hour numbers with the message: “This is a drill of our emergency notification system. Call/email/message back in 45 minutes.” That will let you identify what staff information is wrong and fix it, and improve the response rate as you repeat the exercise every six months or so.

Contact O’Brien atnora@connectconsulting.biz. Access the Kaiser tool athttp://bit.ly/2SnOlMd. View the surveyor training, which CMS has made available to providers, athttps://surveyortraining.cms.hhs.gov. ✧

After-Action Report for Emergency Preparedness Compliance

After conducting a training exercise, providers subject to the CMS regulation on emergency preparedness are expected to write an after-action report to document their drill and identify ways to improve it, says Nora O’Brien, CEO of Connect Consulting Services. The goal of an after-action report, like the one below, “is to identify any gaps in the plan” (see story above). Contact her atnora@connectconsulting.biz.

Emergency Preparedness: Policy Requirements Vary by Provider Type

These are the types of policies and procedures required by the CMS emergency preparedness regulation and which providers are required to have them, according to Nora O’Brien, CEO of Connect Consulting Services. Contact her atnora@connectconsulting.biz.