When surveyors evaluate compliance with the CMS emergency preparedness regulation, they evaluate how well health care organizations would respond in a real disaster, not just on paper. So far, so good, according to CMS. As of Sept. 30, 2018, 78% of providers surveyed met the emergency preparedness requirements in the Medicare conditions of participation, with only 4% of hospitals cited for deficiencies, although nursing homes didn’t fare as well, with 22% of nursing homes tagged. But they also face a new challenge: CMS in February 2019 added infectious diseases like Ebola to emergency operation plan requirements.
The emergency preparedness regulation, which took effect Nov. 15, 2017, requires providers and suppliers to have an emergency preparedness program in case of natural and other disasters and to put it to the test. The regulation applies to 17 types of providers, including hospitals, home health agencies, long-term care facilities and psychiatric residential treatment facilities. Providers must implement an all-hazards approach to emergency preparedness, which includes hurricanes, floods, viruses and terrorism, and coordinate with local, state, federal and tribal agencies, said Nora O’Brien, CEO of Connect Consulting Services.
“CMS wants you not just to have a binder the five people who lead the drills know about, but to develop an overall comprehensive approach to meeting the health and safety needs of patients and also staff and visitors,” O’Brien said at a webinar sponsored by the Health Care Compliance Association June 19.
Providers are expected to reach out as they prepare for a crisis. “What is woven into CMS requirements for emergency management and business continuity is that when you know your planning partners in advance of a disaster, your community is more resilient,” she said.
Disasters can be unpredictable and have ripple effects. For example, the November 2018 Camp Fire in Paradise, California, which killed at least 85 people and caused total damage of $18.5 billion, had a secondary issue of a norovirus outbreak across evacuation shelters. “We had to put in much stronger infectious disease procedures to address the outbreak,” O’Brien said. “Often in disasters, you don’t have just one event but secondary events.” Feather River Hospital, a 101-bed acute care hospital in rural Paradise and the largest employer, had to shut down. “It wasn’t severely damaged, but there was no housing for staff,” she explained. “It would have taken until 2020 to have housing, and it would be too long a recovery time, so the hospital was closed.”
Regulation Has Four Main Requirements
There are four core CMS requirements for emergency preparedness:
-
Conduct a risk assessment and planning:Organizations must develop an all-hazards emergency preparedness plan based on a risk assessment that’s specific to the community and the services you provide. “For example, your community may be in tornado alley so you will do what you can to mitigate. Do you have a storm shelter?” But organizations also have to think more broadly—e.g., is the facility next to a chemical plant?—and determine how to continue to provide services to residents when disaster strikes. “Do I set people up in a parking lot? Move to an alternate care site? Transfer patients to another facility that I have a memo of understanding with?”
She recommended using a free tool developed by Kaiser Permanente called the Hazard Vulnerability Analysis Tool. On their vulnerability analyses, long-term care facilities and intermediate care facilities are required to score missing residents, O’Brien said.
An all-hazards risk assessment also should include the process and documentation for communicating with local, state, tribal and emergency management officials in the event of a disaster. A risk assessment has to be completed for every site and updated for new threats (e.g., measles).
Organizations can’t always count on “historical modeling” to identify the risks, O’Brien said. For example, a hurricane in Hawaii in August 2018 was predicted to bring 12 to 28 inches of rain, but 47 inches came.
-
Develop policies and procedures:They must be based on an organization’s risk assessment and emergency and communication plan. The number of policies required by CMS varies by provider type, but they have to be updated annually. For example, acute-care hospitals must have nine policies and procedures, while federally qualified health centers only need four. Policies cover evacuation plans, medical documentation and the use of volunteers, among other things (see second box below).
-
Create a communication plan:It has to include the name and contact information of employees, medical staff members, contractors and volunteers, as well as emergency contact information for federal, state, local and tribal officials. She also suggested signing up for a GETS subscription, which gives priority access to emergency and national security personnel when landlines are congested. Wireless priority services also are available.
-
Do training exercises and testing:At least once a year, organizations have to train employees, residents, volunteers and contractors, and twice annually they have to do exercises (i.e., drills). One must be a community-based, full-scale exercise, and the other could be full-scale or a tabletop exercise. CMS wants organizations to test as much of their emergency preparedness plan as possible with their partners in the community so they won’t be scrambling in the event of an actual disaster or outbreak because now “there is a capacity for a community response,” O’Brien said. “The good news is the community is not defined by CMS. The community can mean a lot of things. It can be two community health centers, a hospital and a skilled nursing facility, or you and the fire department—whoever will be your partner in the disaster.”
Drills are not the five-minute tests of whether everyone got out of the building safely. “It should be an operations-based exercise where you can test your plan gaps and incident command,” she said. “Operation drills give muscle memory and being realistic is a good thing.” For example, organizations could do an active shooter drill and test their plans for evacuation and shelter. In contrast, tabletop exercises are discussions about how the organization “would respond based upon their emergency plan. The goal is to find plan gaps and update your plan based upon the findings.”
Providers also are expected to update and improve their emergency preparedness plan based on their after-action report (see first box below), O’Brien said.
O’Brien suggests doing staff notification drills on a regular basis. Call, email or text staffers at their off-hour numbers with the message: “This is a drill of our emergency notification system. Call/email/message back in 45 minutes.” That will let you identify what staff information is wrong and fix it, and improve the response rate as you repeat the exercise every six months or so.
Contact O’Brien atnora@connectconsulting.biz. Access the Kaiser tool athttp://bit.ly/2SnOlMd. View the surveyor training, which CMS has made available to providers, athttps://surveyortraining.cms.hhs.gov. ✧
After-Action Report for Emergency Preparedness Compliance
After conducting a training exercise, providers subject to the CMS regulation on emergency preparedness are expected to write an after-action report to document their drill and identify ways to improve it, says Nora O’Brien, CEO of Connect Consulting Services. The goal of an after-action report, like the one below, “is to identify any gaps in the plan” (see story above). Contact her atnora@connectconsulting.biz.
EMERGENCY MANAGEMENT FORM: Hot Wash Critique/After-Action Report
INSTRUCTIONS: (Leader in Charge – Complete and Return the Form to Emergency Management)
-
Event participants complete this form as a group immediately after the event, find a location to huddle.
-
FEEDBACK IS USED FOR PROCESS IMPROVEMENT MEASURES ONLY, INDIVIDUALS ARE IN A NO-FAULT ENVIRONMENT.
-
Circle the Event Type or Scenario, enter the Event Details and Participants, give the Details of the Situation and include the Precipitating Factors.
-
List any identified strengths (things that went well) and opportunities (things that did not go well).
-
The emergency response performance, strengths and opportunities should relate to the policies, procedures, forms, and available tools and resources.
-
DO NOT use patient names or specific patient information.
EVENT TYPE (Check all that apply)
Facility Alert | Security Alert | |||
---|---|---|---|---|
|
|
|
|
|
EVENT DETAIL and PARTICIPANTS
Facility Name and Address: | Department/Unit: | Room#: | ||
Leader in Charge of Response: | Contact #: | |||
Date: | Start Time: | All Clear Time: | Security Called: | |
Exercise/Drill (Yes or No) | Overhead Announcement (Yes or No) | Time of Announcement: | ||
Response Priority (ALERT – PRIORITY 2 – PRIORITY 1) | External Agency Involved (Yes or No) | |||
List Personnel and Related Department Involved: | ||||
EVENT SITUATION (NARRATIVE – TIMELINE – PRECIPITATING FACTORS)
DESCRIBE THE SITUATION AS IT OCCURRED IN FULL DETAIL (FACTS)/COPY AND PASTE SECURITY REPORT NARRATIVE
PERFORMANCE/ACTIONS RATING (1= Poor, 2= Fair, 3= Good, N/A= Do Not Score)
Communicationmessages/methods/channels internal and external were effective | 1 | 2 | 3 | N/A |
All necessarySupply/Materialswere available | 1 | 2 | 3 | N/A |
Safety/Securitywas a focus and was effective | 1 | 2 | 3 | N/A |
Staffunderstood their role and took appropriate actions | 1 | 2 | 3 | N/A |
Utilitysystems functioned properly (water, electricity, heat/air, etc.) | 1 | 2 | 3 | N/A |
Patient Carewas delivered safely and appropriately | 1 | 2 | 3 | N/A |
Average | ||||
Identified Strengths (What went well?): | ||||
1 | ||||
2 | ||||
Identified Opportunities (What did not go well?): | ||||
1 | ||||
2 |
Emergency Preparedness: Policy Requirements Vary by Provider Type
These are the types of policies and procedures required by the CMS emergency preparedness regulation and which providers are required to have them, according to Nora O’Brien, CEO of Connect Consulting Services. Contact her atnora@connectconsulting.biz.
CMS Policies & Procedures
Policies and Procedures Needed By Provider or Supplier Type | RHCs/FQHCs/PCC | PACE | Clinics, Rehab, PHA as OPT/Speech | LTC | ICF/IIDs | Hospitals |
---|---|---|---|---|---|---|
Safe Evacuation | Yes | Yes | Yes | Yes | Yes | Yes |
Shelter in Place | Yes | Yes | Yes | Yes | Yes | Yes |
Medical Documentation | Yes | Yes | Yes | Yes | Yes | Yes |
Use of Volunteers | Yes | Yes | Yes | Yes | Yes | Yes |
Subsistence Provision | No | Yes | No | Yes | Yes | Yes |
Staff and Client Tracking | No | Yes | No | Yes | Yes | Yes |
Informing Partners | No | Yes | No | No | No | No |
Develop Arrangements | No | Yes | No | Yes | Yes | Yes |
1135 Waivers | No | Yes | No | Yes | Yes | Yes |
Emergency Equipment | No | Yes | No | No | No | Yes |